Cymraeg

Privacy Policy

Introduction

Adnodd is strongly committed to protecting personal data. This privacy policy explains the following:

  • who we are
  • what information we collect
  • how we collect your information, why we need it and how we use it
  • what legal basis we have for processing your personal data
  • when we share personal data
  • where we store and process personal data
  • how we secure personal data
  • how long we keep personal data for
  • your rights in relation to personal data including your rights to withdraw consent
  • links to other websites and third-party materials
  • how to contact us including how to make a complaint with a supervisory authority
  • how and when we review our privacy notice

This policy sets out how Adnodd handles the Personal Data of suppliers, employees, and other third parties.  

The policy applies to all personal data Adnodd process regardless of:  

  • the media on which that data is stored   
  • whether it relates to past or present employees, clients or supplier contacts, website users, or any other data subject.  

We recommend you read this privacy policy thoroughly. Please contact us with any questions or concerns regarding our privacy practices. Our contact details are on our website and contained within this privacy policy.

Who we are

Adnodd is a Limited Company (14227941) which is wholly owned by the Welsh Government. Adnodd acts as a Data Controller in the following circumstances:

  • Data Controller – data collected to enable us to conduct normal business as Adnodd Cyfyngedig

Our Data Protection Officer is Emyr George, Chief Executive, who may be contacted by email on post@adnodd.llyw.cymru

What information do we collect?

When we talk about personal data or personal information, we are only referring to information from which an individual person can be identified. It does not include data where the identity has been removed.

Our engagement activities across Wales, the UK and internationally, are fundamental to our success. We collect and process information with key strategic partners across the education and wider public sector, professional services provides, and others involved in the creation, quality assurance, promotion and delivery of education resources.  

For the purposes of this policy, personal data includes the following categories of information:

  • identity data which includes your name, date of birth, business interests and gender
  • financial data including billing address, account details, bank account holder details and bank card details
  • contact data (email address, telephone number)
  • marketing and communications data – preferences for receiving marketing
  • special categories of data as part of our recruitment processes which may include:
  1. Racial or ethnic origin supplied voluntarily during the recruitment process
  2. Declaration of offences during the recruitment process under the Rehabilitation of Offenders Act as part of our duty to follow HM Government’s Baseline Personnel Security Standards (BPSS)

To put this into context, it includes personal information collected when:

  • you contact us
  • you attend an event organised by us, in person or online
  • you are a stakeholder or a member of a special interest group
  • you apply for a job with us
  • you supply goods or services to us
  • you book an event or meeting with Adnodd

This includes all forms of communication with us, including email, social media, verbal and telephone communication

How we collect your information, why we need it, and how we use it

When you contact us about the work we do, we will handle your data with the utmost care and are sensitive to the need to handle all data lawfully, fairly and transparently.

The methodology of collection varies but includes and is not exclusive to information gathered:

  • from email or written contact
  • from telephone contact
  • from an online form on our website
  • verbally or in writing at, or in relation to, events held by Adnodd or partners
  • in support of special interest groups, programmes and projects
  • on social media e.g., Meta, X, YouTube, and LinkedIn
  • and information supplied by third parties or taken from publicly available sources, e.g. Companies House

You should also be aware of our responsibilities under Freedom of Information legislation, our remit to provide information to meet internal and external audit requirements and our legal obligations (e.g., fraud prevention).

What legal basis we have for processing your personal data

We always ensure we have a legal basis for processing personal data. The legal bases we use are as follows:

  • where processing is necessary for the performance of a contract to which the data subject is party
  • where the data subject has given consent to the processing of his or her personal data for one or more specific purposes
  • where processing is necessary for compliance with a legal obligation to which we are subject
  • where processing is necessary to protect the vital interests of the data subject or of another natural person
  • where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (the controller)
  • where processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

To put these legal bases for processing personal data into context, we will use the personal data and information we collect for the following purposes:

  • to reply to any enquiry you make, and to provide you with information regarding the services we provide and our functions as a company
  • to deliver on any of our programmes of work and other services we offer
  • to make a payment to you including a transfer of funds on completion of a transaction on which you have provided services to us
  • to manage our relationship with you
  • to comply with our legal and regulatory obligations
  • to deal with any client feedback or complaint you may make
  • to administer, develop and improve our business
  • to protect our business e.g., should it be necessary to defend any legal claim
  • to make suggestions and recommendations to you about the services we undertake, and which may be of interest to you
  • to promote funding streams and opportunities via targeted marketing
  • to invite you to any hospitality or networking events (physically and online) we may hold or of which we may be a party, and which may be of interest to you
  • to facilitate an introduction of a partner to a business connection where the partner requires the services of the relevant business connection.

We must have a lawful reason for processing your personal information. Most commonly, we will use your personal information in the following circumstances:

  • where we need to deliver the programme or perform the contract for services we are about to enter or have entered in to with you
  • where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
  • where we need to comply with a legal or regulatory obligation
  • where you have given your consent to process your personal information

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Information is only held for as long as there is a legitimate reason to do so, information that is no longer required is destroyed in such a way that it cannot be reconstructed. If you wish to obtain an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

When we share personal data: disclosure of information for legal or regulatory purposes

We may need to disclose your information to a third party as part of ongoing programme management and audit requirements.

Additionally, as part of our remit to conduct due diligence we may also need to release information to progress governance checks for specific requirements, programmes, other parties or projects. We will carry out this process lawfully, proportionately, and securely.

Third parties include:

  • external advisors and consultants directly engaged with programme/project delivery (please note that all advisors/consultants are bound by confidentiality requirements in their contracts)
  • Welsh Government, organisations who provide funding and/or support for innovation, our professional advisers e.g., lawyers, bankers, accountants
  • third party service providers who provide administrative and support services to us
  • HMRC

We will ensure that if information is required to be shared, then it will be shared securely, and you will be informed that we have shared it, who we have shared it with and how we shared it.

Where do we store and process personal data?

Adnodd data is stored within:

  • Microsoft 365
  • Xero financial support tool
  • Zoom

We undertake regular security reviews of all our third-party platforms and conduct risk assessments as required under Article 35 of the UK GDPR and Chapter 2 of the Data Protection Act 2018 (UK GDPR) to comply with our duty as a Data Controller. The systems identified are third party systems which have not been created by or owned us and are outside our control with their own privacy policies. Please contact our Data Protection Officer for further information should you wish to understand how your data is processed by the relevant platform.

Adnodd outsources its accounting activity to a third-party. The current contractor is Azets. Azets do not transfer data outside the EEA. The Privacy Policy for Azets can be found here.

How do we secure personal data?

We have in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised manner or otherwise used or disclosed.

To achieve this, we use encrypted secure technology to protect all personal information stored by us. We operate up to date and regularly review policies for Data Protection, Password Policy, Information Security and Business Continuity (including Risk Assessments on the DPIA process and individual risk assessments) to support our business processes and to ensure that all personnel are aware of the importance of data security.

Access to information is permitted on a need-to-know basis.

How long do we keep your personal data for?

We only keep and process personal data for as long as there is a contractual or business requirement to do so, or we are otherwise obliged to keep the same under any contractual, regulatory, or legal requirement.  Once the requirement has expired, the information is deleted safely and securely from our systems in such a way that information which is deleted is done so in accordance with current security regulations.

Keeping us up to date

As part of our responsibility to ensure that information we hold about you is up to date, we rely on you to keep us updated. We request that where any of your details change, that you inform us so that we may update our records accordingly.

Your legal rights in relation to personal data including your rights to withdraw consent

As a data subject, you have rights in relation to your personal data. These are:

  • you have a right to access your personal information
  • you have a right for incorrect information held about you to be rectified
  • you have a right for information which you no long wish us to hold to be erased (also known as the right to be forgotten)
  • you have a right for the processing of your information to be restricted
  • you have a right to data portability – for your personal information to be transported in a structured, commonly used, recognisable format
  • you have a right to object to the processing of your personal information
  • you have a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you

You also have the right to make a Subject Access Request. As part of this process, you will be able to ascertain:

  • whether or not your data is processed, and if so, why
  • the categories of personal data concerned
  • the source of the data if you have not provided the original data
  • to whom your data may be disclosed, including outside the EEA and the safeguards that apply to such transfers

We reserve the right to validate your identity prior to release of information.

We will not make any charges for such requests unless the requests made repeatedly and are considered excessive. We will respond to you request within 28 days. We provide a form for you to fill in which we use to ensure that your rights are addressed in full.

If you have provided consent to Adnodd to process any of your data, then you also have a right to withdraw that consent unless we are contractually or legally obligated to retain data. Withdrawal of consent will also result in withdrawal of support from the Adnodd services or programme(s) to which you are signed up. In cases where we do not need to retain data for contractual or legal reasons, we will delete the data as soon as possible and at the very least within 28 days.

Links to other websites and third-party contact

Adnodd may link to external sites and resources as part of our normal business activity. This includes news stories and links to other websites as part of the information being shared on our website (e.g. stories about educational resources backed by supporting information from Welsh Government). Use of those links may allow third-parties to collect or share your personal information. As we have no control over how such third parties may collect and share your information, we do not take any responsibility for their use of your information.

How to contact us, including how to make a complaint with a supervisory authority

You can contact Adnodd through several different routes. We will deal with your enquiry in the same way regardless of how you choose to contact us or whether you contact us in Welsh or English.  For further information on how Adnodd processes your data, please contact us at post@adnodd.llyw.cymru 

If you are unhappy with the way in which your personal data has been processed and wish to raise a complaint, please do so by emailing us at post@adnodd.llyw.cymru . We will handle your complaint sensitively, and confidentially and will write to you with a response within 10 working days.

If you are dissatisfied, you have the right to communicate directly to the Information Commissioner (ICO). The Information Commissioner can be contacted at:

Information Commissioner’s Office – Wales
2nd Floor
Churchill House
Churchill Way
Cardiff
CF10 2HH

Telephone: 029 2067 8400
Fax: 029 2067 8399
Email: wales@ico.gsi.gov.uk

To help resolve any questions, concerns or complaints you may have as quickly as possible, we encourage you to contact us first, before contacting the ICO.

Review of the privacy policy

We regularly review all our policies and procedures, we will post updates on our documentation and webpage. This privacy policy was last reviewed and amended on 16 October 2024