Your privacy is important to Business Wales. This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).
Please take a moment to familiarise yourself with our privacy practices.
Why we collect and process the data collected
The Welsh Government will be the Data Controller for the personal data you provide in accessing Business Wales support.
The legal basis for processing your personal data is section 6(1)(e) of the UK GDPR (lawfulness of processing).
This processing is necessary for the performance of our public task to identify you and provide the most appropriate business advice and information.
We will process the following personal and business data:
- Name.
- Address.
- Contact information.
- Information about your business (such as a business plan or business balance sheets or cashflow).
- Turnover for most recent FY (or ideally last 3 FYs).
- Workforce – FTEs plus average wage and qualification levels
Company location (local authority level). - Qualitative descriptor of business activity e.g. service or product. To provide a more granular level of intelligence beyond SIC code and to enable analysis in relation to likely future sectors.
- Markets served (spatial and sectoral) and whether they export
- Basic info on financials (e.g. top line liquidity ratio analysis or other) to provide inference on health/survivability.
Failure to provide us with this information may preclude you from accessing the service.
Demographic data
We also collect demographic information.
The legal basis for processing demographic data is section 6(1)(e) of the UK GDPR (lawfulness of processing). This processing is necessary for the performance of our public task; that is, exercising our official authority to undertake the core role and functions of the Welsh Government.
Some of the data we collect is called ‘special category data’ (in this case your ethnicity and disability status).
Under Article 9(2)(j) of the UK GDPR, Business Wales will process special category data where it is necessary for statistical research purposes in accordance with Article 89(1) of the UK GDPR, provided the processing is proportionate to the aim pursued, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The information collected in the Business Wales service, for example, might be used to:
- Plan future business support provision.
- Understand the impact of the support on businesses in Wales.
- Ensure the reach of the service reflects the community of Wales.
Marketing and Research
We may contact you to request your permission to use your business details for Business Wales marketing activities. The Welsh Government will not use your data without your consent for this particular purpose.
Please note that research organisations/evaluators will only contact a sample of individuals and/or enterprises. If you are contacted to take part in any research/evaluation about your experience on the project the purpose of the interview or survey will be explained to you and you will be given the option to say yes or no to taking part. Your contact details will only be used for approved research and will be deleted once this approved research is complete.
Who will have access to your data?
Business Wales and its third-party service contractors will collect and store your data.
Your data will be stored on a Welsh Government secure IT System within the UK and the secure IT systems of our third-party service contractors delivering the service to you.
It is collected and shared with the following organisations for the purposes previously listed:
- Approved social research organisations, to carry out research, evaluation, analysis or equal opportunities monitoring of the service.
- Welsh Government support service teams and its system technical administrators who support the IT system. System technical administrators will not use your details in any way.
- Wales Audit Office or those acting on their behalf, or other appropriate auditors of the Business Wales Services.
- Other business support providers and public bodies, including Neath Port Talbot Council and UK Government, when appropriate.
How long do we keep it?
Welsh Government will keep your personal data for a minimum of 10 years after the project ends for auditing purposes, after which time it will be securely destroyed.
What are your rights?
Under the data protection legislation, you have the right:
- to access the personal data the Welsh Government holds on you;
- require us to rectify inaccuracies in that data
- to (in certain circumstances) object to or restrict processing
- for (in certain circumstances) your data to be ‘erased’
- to lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection
The contact details for the Information Commissioner’s Office are:
Customer Contact
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545 745 or 0303 123 1113
Website: www.ico.org.uk
For help with any of the above rights then please contact our Business Wales Helpline 03000 6 03000 or use the contact us form.
Rydym yn croesawu galwadau yn Gymraeg / We welcome calls in Welsh.
The Freedom of Information Act and your Information
The Freedom of Information Act 2000 and the Environmental Information Regulations 2004 allow the public to ask to see information held by public bodies, including the Welsh Government. The information you provide us may be the subject of a freedom of information request by another member of the public. We would consult with you to seek your views before responding to such a request.
Changes to this policy
The Welsh Government may make changes to this privacy policy at any time. Changes will be posted here and are effective immediately. When changes occur to this policy we will contact you on the email address we have recorded in your account to enable you to review the new version.
For further information on your information rights
Postal address:
Data Protection Officer
Welsh Government
Cathays Park
CARDIFF
CF10 3NQ
Email address: DataProtectionOfficer@gov.wales