Your personal data – what is it?

Personal data means any data which identifies a living person. Processing personal data (collecting, storing, using, altering, sharing or destroying personal information) is governed by the General Data Protection Regulation 2016/679 (known as GDPR).

Who are we?

Cwmpas, formally known as The Wales Co-operative Centre Ltd  is the data controller (contact details below). This means it decides how your personal data is processed and for what purposes.

How do we process your personal data?

If you are a website user with general public and anonymous access, the Cwmpas’s website does not capture or store personal information about you but simply logs your IP address, which is automatically recognised by our web server. This is known as a ‘log file’ which we use to compile site usage statistics. The site does not use cookies to collect user information.

Some areas of our website, including enquiry/contact forms and areas needing registration, require you to provide personal information. Cwmpas complies with its obligations under GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for the following purposes: –

• To deliver the web-based services or information you’ve requested from us
• To monitor and report on the number of individuals and enterprises making enquiries or using web-based services, and the number of people from different groups being supported
• To fulfil the reporting requirements of our project funders
• To evaluate the impact of web-based services on the individuals and enterprises who took part
• For audit and verification purposes
• To inform you about similar services, activities or events (in accordance with the Privacy and Electronic Communications Regulations)

What is the legal basis for processing your personal data?

Processing is necessary for the performance of a contract we have with you to deliver a service, or to take steps to enter into a contract with you.

Processing is also necessary for the legitimate interests of Cwmpas, so that we can monitor and evaluate our services and inform you about similar services, activities or events.

Provision of your data is a contractual requirement – without it, we are unable to deliver the service you have requested from us.

Sharing your personal data

Your personal data will be treated as strictly confidential, and will be shared only with the following:

• Third parties acting on our behalf who are helping us deliver the service
• Third parties acting on our behalf who are helping us evaluate the service
• Funders who have paid for the service
• Third parties are contractually required to protect your data and comply with GDPR.

The Centre will never pass on your information to another organisation for them to market directly to you or your organisation.

How long do we keep your personal data?

Our project funders determine how long we must keep your data. Your data is kept for no longer than necessary in case of any complaints, legal claims or auditing queries. For details of specific project retention dates, please contact us using the details below.

Your rights and your personal data

You have the following rights with respect to your personal data:

• The right to request a copy of your personal data which the Cwmpas holds about you;
• The right to request that Cwmpas corrects any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for the Cwmpas to retain such data;
• The right to request that Cwmpas provides you with your personal data and where possible, to transmit that data directly to another data controller;
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data;
• The right to lodge a complaint with the Information Commissioners Office.

Transfer of Data Abroad

Where Cwmpas uses platforms outside the UK to process data (such as website providers, MailChimp, Eventbrite or Survey Monkey), we have satisfied ourselves that these platforms adhere to the EU-US Privacy Shield Framework as set forth by the European Commission and the US Department of Commerce regarding the collection, use and retention of personal data from European Union member countries, and have adequate measures in place to protect your data and comply with GDPR.

Automated Decision Making

We do not carry out automated decision making with your personal data.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use before we start the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

To exercise all relevant rights, queries or complaints please in the first instance contact the Cwmpas’s Director of Corporate Services on 0300 111 5050 or via email info@cwmpas.coop or at Y Borth, 13 Beddau Way, Caerphilly, CF83 2AX.

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.