Privacy Policy
We will only process your personal data when there is a legal basis to do so under the UK GDPR and UK Data Protection Act 2018.
1. Who is the data controller?
1.1. Qualifications Wales is a ‘data controller’ as defined by Article 4(7) of the General Data Protection Regulation (GDPR).
1.2. We are the controller of the personal data we process, unless otherwise stated.
1.3. As a data controller, we determine the purposes and means of processing your personal information, ensuring it is managed lawfully and securely in accordance with data protection legislation.
1.4. We have an appointed Data Protection Officer, and their contact details are:
Catherine English
Qualifications Wales
Q2 Building, Pencarn Lane
Imperial Park
Coedkernew
Newport
NP10 8AR
01633 373222
Informationgovernance@qualifications.wales
2. What data do you collect?
2.1. To perform our statutory function as a regulator, we need to collect and use your personal data and sometimes your special category personal data.
2.2. We collect the following personal data:
a) personal identifiers – this may include your name, date of birth, national insurance number, unique pupil number, organisation name, and job title.
b) contact details – this may include your home or work address, phone number, and email address.
c) characteristics – for example, your age and language preferences
d) qualifications taken, subjects taught and education provider.
e) employment details
f) views and opinions
g) special category data – this may include your race, ethnic origin, trade union membership, religious beliefs, health data, and sexual orientation.
h) photos
i) videos.
2.3. There may be instances where we will anonymise your data. For example, in a survey we may not need your name or contact details. In which case, we will only collect your survey responses.
3. How do you collect my data and what do you use it for?
3.1. We collect your personal data through the following processes:
a) our regulatory activities and statutory obligations
b) the collection of learner data from awarding bodies and other public bodies for research and statistical purposes and to perform our function as a regulator.
c) engagement, research, and consultation with you as a stakeholder.
d) when you register to attend a stakeholder event.
e) when you contact us with an enquiry, complaint, data right request, application, or Freedom of Information request.
f) when you apply for a job with us or if you are a current or former employee.
g) when applying for recognition as an awarding body.
h) when you visit our websites.
i) when you subscribe to one of our mailing lists.
j) when visiting our office.
k) when using our EV charging points; and
l) when entering a contract for goods or services with us.
3.2. We collect this data so that we can:
a) perform our function as a regulator.
b) ensure that qualifications, and the Welsh qualification system, are effective for meeting the reasonable needs of learners in Wales.
c) promote public confidence in qualifications and in the Welsh qualifications system.
d) respond to general enquiries.
e) investigate complaints or concerns raised by you or other individuals.
f) assist with the research and planning of new council services.
g) keep stakeholders updated on the work of Qualifications Wales
h) comply with our statutory obligations.
4. Who has access to my personal data?
4.1. We may hold your personal data on databases and systems so that we can provide information to you and easily identify you if you contact us. Access to your personal data is strictly restricted and officers of Qualifications Wales may only access your personal data if they need it for a task they are working on and are authorised to do so.
5. Do you use external data processors?
5.1. Yes, we sometimes use external data processing organisations. We have contracts and data processing agreements in place with our data processors. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal information with any organisation apart from us unless they are authorised to do so and there is an appropriate sub-processing agreement in place. Third party processors and sub-processors must comply with data protection legislation and must hold your personal data securely, retaining it for the period we instruct.
5.2. When the work finishes or the contract ends, the external processor will give your personal data back to Qualifications Wales if needed and will then securely delete or destroy it.
6. Do you share information with other organisations?
6.1. Yes, in some circumstances we are legally obligated to share information. For example, under a court order or where we cooperate with other authorities in handling complaints or investigations. We might also share information with other regulatory bodies to further their, or our, objectives. In such instances, we will ensure that there is a valid legal basis for sharing your information, and we will record our decision-making process accordingly. We may not have to tell you if we share your personal information with other organisations in this way.
6.2. Our internal auditors, data protection officer, and external auditors may also have access to your personal data to complete their work. We will only share personal data with another organisation if we have a lawful basis to do so, and we will always keep records of when your data has been disclosed to another organisation.
6.3. We also share personal data with The National Archives. As a public authority we must comply with the Public Records Act 1958. We are required to retain and transfer records of historical significance to The National Archives after 20 years in line with their Collection Policy.
6.4. We only share personal data when it is fair and lawful. We do not share personal data with any third parties for the purposes of direct marketing.
7. What is your lawful basis?
7.1. There are various legal reasons for us to collect and use your personal data.
7.2. Our main lawful basis for collecting and using your personal data is to enable us to fulfil our public task as the regulator for the qualifications system in Wales and to exercise our official functions under the Qualifications Wales Act 2015 under Article 6(1)(e) GDPR.
7.3. Where you give us clear consent to process your personal data for a specific purpose our lawful basis will be consent under Article 6(1)(a) GDPR.
7.4. Where processing is necessary for the performance of a contract to which you are a party, then our lawful basis will be Article 6(1)(b).
7.5. Where processing is necessary to comply with our legal obligations, our lawful basis will be Article 6(1)(c).
7.6. Where we are collecting and processing data using other legal powers, we will let you know.
7.7. When collecting and processing special category data we usually use the legal basis of explicit consent to process this information. In situations where we are required to process special category data for legal or statutory reasons, we will inform you of the legal basis and safeguards in place. Otherwise, you are free to withdraw your consent at any time, and we will stop processing your special category data unless there is another lawful basis for us to continue doing so.
8. How long will you keep my personal data?
8.1. We will only keep your personal data for as long as it is needed for the purpose it was collected, or for as long as is required by legislation, and will destroy it when we no longer need to retain it for those purposes. There are different retention periods for different types of information.
9. Do you transfer personal data outside of the UK?
9.1. Usually, the information that we hold is within the UK. However, some information may be held on computer servers which are outside of the UK. In these cases, we will take all reasonable steps to make sure your data is not processed in a country that the UK government does not consider to be ‘safe’. If we do need to send your data out of the UK, we will ensure it has extra protection from loss or unauthorised access.
10. What are my data protection rights?
10.1. Under data protection legislation, you have rights when it comes to the processing of your personal data. The rights available to you depend on the reason for processing your information.
10.2. Subject to some legal exceptions, you have the right to:
a) Access – you have the right to ask us for a copy of your personal information. This right always applies, although there are some exemptions which mean you may not always receive all the information we process.
b) Rectification – you have the right to ask us to rectify information you think is inaccurate. This right always applies.
c) Erasure – you have the right to ask us to erase your personal information. However, this right only applies in certain circumstances.
d) Restriction – you have the right to ask us to restrict the processing of your information However, this right only applies in certain circumstances.
e) Object – you have the right to object to processing. However, this right only applies in certain circumstances, and we may not need to stop if we can give strong and legitimate reasons to continue using your data.
f) Portability - this only applies to information you have provided to us, and which is held electronically. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering a contract and the processing is automated.
10.3. You can find out more about your rights by visiting the ICO website here: Your data protection rights | ICO
11. Do you process children’s and young people’s data?
11.1.Yes, we sometimes receive and process information relating to children, such as when we are dealing with complaints involving young people or carrying out investigations that concern them. Additionally, children may provide us with their own information directly, for example, when they choose to register for our engagement platform or take part in research studies we organise. This information can include names, contact details, and other relevant personal data necessary for us to fulfil our statutory duties.
11.2. The information outlined in this notice applies equally to children and adults alike. We are committed to safeguarding the privacy and rights of children in the same way we do for adults, ensuring that all personal information is managed securely and in accordance with the applicable data protection laws.
11.3. We also recognise the importance of making our privacy notices and other data processing documentation accessible and easy to understand for children and young people. We strive to provide information in a clear and age-appropriate manner so that children and young people are aware of how their data is being used and what rights they have regarding their personal information.
12. How can I complain about the way in which you have handled my personal data?
12.1. If you have concerns about the way in which we have handled your personal data, please contact our Data Protection Officer:
Catherine English
Qualifications Wales
Q2 Building, Pencarn Lane
Imperial Park
Coedkernew
Newport
NP10 8AR
01633 373222
informationgovernance@qualifications.wales
12.2. If the Data Protection Officer is unable to resolve your concerns, or if you are not satisfied with the response provided, you may make a complaint using our Corporate Complaints Policy, which includes a section addressing data protection concerns.
You can also complain to the Information Commissioner's Office (the data protection regulator) about the way in which we have handled your personal data:
Information Commissioners Office
2nd Floor
Churchill House
Churchill Way
Cardiff
CF10 2HH
0330 414 6421
wales@ico.org.uk
13. Is my information subject to disclosure under the Freedom of Information Act?
13.1. As a public body, information that we hold is subject to the Freedom of Information Act. However, we will comply with the Data Protection Act 2018 and UK GDPR when considering requests made under the Freedom of Information Act and usually do not release personal data under Freedom of Information requests. In most cases, we do not disclose personal data in response to Freedom of Information requests.
14. Service Specific Privacy Information
A. Access Arrangements Research
i. As part of this activity, Qualifications Wales will be processing information about you which may include your name, job title, contact details, and the additional learning needs of learners participating in the research, together with your views, for the purpose of improving our understanding of the access arrangements system.
ii. The information gathered during phase one will be used to improve our understanding of the access arrangements system and to inform future approaches. It may also be used during phase two, when we explore the extent to which access arrangements are fair and manageable, and to produce and publish research reports.
iii. The lawful basis for processing this information is consent under Article 6(1)(a) of the UK General Data Protection Regulation (GDPR).
iv. The lawful basis for processing special category personal data is Article 9(2)(a), explicit consent and Schedule 1, Part 2, Paragraph 6(2)(a) of the Data Protection Act.
v. Qualifications Wales will be the data controller and a data processor of the personal information provided. Appen, an external transcription company, commissioned by Qualifications Wales will transcribe the recorded interviews and will be a data processor of any personal information provided to them by Qualifications Wales.
vi. We only keep your personal data for as long as it is needed for the purpose it was collected for, or for as long as is required by legislation, and will destroy it when we no longer need to retain it for those purposes. Personal information collected as part of this research will be kept securely for the duration of the project and will then be destroyed.
B. CCTV and Visitors to the Office
i. Qualifications Wales is the data controller of our CCTV footage and attendance records.
ii. We monitor our car park using CCTV under the legal basis of processing for legitimate interests, Article 6(1)(f) GDPR. The legitimate interests being for the purposes of crime prevention and evidential purposes, and the safety of our staff and visitors.
iii. The footage is held securely and will only be accessible to Facilities staff and our CCTV contractor. It will be retained for 70 days and then destroyed if not required for evidential purposes.
iv. Contractors and visitors to the office will be asked to sign in at reception and log their attendance times. This is to comply with our legal obligations under the Health and Safety at Work Act and any public health requirements that may be in place. In the case of contractors, information is also retained for contract records.
v. Visitor information will be retained for 60 days, and contractor information will be kept for one year.
C. Complaints, and Whistleblowing
i. When investigating complaints, cases of whistleblowing and regulatory incidents it will be necessary for us to process personal information.
ii. We may process personal data to:
a) investigate complaints made about awarding bodies regulated by us.
b) investigate complaints made about us.
c) investigate whistleblowing cases brought to our attention; and
d) monitor how awarding bodies manage events that could have an adverse effect in Wales.
iii. Qualifications Wales is the controller of this data.
iv. The lawful basis for processing this information is article 6(1)(e) of the UK GDPR which allows us to process personal data when this is necessary to perform our public tasks as a regulator.
v. If the information you provide us in relation to your complaint contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is Article 9(2)(g) of the UK GDPR, substantial public interest, and Schedule 1, Part 2, Paragraph 6(2)(a) of the Data Protection Act 2018 which relates to statutory and government purposes.
vi. Any personal data collected to investigate complaints, and whistleblowing will be reviewed for disposal after five years but may be retained for up to ten years.
vii. Access to this information may be given to independent reviewers contracted by us to review cases. In some cases, it may be necessary to share information with other UK regulators or our appointed legal counsel.
D. Cookies
i. Cookies are files saved on your phone, tablet, or computer when you visit a website.
ii. We use cookies to store information about how you use this website, such as the pages you visit. Cookies may store user preferences and other information. You can configure your browser to refuse all cookies or to indicate when a cookie is being sent. However, some website features or services may not function properly without cookies.
iii. We may use the following on our site:
a) cookies that measure website use
b) cookies that help with communications and marketing
c) cookies that remember your settings
d) other strictly necessary cookies
iv. The lawful basis we rely on to process your personal data is either consent under Article 6(1)(a) or legitimate interests under Article 6(1)(f) whereby the legitimate interest is the maintenance and integrity of our ICT systems.
E. Have Your Say
I. To register on our engagement platform, Have Your Say, we will collect certain personal information from you. This includes your name, email address, and your language preferences together with information that will help us understand what types of stakeholders we have reached through our engagement.
ii. We may use your email address and language preferences to send you mailings about stakeholder engagement that may be of interest to you. There will be an option to unsubscribe from these mailings. We may also use your email to contact you about your responses.
iii. The content you create as part of your interactions on this platform can include responses to public consultations, surveys, quick polls, comments, and discussions forums. This will be retained along with your identifiable registration information.
iv. Responses to consultations and surveys will be retained according to our retention schedule.
v. The providers of the platform, Engagement HQ (Granicus), acts as a processor under contract for Qualifications Wales.
vi. Qualifications Wales is the Controller of the personal information contained within the platform.
vii. Our lawful basis for processing your personal data is public task under Article 6(1)(e) as our engagement activities relate to the exercise of our statutory functions under the Qualifications Wales Act 2015.
viii. We may also process special category personal data to monitor our engagement with underrepresented groups. You do not have to give us this information. If you do provide us with your special category data we will process it on the basis of explicit consent under article 9(2)(a) of the UK GDPR and Schedule 1, Part 2, Paragraph (6)(a) of the Data Protection Act 2018 which relates to statutory and government purposes.
ix. You may withdraw your consent at any time by logging in to the platform and amending your registration responses or by contacting us.
x. For further details on how your data is processed in connection with our Have Your Say website, please refer to the site's privacy notice: https://haveyoursay.qualifications.wales/privacy
F. Evaluation Research of the 14-16 Qualification Reforms
i. As part of this research activity, Qualifications Wales will collect and process personal information about you. This may include your name, age, job title, contact information, language preference, employer name, work history, voice and image recordings, opinions, and personal experiences, for the purpose of evaluating the impact of 14–16 qualification reforms in Wales.
ii. The lawful basis for processing this information is public task under Article 6(1)(e) of the UK General Data Protection Regulation (GDPR).
iii. Additionally, should you voluntarily disclose information relating to your health or disability during interviews, this special category personal data will also be processed.
iv. The lawful basis for processing this information it is Article 9(2)(a) of the UK GDPR, consent, and Schedule 1, Part 2, Paragraph 6(2)(a) of the Data Protection Act 2018 which relates to statutory and government purposes.
v. The information gathered will be used to evaluate the impact of the recent 14-16 qualification reforms in Wales and to produce and publish research reports. It may also be used to follow up on our research findings and outcomes.
vi. We are undertaking this activity to support our principal aims of:
a) Ensuring that qualifications, and the Welsh qualification system, are effective for meeting the reasonable needs of learners in Wales.
b) Promoting public confidence in qualifications and in the Welsh qualification system.
vii. Qualifications Wales is the data controller.
viii. Alma Economics, an independent research organisation, has been commissioned by Qualifications Wales to conduct this research on our behalf and will act as a third-party processor. They will be responsible for collecting and processing any personal information you provide, acting under the authority and instruction of Qualifications Wales. We have a contract in place with Alma Economics which means they cannot do anything with your personal information unless we have instructed them to do it. They will hold your personal data securely and retain it for the period we instruct.
ix. Your personal data will be retained only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by law. Once it is no longer needed for these purposes, it will be securely destroyed.
x. Alma Economics will securely retain your personal data for one year from the date of each report publication, after which it will be deleted.
xi. Qualifications Wales will securely retain limited personal data, i.e. name, employer and contact information, only for as long as it is necessary to fulfil the purposes of the project. Once the project is complete and your data is no longer required, it will be permanently and securely deleted. It is anticipated the project will be complete in 2030.
xii. Most of the personal data we process will be provided to us by you either via previous engagement with us or during the course of this research. We may also receive personal information indirectly for example via your school, employer, or where you have made your contact information publicly available.
G. Events
i. We may use third party ticketing and webinar platforms to manage events e.g. Eventbrite. Personal information collected for events may include participants name, organisation, contact details, and dietary requirements as well as participation records and Welsh language preferences. We use this information to facilitate the event. This information will be exported from third party websites and held securely on our systems.
ii. Qualifications Wales will be the controller of personal information provided for our events.
iii. The lawful basis for processing this information is consent under Article 6(1)(a) of the UK General Data Protection Regulation (GDPR).
iv. Third party systems may also act as a data controller for some personal information submitted by its users e.g. if you are registering for their site. Please also refer to the privacy notices of these websites when registering.
v. We may take photos and videos at events for use on our website and social media channels. These may include participants at events. We will ask permission before recording the image of a person in a way that could identify them. Please notify the event organiser before the event starts if you do not wish to be included.
vi. We only keep your personal data for as long as it is needed for the purpose it was collected for, or for as long as is required by legislation, and will destroy it when we no longer need to retain it for those purposes. We delete event participation data three months after the date of the event.
H. Data Collections - Learner Data
I. As the regulator of awarding bodies and qualifications in Wales, we will request learner data from awarding bodies, Welsh Government and other public bodies which may identify individuals. Such data collections may include special category such as a learner's ethnicity or data about a learner's health where this may be linked to special considerations.
ii. Our purposes for requiring the data are:
a. to carry out our monitoring and audit functions
b. to publish statistics about the qualifications system
c. to carry out evidence-based research
d. to investigate particular issues reported to us.
iii. The lawful basis for processing this information is Article 6(1)(e) of the UK GDPR which allows us to process personal data when this is necessary to perform our public tasks as a regulator. If the information we receive includes special category data, such as health or ethnic information the lawful basis we rely on to process it is Article 9(2)(g) of the UK GDPR, substantial public interest, and Schedule 1 paragraph 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes.
iv. No data identifying individual learners will be published.
v. The data will be retained for 15 years to enable trends to be analysed. After this point it will usually be destroyed.
vi. We may share data with third parties to undertake research and analysis on our behalf. All third parties processing personal data on our behalf are required under contract to abide by the GDPR.
vii. As producers of official statistics, we comply with the Code of Practice for Statistics in the production of statistics.
I. Engagement Panels and Groups
i. We have established several dedicated engagement groups and panels to facilitate meaningful dialogue with particular stakeholder communities on issues relevant to their interests.
ii. We collect and process personal data from individuals who are members of our engagement panels or groups, or from those who have expressed an interest in joining a panel or group. This includes name, contact details, school, organisation, language preference and opinions.
iii. We also collect and process the age of individuals who take part in our learner panels.
iv. We may sometimes process sensitive personal data including, health information and ethnicity.
v. Qualifications Wales will act as the data controller for any personal information you provide when participating in our engagement panels and groups.
vi. Our lawful basis for processing your personal data is public task under Article 6(1)(e) as our engagement activities relate to the exercise of our statutory functions under the Qualifications Wales Act 2015.
vii. You do not have to give us your special category data to participate in our engagement panels and groups. If you do provide us with your special category data we will process it on the basis of explicit consent under article 9(2)(a) of the UK GDPR and Schedule 1, Part 2, Paragraph 6(2)(a) of the Data Protection Act 2018 which relates to statutory and government purposes.
viii. You may withdraw your consent at any time by contacting us.
ix. We only keep your personal data for as long as it is needed for the purpose it was collected for, or for as long as is required by legislation, and will destroy it when we no longer need to retain it for those purposes. The personal data of panel and group members is recorded within our CRM system and is subject to a review for deletion after five years.
J. Newsletter Mailing List
I. It is essential that key stakeholders remain updated about the work of Qualifications Wales and our monthly newsletter will automatically be sent to all primary contacts at awarding bodies, schools and colleges. Primary contacts include responsible officers, heads of schools and colleges, FE college principals and exam officers. These contacts will automatically receive newsletters and other mailings. If you would like to update the primary contact details, please contact us.
ii. By subscribing to our newsletter or any mailing lists you are consenting to us retaining your personal identifiers and contact details for the purposes of sending you the newsletter or mailing list to which you have subscribed.
iii. Qualifications Wales acts as the data controller for any personal information you provide when subscribing to our newsletter mailing list.
iv. Our lawful basis for processing your personal information is consent under Article 6(1)(a) GDPR.
v. Your personal data will be processed in accordance with the Corporate Privacy notice, and you may unsubscribe from your mailing list at any time by clicking ‘unsubscribe’ at the bottom of the mailing.
K. Procurement and Contractors
i. Qualifications Wales will be the controller of personal information you provide to us as part of the procurement process.
ii. This information will be processed under the legal basis that it is necessary in order to take steps at your request with a view to entering into a contract for goods and services, Article 6(1)(b) GDPR.
iii. Should you be successful in your application, we will retain your personal information for the length of our contract with you and thereafter according to our retention schedule.
iv. We may transfer your details to third parties processing data on our behalf where it is necessary to facilitate payment, to fulfil the contract or for analysis of third-party expenditure data.
v. All third parties processing personal data on a client’s behalf are required under contract to abide by the GDPR.
vi. We publish a contract register on our website of all awarded contracts and this includes supplier name, contract name, contract commencement and expiry dates, and the total value of the contract (where appropriate).
vii. We will hold information about unsuccessful applicants for three years following the financial year in which the contract was awarded, it will then be destroyed.
L. Recognition Process
i. Qualifications Wales will be the controller of any personal information you provide to us through the awarding body recognition process.
ii. This information will be collected for the purposes of determining an awarding body application for recognition and may be used in monitoring any future compliance with our 'Standard Conditions of Recognition'.
iii. The lawful basis for processing this information is Article 6(1)(e) of the UK GDPR which allows us to process personal data when this is necessary to perform our public tasks as a regulator.
iv. Should you be successful in your application, we will retain your personal information for as long as you remain a recognised awarding body and thereafter according to our retention schedule. Where applicants are successful, we will hold your personal information for twelve months after the application procedure has been completed, it will then be securely destroyed.
v. Your personal information may be shared between UK regulators for the following reasons:
a) you have already been recognised by another UK regulator.
b) you have applied to other UK regulators at the same time.
c) you have been previously unsuccessful in applying for recognition with other UK regulators.
M. Recruitment
i. We will process your personal data for the purposes of progressing your application, managing the recruitment process and for keeping records of the process. This means that a different lawful basis may apply to different stages of the process:
a) We may need to process your personal data to carry out actions you have requested before entering into a contract. Additionally, we may process your personal data to establish and fulfil our contractual obligations with you. This processing is carried out in accordance with Article 6(1)(b) of the GDPR.
b) We may also need to process your personal data to fulfil our legal obligations. For example, when verifying that successful candidates are eligible to work in the UK. Such processing is conducted in accordance with Article 6(1)(c) of the GDPR.
c) We process personal data during the recruitment process to support our legitimate business interests. This includes managing the recruitment process efficiently, assessing candidates’ suitability for roles, making well-informed decisions about job offers and maintaining appropriate records. Our processing of personal data for these purposes is Article 6(1)(f) of the GDPR, which allows us to process data where it is necessary for our legitimate interests.
d) We may also need to process personal data from applicants to respond to, and defend, legal claims.
e) At times, we may need to process special category data, such as details used to monitor recruitment statistics or to meet our obligations under equality, diversity, and employment law. We may also collect information about whether applicants have a disability, so that we can make appropriate reasonable adjustments where needed. In all cases, we will always ensure that there is a lawful basis and, where required, a relevant additional condition for processing your special category data.
ii. We will need to share your personal data internally and may be required to share with some external third parties or processors. Your personal data will only be shared if it is necessary and lawful. We may need to share your personal data with:
a) external panel members who may be part of the recruitment process
b) organisations providing candidate interview and assessment services.
c) suppliers who undertake background screening/vetting on our behalf
d) Occupational Health providers delivering pre-employment checks on our behalf.
e) referees you have provided to support your application.
f) academic institutions in validating information you have provided.
g) auditors carrying out audit activities.
iii. If you apply for a job with us, we will only hold information relating to your application for as long as necessary. If you are unsuccessful, we will hold any personal data provided by you (or others) for one year after which time it will be securely deleted.
N. Stakeholder Confidence in Qualifications and Qualifications System Interviews
i. During these interviews, we will collect personally identifiable information, including the name of your organisation, your job title, your name, and your contact details.
ii. Our lawful basis for processing your personal data is consent under Article 6(1)(a) GDPR.
iii. A phase of this research will focus specifically on equality, diversity, and inclusion (EDI). During parent interviews, we will collect special category data, which includes information on ethnicity, sexual orientation, and religious beliefs.
iv. Our lawful basis for processing special category personal data is explicit consent under Article 9(2)(a) and Schedule 1, Part 2, Paragraph 6(2)(a) Data Protection Act 2018 which relates to statutory and government purposes.
v. Beaufort Research will act as a processor on behalf of Qualifications Wales. Qualifications Wales will be the data controller of any personal data submitted.
vi. Your personal data will be kept securely for twelve months and then destroyed.