HEFCW Privacy Notice

The Higher Education Funding Council for Wales (HEFCW) is committed to protecting your personal information and respecting your privacy.

This privacy notice explains what personal information we hold about you, how we use it, the limited conditions under which we may disclose it to others and how we keep it secure.

We know how important it is to protect and manage your personal information. We have established physical, technical and organisational security measures to assist with this. Some of the measures we have taken include:

  • adopting computer safeguards such as firewalls, encryption, secure transfer protocols, penetration testing, complex security credentials, and access controls including restricting access depending on job responsibilities
  • accreditation against the ISO 27001 Information Security Management System Standard and ongoing compliance against Government and industry recognised security frameworks
  • a comprehensive framework of policies relating to data protection, information security and records management
  • regular training and awareness sessions for our employees to ensure understanding and compliance across the organisation
  • maintenance of a data protection register that identifies all personal information held and includes details such as lawful basis for processing, location, security measures and retention
  • data sharing agreements and relevant clauses in contracts that have personal data implications
  • privacy notices so that individuals are aware of what personal information we hold and why
  • data protection impact assessments undertaken to identify risks and ensure compliance with data protection legislation, and
  • data stored within the UK and not transferred outside the European Economic Area (EEA). If there was a requirement to transfer personal information outside of the EEA, transfer would only be permitted to countries whose data protection laws have been assessed as adequate by the European Commission, and where adequate safeguards are in place to ensure compliance with relevant data protection regulations.

We try to be as open as we can be in terms of giving you access to your personal information. Under data protection legislation, you have certain rights which we’ve explained in the ‘Access to personal information’ section.

We also want to be clear about what is potentially covered by the personal information categories, so we have made available our personal information categories descriptions.

The way we process personal information depends on the services we are providing. To review the service that applies to you, select the most appropriate option from one of the following:

Visitors to our website, and recipients of our newsletters, circulars, press releases and job vacancies

What personal information we process, why and for how long

When you visit www.hefcw.ac.uk we log your IP address which is classed as personal information. We also log your browser type (e.g. Internet Explorer, Firefox, Google Chrome) and the referral website (if the website you last visited provided a link to us). If you use our search function, we log the search term submitted, and the time and date of submission. We do not store any personal information with the search term. In order to obtain the IP address of a visitor who submitted a search, the website log file for that day needs to be cross-referenced. If you use one of our website forms, the IP address will be logged alongside the data you have voluntarily submitted. Our website forms are:
  • feedback
  • freedom of information requests
  • subscriptions to our newsletters, circulars, press
  • releases or job vacancies
  • complaints
We use data in log files to compile website usage statistics and error tracing. Under normal circumstances, we do not use the IP addresses to identify a visitor or trace a visitor’s activity on the website. However, we may do this in order to identify abusive activity. If potential hacking activity is detected the website makes a record of the source IP address and blocks access to all visitors using that IP address. Our lawful basis for processing of this information is for the purposes of our legitimate interests in providing IT services and systems that are secure and function effectively. Logs are stored for 12 months before they are permanently deleted. IP addresses linked to potential hacking activity are added to the configuration of the website and stored in perpetuity.

How we protect your personal information and who we may share it with

Log files are stored securely in systems accessible only to our employees who need access to undertake their job responsibilities. We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate. When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. If you have any concerns about the processing of your personal information, you have the right to object by emailing info@hefcw.ac.uk. Please bear in mind that if you object, this may affect our ability to deliver this service to you.

Use of Cookies

How we use cookies

Cookies are text files saved to your device browser when using this website. The HEFCW website uses cookies for analytical purposes, and to improve user experience. The data stored in the cookies we use is not used to identify any user personally. The cookies we set

The HEFCW website uses three cookies:

Language selection This cookie remembers a visitor’s language selection. The language selection stored in this cookie is called whenever a user interacts with a page on the HEFCW website. This cookie is required for the site to function correctly, therefore this cookie is classed as “strictly necessary”. It expires after 24 hours. Cookie consent settings This third-party cookie is used by Cookie-Script.com service to remember visitor cookie consent preferences. It is necessary for Cookie-Script.com cookie banner to work properly. This cookie is required for the site to function correctly, therefore this cookie is classed as “strictly necessary”. It expires after 1 month. Google Analytics This third-party cookie helps us to understand how the site is used, and to identify ways that we can improve your experience. The settings in this cookie may track things such as how long you spend on the site and the pages that you visit. Read the Google Privacy Policy for further information. The use of this cookie is optional. It expires after 2 years.

Preferences

You can choose to enable or disable optional cookies below. Cookies classed as “strictly necessary” are required for this site to work properly, so they cannot be disabled. More Information For further information on our use of cookies, contact us at info@hefcw.ac.uk.

What personal information we process, why and for how long

When you subscribe to receive our newsletters, circulars, press releases or job vacancy alerts, we will log your personal contact information such as name and email address.

We use your contact information to provide you with the services you’ve selected. You are not required to give us these details although we may not be able to provide you with the services you have requested if you chose not to disclose this information.

Our lawful basis for processing of this information is consent which you have freely given when subscribing to these services.

We will not use your personal information for any other purpose and will retain your details for as long as is required to deliver the requested service.

How we protect your personal information and who we may share it with

Your contact information is stored securely on our IT systems and only accessible to our employees.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to withdraw your consent at any time by emailing info@hefcw.ac.uk. We will erase your personal information on receipt of your request.

You also have the right to request a copy of your personal information, to request that we correct your personal information if it is inaccurate, and to request the restriction of the processing of your personal information.

Stakeholders, conference/event attendees, people who contact us directly (including disclosures, requests for information and complaints) and members of the public

What personal information we process, why and for how long

We hold your contact details such as name, email address, correspondence address and phone number as this information is essential to the conduct of our business. In most cases, these contact details would be professional or work details but may occasionally be private or home details.

Our lawful basis for processing this information is public task, to enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters and specific delegation letters.

We will not use your personal information for any other purpose and will retain your details for as long as is required to fulfil the public task and as determined by the appropriate retention policy.

How we protect your personal information and who we may share it with

Your contact information is stored securely on our IT systems and our business continuity system, and will only be accessible to our employees.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

You also have the right to object to the processing of your personal information by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

What personal information we process, why and for how long

If you’re attending our conferences or events, we will need to process your contact details such as name, email address, correspondence address and phone number in order to keep you informed of arrangements. We might also hold information required to make reasonable adjustments such as dietary, access or Welsh Language requirements.

We sometimes use Eventbrite to manage our conferences and events. Eventbrite processes data (including any personal data submitted by booking one of our events) outside the European Economic Area. Please only submit information which you are happy to have processed in this way. Refer to Eventbrite’s privacy policy for further information. You may contact the event organiser directly if you prefer not to use Eventbrite.

We usually provide a list of delegates as part of the delegate pack for the conference or event. We will give you an opportunity to indicate if you do not wish your name, job title and organisation to be included on the delegate list.

Sometimes we may take informal photos during the conference or event which may be published on our website or social media feeds. We will give you an opportunity to indicate if you do not wish to be included in any photos.

Our lawful basis for processing this type of information depends on the nature of the task. The lawful basis could be:

  • To enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters and specific delegation letters.
  • To meet our legal obligations under the Health and Safety at Work etc Act 1974 and Health and Safety at Work Regulations 1999, and our responsibilities under the Equality Act 2010.
  • You have given your consent when subscribing to our conference or event.

We will not use your personal information for any other purpose and will retain your details for as long as is required to fulfil the public task or legal obligation and as determined by the appropriate retention policy.

Unless you have given us your consent to retain your contact details to invite you to future conferences and events, we will erase your details once the conference or event has ended.

How we protect your personal information and who we may share it with

Your contact information is stored securely on our IT systems and only accessible to our employees.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

Where we rely on consent to retain your contact details, you have the right to withdraw your consent at any time by emailing info@hefcw.ac.uk. We will erase your personal information on receipt of your request. You also have the right to request the restriction of the processing of your personal information.

Where we process your personal information to enable us to fulfil our public tasks, you have the right to object by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

What personal information we process, why and for how long

When you phone us we may make a note of your contact details and information about the subject of your call so that we can deal with your enquiry. We do not record or monitor telephone calls apart from voicemails. Your phone number may be stored within our phone system if your phone settings allow for caller identification.

Any emails sent to us may be monitored for security and compliance reasons. Emails may be stored on our IT systems whilst your query is being dealt with.

When we receive a disclosure, request for information or complaint, we may record details of the request including contact details and other relevant information you’ve included in the request.

Our lawful basis for processing this type of information depends on the nature of the request. The lawful basis could be:

  • To enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters and specific delegation letters.
  • To comply with a legal obligation such as the Freedom of Information Act 2000.

We will only use the personal information you’ve provided in order to process the request. Personal information will be retained for as long as is necessary to deal with the enquiry, or in line with our retention policy where this applies. This means that information relating to a disclosure or request for information will be retained for three years, and relating to a complaint will be retained for ten years from closure. If information results in an investigation into an institution, the retention may be 15 years from closure although personal information will be redacted after ten years.

How we protect your personal information and who we may share it with

Your personal information is stored securely on our IT systems and only accessible to our employees on a restricted ‘need to know’ basis.

However, we may need to share this information with other organisations or statutory bodies where a disclosure, request for information or complaint has been made. Refer to our ‘Access to Information Policy’ and ‘Complaints Procedures’ for further information.

There may be times when we are asked to share information with other organisation in the event of a complaint about HEFCW itself. In these circumstances we are usually obliged to provide the information by law.

We may compile and publish statistics showing information like the number of complaints or requests we receive, but not in a form which identifies anyone.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

Where we process your personal information to enable us to fulfil our public tasks, you have the right to object by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

What personal information we process, why and for how long

If you are supplying goods or services to us we may process personal information about you, such as your contact details in order to enter into agreements. Details of the personal information we process should be included in contracts to deliver the goods or services but may include financial details to make payments or check your financial viability, or CVs to assess your qualifications and experience.

Our lawful basis for processing this type of information depends on the nature of the relationship. The lawful basis could be:

  • Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • To enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters, specific delegation letters and Managing Welsh Public Money.
  • To meet our legal obligations including compliance with the National Fraud Initiative, Public Contracts Regulations 2015, European Procurement Directive 2014/24/EU, and the Freedom of Information Act 2000.

We will not use your personal information for any other purpose and will retain your details for as long as is required to deliver the contract and as determined by the appropriate retention policy. Invoicing and payment details are retained for seven years unless there is an obligation to retain the information for longer to comply with legal requirements such as the Welsh European Funding Office (WEFO). Information relating to procurements or contracts are retained for six years after the contract has ended.

How we protect your personal information and who we may share it with

Your personal information is stored securely on our IT systems and our business continuity system, and will only be accessible to our employees on a restricted ‘need to know’ basis.

We may need to share this information with other organisations or statutory bodies such as relevant ombudsman, auditors, Welsh Government, WEFO, other Welsh Government Sponsored Bodies, and contracting organisations, all of which are required to comply with data protection legislation.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

Where we process your personal information to enable us to fulfil our public tasks, you have the right to object by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

What personal information we process, why and for how long

We process personal information, including sensitive types of information (also referred to as special categories of personal information) for a number of purposes such as to inform funding, policy development, policy analysis, research or in relation to our financial duties, legal obligations and public interests.

The types of personal information processed may include:

  • contact details
  • personal details
  • family, lifestyle and social circumstances
  • financial details
  • education and training details
  • employment details

The types of special categories of personal information may include:

  • physical or mental health details
  • racial or ethnic origin
  • religious or other beliefs
  • sex life or sexual orientation details

Much of the information we hold is collected from other sources including the Higher Education Statistics Agency (HESA), Research Excellence Framework (REF), Student Loans Company (SLC), Scottish Funding Council (SFC), Education and Skills Funding Agency, Higher Education providers, and Welsh Government. These organisations should have collection notices informing you of the information they may collect, the purposes for the collection, who your information may be disclosed to and your rights.

We have data sharing agreements in place with these organisations, or may be legally required to process this information in relation to our financial and legal duties.

Our lawful basis for processing this type of information is to enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, our Financial Management Code and Memorandum of Assurance and Accountability/Terms and Conditions of Funding, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters and specific delegation letters.

We will not use your personal information for any other purpose and will retain your details for as long as is required to fulfil the public task and as determined by the appropriate retention policy.

How we protect your personal information and who we may share it with

Your personal information is stored securely on our IT systems and only accessible to our employees on a restricted ‘need to know’ basis.

We may share your information with other organisations who have a contract to process this data. Appropriate contracts or data sharing agreements will be established.

Otherwise we will only disclose information to someone outside of HEFCW where we are legally obliged to do so.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

You have the right to object by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

Separate privacy notices are in place for Employees, Council Members and job applicants.

What personal information we process, why and for how long

When you apply to join a committee, we need to process your contact details such as your name, email address, correspondence address and phone number, and other personal information including information submitted in your CV. This information is required in order to conduct a fair, open and transparent recruitment process, and in some areas to ensure we are compliant with our legal obligations. We will not ask for any information that we don’t need, and we will tell you if providing some personal information is optional, including if we ask for your consent to process it.

For equality monitoring purposes we process sensitive types of information (also referred to as special categories of personal information) including gender, age, religion, sexual orientation, ethnicity and disability. Completion of this information is optional and will not affect the selection process.

If your application is successful, we will require further personal information including financial details to make travel and subsistence payments. We might also hold information required to make reasonable adjustments such as dietary, access or Welsh Language requirements.

Our lawful basis for processing this type of information depends on the nature of the purpose. The lawful basis could be:

  • To enable us to fulfil our public tasks including our responsibilities as the lead regulator for higher education in Wales. This is in accordance with obligations described in the Further and Higher Education Act 1992, the Education Act 2005, the Higher Education (Wales) Act 2015, and where expectations are set out by Welsh Ministers including, the WGSB Framework Document: HEFCW, Remit letters and specific delegation letters.
  • To meet our legal obligations under the Health and Safety at Work etc Act 1974 and Health and Safety at Work Regulations 1999, and our responsibilities under the Equality Act 2010.

We will not use your personal information for any other purpose and will retain your details for as long as is required to fulfil the public task or legal obligation and as determined by the appropriate retention policy. Payment details are retained for seven years.

Details of unsuccessful applicants will be retained for no longer than is necessary for the purposes of processing the application. Your written consent will be sought if we wish to retain your details for future applications.

How we protect your personal information and who we may share it with

Your personal information is stored securely on our IT systems and our business continuity system, and will only be accessible to our employees on a restricted ‘need to know’ basis.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

Where we process your personal information to enable us to fulfil our public tasks, you have the right to object by emailing info@hefcw.ac.uk. We will assess your objection openly and fairly, and clearly explain our decision and your options should you disagree with our decision.

What personal information we process, why and for how long

When you visit our premises you will be asked to sign in to our visitors log. Alongside your signature will be your name and your organisation. If you’ve parked a vehicle in the car park you will also be asked to provide your car registration number in case you need to be contacted in relation to your vehicle during your visit. These logs are retained for one month and then destroyed.

Visitors, including contractors, who are issued with a security badge by Welsh Government, will generate a record of activity on the door access system maintained by Welsh Government. These logs are reviewed for security and safety purposes, and retained for 12 months.

Before your visit we are required to establish if you have any specific access or support requirements in order to allow us to make reasonable adjustments to ensure your safety. You may be asked to complete a Personal Emergency Evacuation Plan (PEEP) questionnaire to help us make appropriate arrangements. We would like to retain the personal information you have supplied for the PEEP but will only do so if you have given us your consent. Otherwise your information will be destroyed at the end of your visit.

Our lawful basis for processing this type of information depends on the nature of the purpose. The lawful basis could be:

  • To meet our legal obligation under the Health and Safety at Work etc Act 1974 and Health and Safety at Work Regulations 1999, and our responsibilities under the Equality Act 2010.
  • Processing is necessary for the purposes of our legitimate interests in maintaining the security and safety of individuals.

CCTV is used by the Landlord to maintain the security of the property and the personal safety of employees and visitors. Notices are displayed around the premises. For further information on CCTV images, contact the Welsh Government’s Security Team.

How we protect your personal information and who we may share it with

Personal information relating to your PEEP and other reasonable adjustments made in relation to your visit will be stored securely on our IT systems and only accessible to our employees who require access to undertake their job responsibilities.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights, under data protection laws. If you have any concerns about the processing of your personal information, you have the right to object by emailing info@hefcw.ac.uk. Please bear in mind that if you object, this may affect our ability to deliver this service to you.

What personal information we process, why and for how long

When you visit our extranet or make use of our secure file transfer facilities, we log your IP address which is classed as personal information. We also log your browser type (e.g. Internet Explorer, Firefox, Google Chrome) and the referral website (if the website you last visited provided a link to us).

We log the usernames and IP addresses of anyone who attempts to log on, whether they are successful or not, or whether they are using a valid login name or not.

If you use “forgotten password”, we store the data submitted to this page in a database alongside a timestamp of submission.

These IT services are accessible after logging on with correct credentials. Browsing activity, including search terms entered into the search field will be logged against the username.

The secure areas use cookies to verify that a request for the page is from an authenticated user. The cookie is removed from your computer when you logout, close the browser, or after twenty minutes of inactivity.

We use data in log files to compile website usage statistics and error tracing. Under normal circumstances, we do not use the data to identify a visitor or trace a visitor’s activity on the website. However, we may do this in order to identify abusive activity. If potential hacking activity is detected the website makes a record of the source IP address and blocks access to all visitors using that IP address.

To access our extranet you are required to sign a security statement. This statement is your confirmation that you understand and will abide by the security measures required to keep this system secure. Your signed form will be retained for the duration of your access.

Our lawful basis for processing of this information is for the purposes of our legitimate interests in providing IT services and systems that are secure and function effectively.

Logs are stored for 12 months before they are permanently deleted.

IP addresses linked to potential hacking activity are added to the configuration of the website and stored in perpetuity.
How we protect your personal information and who we may share it with

Log files are stored securely in systems and signed extranet forms are stored securely on your file. This information is accessible only to our employees who need access to undertake their job responsibilities.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.
Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. If you have any concerns about the processing of your personal information, you have the right to object by emailing info@hefcw.ac.uk. Please bear in mind that if you object, this may affect our ability to deliver this service to you.

What personal information we process, why and for how long

When you make use of our guest wifi or eduroam facilities, we store the MAC address of your device, the guest network IP address allocated to your device and the timestamp.

When a client authenticates with their home eduroam provider, their authenticating username is stored alongside their MAC address and a timestamp.

MAC address logs are used for troubleshooting and security purposes (e.g. we can block a MAC address from the system if required).

Your browsing activity is logged alongside the IP address allocated to your device. We use data in log files to compile website usage statistics and error tracing. Under normal circumstances, we do not use the data to identify a visitor or trace a visitor’s activity. However, we may do this in order to identify abusive activity.

To access our guest wifi you are required to sign an acceptable use statement. This statement is your confirmation that you understand and will abide by the security measures required to keep this system secure. Your acceptance is required every time you access the guest wifi.

Our lawful basis for processing of this information is for the purposes of our legitimate interests in providing IT services and systems that are secure and function effectively.

All associated logs are stored for 12 months before they are permanently deleted.

How we protect your personal information and who we may share it with

Log files are stored securely in systems accessible only to our employees who need access to undertake their job responsibilities.

We will not disclose your personal information to any other body except where this is necessary to comply with the law or protect our services or others.

Your rights

You have the right to request a copy of your personal information and to request that we correct your personal information if it is inaccurate.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. If you have any concerns about the processing of your personal information, you have the right to object by emailing info@hefcw.ac.uk. Please bear in mind that if you object, this may affect our ability to deliver this service to you.

Data protection legislation gives you certain rights over your personal information.

You have the right to:

  • be informed about the collection and use of your personal information
  • request a copy of your personal information by making a subject access request (see below for details)
  • request rectification of inaccurate personal information or completion of incomplete personal information
  • request erasure of your personal information
    restrict the processing of your personal information
  • receive a copy of your personal information in a format that allows easy transfer (known as “data portability”)
  • object to the processing of your personal information
  • not be subject to automated decision making or profiling

All of these rights have certain limitations depending on the request and on the purpose of our processing. We have identified your rights throughout this privacy notice although we welcome any queries in relation to your rights. Further information about your rights is available on the ICO website.

To exercise your rights, please get in touch with our Data Protection Officer using the contact details below.

The right to request a copy of your personal information is known as making a subject access request. You are entitled to know what information we hold on you, and can make this request, in writing, to any of our employees or via info@hefcw.ac.uk. We will need to confirm your identity in order to process your request.

HEFCW is the data controller of any personal information collected within the scope of this privacy notice.

We are fully committed to the processing of your personal information in line with data protection legislation but we do welcome any queries relating to the processing of your data and will listen to any concerns you may have.

Please get in touch with us by email, phone or post:

Email: info@hefcw.ac.uk

Phone: 029 2085 9696

Write to:

HEFCW
Tŷ Afon
Bedwas Road
Bedwas
Caerphilly
CF83 8WT

Our Data Protection Officer is Alison Haggett (Head of Information Systems and Facilities). You are welcome to contact our Data Protection Officer directly:
Email: alison.haggett@hefcw.ac.uk
Phone: 029 2085 9650

If you are unhappy with the way in which your personal information has been handled by us, please either contact us at info@hefcw.ac.uk or via our Data Protection Officer and we will try to resolve your issue informally.

If we are unable to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113
Email: casework@ico.org.uk
Website: https://ico.org.uk

You can also contact the Wales ICO office:

Information Commissioner’s Office – Wales
2nd Floor, Churchill House
Churchill Way
Cardiff
CF10 2HH

Tel: 029 2067 8400
Email: wales@ico.org.uk

Our website contains links to other websites. We are not responsible for the privacy practices or content of other websites. We encourage our website visitors to be aware when they leave our website and to read the privacy policy of other websites.

This privacy notice is regularly reviewed to ensure that it accurately describes how we process personal information. This notice may be updated from time to time, for example when new legislation is enacted or when new purposes or systems are added.

Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

This privacy notice was last updated on 1 August 2019.