Ceredigion County Council website

The proper handling of personal information by Ceredigion County Council is very important to the delivery of our services and maintaining public confidence.

Personal data is any information that relates to a person who can be directly or indirectly identified from the information. The terms ‘information’ and ‘personal data’ are used throughout this privacy notice and have the same meaning.

This privacy notice has therefore been produced to explain as clearly as possible what we do with your personal data.

The purposes for which we use your personal data

Ceredigion County Council’s Learning & Development team is responsible for the provision, delivery, recording and reporting of training, along with qualification panel applications and administration. In order to carry out these functions, and to ensure that you are eligible for training and/or qualification application we must collect, and process personal data as set out in the notice below.

Your information will be used to:

• Request and administer your place on training courses – virtual and face to face
• Create a user account on our Learning Management System (LMS)
• Offer support to learners, service areas, external service suppliers, volunteer organisations etc.
• Maintain training records
• Administer and submit qualification applications
• Administer and process student work placements
• Data quality management

The lawful basis for the processing of your information is

The UK General Data Protection Regulations (UK GDPR) requires specific conditions to be met to ensure that the processing of your personal data is lawful. These relevant conditions are below:

• Article 6 (1)(a) Consent: you have given us clear consent us to process your personal data for a specific purpose. For example, where we ask to use a photograph of you to promote our courses. Where you give your consent, you have the right to remove it at any time
• Article 6 (1)(c) Legal Obligation: the processing is necessary for us to comply with the law (not including contractual obligations). For example, when we are required to share information with external training providers or qualification boards; or we are required to share information with regulatory authorities
• Article 6 (1)(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. For example, when we are requested to process your data in line with our legal obligations to comply with the Health & Safety At Work (1974) Act. Other examples may include processing personal data to create users accounts for staff of external organisation who receive training form us, paid for by grant funding

Some types of personal data are more sensitive than others and need more protection. This is classed as ‘special category data’ and could include information about your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and the processing of genetic or biometric data, health and sex life and sexual orientation.

We process this type of special category data as it is necessary for reasons of:

• Article 9 (2)(g) – Substantial Public Interest: the processing is necessary for us to comply with the law (not including contractual obligations). For example: Where we may collect and process your personal data to comply with our legal obligations under The Equality (2010) Act or The Health & Safety at Work (1974) Act

What type of information do we use?

We may collect the following types of personal data about you to deliver our services, depending on your circumstances:

• Name
• Address
• Date of birth
• Gender
• Contact telephone number(s)
• Email address
• Employer details
• Current role
• Images/photographs
• Nationality
• Ethnicity
• Medical conditions and history

Do we use information received from other sources?

We collect and process information directly from you, but we may also receive information from the following sources:

• Your manager/appointed person
• Universities
• Other Council service areas
• Other Local Authorities

Transferring your data abroad

We use a variety of software to process our electronic documents/records under the terms of a strict agreement, which safeguards your information. This personal data is hosted on servers inside and outside the UK, but only in EU countries which are subject to the General Data Protection Regulation.

Your personal data will not be transferred outside of the EU.

Who your information may be shared with?

We may share your information with the following recipients depending on your circumstancesto carry out our obligations under our contract with you, or for our legitimate interests, this will include:

• Internal and external training providers
• Audit - internal and external
• Other Council service areas
• Universities, FE Colleges and qualification providers
• Our learning management system provider
• Regulatory bodies
• Your external employer(s) or voluntary organisation
• External training providers/consultants where their specialist skill is needed in order to meet our legal/training responsibilities
• External providers engaged to perform specific tasks on behalf of the Learning & Development team, for example staff engagement surveys, course evaluations, training needs analysis etc.

There are also other specific situations where we may be required to disclose information about you, such as:

• Where the Council is required to provide the information by law
• Where disclosing the information is required to prevent or detect a crime
• Where disclosure is in the vital interests of the person concerned

How long will we keep your information?

Your information will be kept in line with our retention guidelines and your information will be securely disposed of, once it is no longer required. Please see Ceredigion County Council’s Privacy Notice for further details of our retention rules.

Your Data Protection rights

You have the right to:

• Obtain access to the personal data that Ceredigion Council’s Learning & Development team is processing about you
• Have any inaccurate or incomplete information rectified (corrected)
• Withdraw your consent to processing, where this is the only basis for the processing
• Make a complaint to the Information Commissioner’s Office (ICO), the independent body in the UK which protects information rights

In some circumstances, you may have the right to:

• Object to the processing of your personal information
• The erasure of your personal data
• Restrict the processing of your personal information
• Data portability (transfer your personal data to another organisation in a suitable and timely manner)

Contact Details

For more information regarding this privacy notice and your rights, please contact Data Protection Officer, Ceredigion County Council, Rhodfa Padarn, Aberystwyth, SY23 3UE or email data.protection@ceredigion.gov.uk.