This privacy statement is a statement that describes how CYNNAL collects and uses, retains and discloses personal information. CYNNAL is registered with the Data Controller and as part of our work we are responsible for collecting and processing your personal information. If you have any specific queries about the personal data that we are processing, you can contact the Chief Executive who is also responsible for the data protection function via
Cwmni CYNNAL Cyf
Personal data is any information that relates to a person who can be directly or indirectly identified from the information. The terms ‘personal information’ and ‘personal data’ are used throughout this privacy notice and have the same meaning. To ensure that CYNNAL treats personal information correctly, we seek to adhere in full to the requirements of Data Protection Legislation. This privacy notice has therefore been produced to explain as clearly as possible what we do with your personal data.
How we use your information
The proper handling of personal information by CYNNAL is very important to the delivery of our services and maintaining public confidence. We comply with our obligations under the General Data Protection Regulation (GDPR) and the principles of the Data Protection Act 2018 (DPA).
CYNNAL will make sure that your Personal Data is
- Processed lawfully, fairly and In a transparent way
- Collected for specified, explicit and legitimate reasons
- Adequate, relevant and limited to what is necessary
- Accurate and where necessary kept up to date
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which those data are processed, and
- Processed in a manner that ensures appropriate security of personal data.
What is the lawful basis for processing your personal data?
The first principle requires that you process all personal data lawfully, fairly and in a transparent manner. Processing is only lawful if you have a lawful basis.
Depending on how we are processing your personal data will determine the lawful basis for processing. Generally, the legal basis for processing by CYNNAL as business and charity that works with public authority will be:
- Keep details such as name, contact number and email address to complete the duties in our service level agreement
- To perform a function or provide a service required by statute (Article 6(1)(e) GDPR)
- To comply with a legal obligation (Article 6(1)(C) GDPR)
- Where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (Article 1(b) GDPR)
- Where disclosure is in the vital interests of yourself or another person (Article 6(1)(d) GDPR)
- With your explicit consent (Articles 6 (1)(a) and 9(2)(a) GDPR)
Where the purpose for processing your personal data has changed, we will inform you about the change and might have to seek your consent.
Who your information may be shared with (internally and externally)?
The personal data you provide us with may be shared with the Education Department of your County Council, or other external body such as GwE. If this is the case you will be informed by CYNNAL.
There are also other specific situations where we may be required to disclose information about you, including:
- Where CYNNAL is required to provide the information by law;
- Where the information is disclosed to an internal compliance service (such as Internal Audit) or to an external regulatory body;
- Where disclosing the information is required to prevent or detect a crime;
- Where disclosure is in the vital interests of the person concerned.
Under the Data Protection Legislation, you have rights as an individual which you can exercise in relation to the information we hold about you, not all rights will apply, and it will depend on the legal basis for processing your data.
The right to be informed
- You have the right to be informed about the collection and use of your personal data such as the purposes for processing your personal data, retention periods for that personal data, and who it will be shared with. This is provided when you provide us with your personal information and also within the privacy notices on this webpage.
- If we obtain your personal data from other sources, we will provide you with privacy information within a reasonable period of obtaining the data and no later than one month. This will only happen where you have not already been informed that your data will be passed to us.
- There are a few circumstances when we are not required to provide you with privacy information, such as if you have already had the information or if it would involve a disproportionate effort to provide it to you
The right of access
- You are entitled to request access to and a copy of, information we hold about you
- You can make a request to CYNNAL for any personal information we may hold about you, and the information will be provided to you free of charge.
You can do this by:
- E-mail us: firstname.lastname@example.org
- Write us:
Cwmni CYNNAL Cyf
The right to Rectification
- You have the right to ask to have your information corrected.
The right to Erasure
- You have the right to have personal data erased.
- The right to erasure is also known as ‘the right to be forgotten’.
- The right to erasure exists where:
- the personal data is no longer necessary for the purpose which it was originally collected or processed for, or
- If it was collected under consent rather than a lawful basis
The right to Data Portability
- This generally applies to instances where you wish to ‘move’ to another service provider – e.g. moving banks or phone providers. The right to data portability allows individuals to obtain and re-use their personal data for their own purposes across different services. This only applies to data processing that is carried out by automated means.
The right to restrict processing
- Individuals have the right to restrict the processing of their personal data where they have a particular reason for wanting the restriction. This may be because you have issues with the content of the information we hold or how we have processed your data.
- The right to restrict processing can apply when:
- An individual contests the accuracy of their personal data and you are verifying the accuracy of the data;
- When someone challenges the accuracy of their personal data and you check the accuracy of the data in question;
- The data has been unlawfully processed and the individual opposes erasure and requests restriction instead;
The right to Object
- Individuals must have an objection on “grounds relating to his or her particular situation”.
- Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, a data subject should be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for CYNNAL to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject
How does Cynnal protect data?
CYNNAL takes the security of your data seriously. CYNNAL has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by CYNNAL’s employees in the performance of their duties. We will use leading technologies and encryption software to safeguard your data and keep strict security standards to prevent any unauthorised access to it.
How long we will keep your information?
We will only keep your information for the minimum period necessary. After this time, information is deleted/destroyed in accordance with the Retention Guidelines.
Complaints and Enquiries
CYNNAL endeavours to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this seriously. We encourage people to bring to our attention if they believe that our collection or use of information is unfair, misleading or inappropriate.
This privacy notice does not provide exhaustive detail of all aspects of our collection and use of personal information. However we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below:
Cwmni CYNNAL Cyf
Tel: 01286 685413
If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office as the statutory body which oversees data protection law:
Information Commissioner’s Office