Privacy Policy

Privacy Notice – Cyd Service

The Welsh Government facilitates the Cyd Commercial & Procurement Service (Cyd), a community led service that enables shared learning, collaboration and practical support for procurement, commercial and contract management professionals across the Welsh public sector, helping them translate policy and strategic objectives into effective day-to-day practice.

Cyd provides a range of services designed to develop capability, promote collaboration and support effective commercial and procurement practices across Wales. These services may include:

Commercial & Procurement Community of Practice.
Events, webinars, workshops and knowledge-sharing sessions.
Tailored support and advice.
Access to guidance, templates, tools and resources.
Peer networking and collaboration opportunities.
Surveys, research, feedback and service evaluation activities.
Communications relating to commercial and procurement capability development.

When you register for, participate in or contact us about certain Cyd services, the Welsh Government will process personal data about you. Some Cyd information and resources may be available without you providing personal data. However, where personal information is needed to administer a particular service, event or activity, that

A data controller determines how and why personal data can be processed. This privacy notice gives you general information on how we handle your data when you engage with Cyd services

What personal data do we hold and where do we get this information?

Personal data is defined under the General Data Protection Regulation (GDPR) as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier’.

or otherwise interact with Cyd Services, Depending on the Cyd Service, we collect some or all of the following information :

name and contact details;
job title, role and employing organisation;
Community of Practice membership and areas of professional interest;
event registration and attendance information;
correspondence and details of enquiries or support requests;
survey responses and feedback;
questions, comments, chat messages and other voluntary contributions;
Microsoft 365 profile information and platform activity connected with Cyd;
image and voice where an event is recorded;
communication preferences, including consent or opt-out records.

Registration for events coordinated by Cyd will typically be available via, Business Wales. Business Wales will collect your personal information, specifically name, email address and organisation and share your information with us to enable us to manage your request to attend the event. Details on how Business Wales collect your personal information through registration can be viewed by clicking here. Alternatively, where Cyd events are not coordinated via Business Wales the Cyd Team will provide you with a Microsoft Tool link to via email to join the event.

Cyd services may utilise approved Welsh Government digital platforms, including Microsoft 365 applications such as Teams, Outlook, SharePoint and Forms, to facilitate events, collaboration, surveys, communications and information sharing. Information generated through your use of these platforms in connection with Cyd activities may be processed for the purposes described within this notice.

We may use the personal data you provided when you interacting with Cyd services to share information with you about relevant Cyd activities, events, services and opportunities. This forms part of our delivery of Cyd and is not dependent on a separate opt-in.

You may withdraw that consent at any time by contacting the Cyd Team or using any unsubscribe option provided. Withdrawing consent will not affect your access to core Cyd services or the lawfulness of processing carried out before consent was withdrawn. You can withdraw your consent and opt out of future communications at any time by contacting the Welsh Government using the contact details set out in the Further Information section below.

Community of Practice Membership

If you choose to register to become a member of the Commercial and Procurement Community of Practice, we will use your information to:

Manage membership records.
Provide access to Community of Practice activities.
Communicate relevant information, resources and opportunities.
Facilitate collaboration, networking and peer learning.
Understand areas of interest and support requirements across the community.
Evaluate and improve Community of Practice services.

A membership directory will be maintained by the Welsh Government to administer Community of Practice membership and activities. This directory will not be shared with Community of Practice members and will only be accessible to authorised staff involved in the delivery and management of the Community of Practice.

As part of participating in Community of Practice activities, certain information may be visible to other members. For example, your name, organisation, job title, email address and any comments, questions or contributions you choose to make may be visible to other participants during webinars, Microsoft Teams meetings, collaboration sessions, discussion activities or other Community of Practice events.

Participation in discussions, collaborative activities and knowledge-sharing sessions may result in information you provide being visible to other members participating in those activities. Members will be made aware that in the Community of Practise Terms of Reference that they should only use information obtained through Community activities for legitimate professional and Community of Practice purposes.

Tailored Support and Guidance Requests

Where you request tailored support, guidance documents, templates or advice, we may collect and retain information relating to your enquiry.

This information will be used to:

Respond to your request.
Provide appropriate guidance and support.
Monitor service demand and effectiveness.
Improve future services and resources.
To provide support opportunities of a similar nature
Produce anonymised management information and reporting.

Only information necessary to provide the requested support and future similar support will be collected and processed.

Events, Workshops and Webinars

Cyd organises and promotes a range of events to support capability development, knowledge sharing and collaboration across the Welsh public sector. Events may include presentations from Welsh Government officials, external speakers, workshops, panel discussions and question-and-answer sessions.

Where Microsoft Teams or other collaboration platforms are used to host events and Community of Practice activities, participant information such as names, email addresses, profile information, chat messages, questions, reactions and meeting attendance may be visible to other participants as part of normal platform functionality. In addition, personal data submitted via the Chat bar when asking questions or making comments will be visible to all attendees and collected by us unless you engage via the anonymise options. These comments/questions will be captured in the transcript.

We will tell you before an event if it will be recorded or transcribed and explain how the recording will be used and who will be able to access it. Where reasonably possible, we will provide a way to participate without your image, voice or identifiable contribution appearing in a publicly available recording. Separate arrangements may apply to invited speakers and presenters.

Participants will be informed when a recording is taking place. Recordings may be hosted on Welsh Government systems or approved digital platforms to support access to learning materials and knowledge sharing such as YouTube or LinkedIn. Some approved digital service providers may process personal data outside the UK. Where this occurs, the Welsh Government will ensure that an appropriate transfer mechanism and safeguards are in place. You may contact the Cyd Team for further information about the safeguards relevant to your personal data.

Feedback, Surveys and Research

We may use surveys, questionnaires and feedback mechanisms to evaluate Cyd services and identify future support requirements.

We do use survey software from time to time that allows respondents to save and return to a survey, so they do not have to complete a survey in one go. If you select ‘save and continue later’, the software will ask your name and email address so that a unique link is generated and emailed to you so you can go back and complete the survey at a convenient time. This information is only retained by the software so you can re-access the survey. This information is then deleted in line with the software’s data retention procedures. Your name and address details will never made available as part of your survey response and is inaccessible to the Cyd Team.

Questions asked in our feedback surveys will not typically request any personally identifiable information. However, where they do so or if you choose to provide information that identifies you, this information will only be used for the purpose for which it was collected. Survey findings will normally be reported in aggregated or anonymised formats and will not identify individual respondents. Where contact details are requested to enable follow-up discussions, participation is entirely voluntary.

Communications

We may use your contact information to:

Administer your Community of Practice membership.
Provide information about Community of Practice activities.
Promote upcoming events, workshops and learning opportunities.
Share relevant commercial and procurement updates.
Provide resources, guidance and support available through Cyd.
Facilitate networking and collaboration opportunities.
Communicate information relating to capability development across the Welsh public sector.

You may opt out of receiving non-essential communications at any time by contacting the Cyd team.

What is the lawful basis for using your personal data?

Engaging with Cyd services and the necessary administration is conducted under Article 6(1)(e) (public task).

Contacting you about Cyd services including future events or services of a similar nature and requesting feedback where contact details are used, is based on your consent under Article 6(1)(a).

Registration for Cyd Services, participation in feedback and agreeing to receive future communications is completely voluntary. However, your participation, views and experiences are important to support capacity building, inform improvement and the provision of Cyd services.

How secure is your personal data and who do we share your information with?

Personally identifiable information shared on registration for Cyd Services will be held by the Welsh Government’s Capability Team and will only be accessed by staff members within this division to share communications with regards to our services. Any information provided is stored on a protected area of iShare (Welsh Government’s internal document management system).

Event Recordings may be hosted on Welsh Government platforms or publicly accessible platforms such as YouTube or LinkedIn to maximise accessibility, knowledge sharing and transparency. If captured in the recording your name will be displayed in the uploaded recording and will be available to the public.

We use approved service providers and digital platforms to support the delivery of Cyd. Depending on the service concerned, these organisations may process personal data on behalf of the Welsh Government or act as a separate controller. Further information about the relevant arrangements will be provided where required.

Cyd does not normally require special-category personal data. Please avoid including sensitive personal information in free-text responses, chats or support requests unless it is necessary. If special-category personal data is required for a specific activity, we will explain the applicable lawful basis and condition at the point of collection.

Reporting and Analysis

Information collected through Cyd services may be used to produce management information, service reports and evaluation activities.

Where reporting is undertaken, information will normally be presented in an aggregated or anonymised format and will not identify individual participants.

How long do we keep your personal data?

We will retain personal information up to 3 years from the point at which the information is provided to enable us to deliver Cyd services, to provide tailored communications on future Cyd services and to meet legal, audit and governance requirements. If you are a member of the Community of Practice we will retain any contact information for the life of the community, or your part in it, plus 3 years. If you leave the Community of Practice, we will remove you from the active membership list and stop membership communications. We may retain a limited historic record for the period described below where this is necessary for audit, governance or records-management purposes.

Retention periods may be reviewed periodically to ensure alignment with Welsh Government records management, audit and legal requirements. Information that is no longer required will be securely deleted or anonymised in accordance with Welsh Government retention policies.

If you do not wish for your details to be retained for any of the Cyd services refer to in this Privacy Notice please contact us via the email address detailed in the Further Information section below.

During events we may use Microsoft tools for transcription purposes, this transcript will be used as a record of the information provided during the event. We retain transcripts for up to three years to support knowledge sharing, evaluation of training impact, and for audit purposes. Content that is no longer relevant will be reviewed and removed earlier where appropriate

We will also retain event recordings for up to three years to support knowledge sharing, evaluation of training impact, and audit purposes. Content that is no longer relevant will be reviewed and removed earlier where appropriate

Your rights

Under data protection legislation, you have the right:

to be informed of the personal data Welsh Government holds about you and to access it
to require us to rectify inaccuracies in that data
to (in certain circumstances) object to or restrict processing
for (in certain circumstances) your data to be ‘erased’
to (in certain circumstances) data portability
to lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection

Further Information

If you have any further questions about how the data provided as part of this work will be used by the Welsh Government or wish to exercise your rights using the General Data Protection Regulation, please contact:

Name: Cyd Team

E-mail address: Cyd@gov.wales

How to make a data protection complaint

The Welsh Government is committed to handling your personal data safely, securely and only for as long as we need.

If you have any concerns about how we use your personal data, we encourage you to raise them with the relevant team in the first instance.

You can also contact the Data Protection Officer by emailing DataProtectionOfficer@gov.wales or writing to the DPO at:

Welsh Government, Cathays Park, Cardiff, CF10 3NQ

If you wish to make a formal complaint about how the Welsh Government has processed your personal data, you can do this in the following ways:

Online form – Complete our online complaint form.

Phone – 03000 251378

Email – Download the form and email to complaints@gov.wales

By post to:

Complaints Advice Team, Welsh Government, Cathays Park, Cardiff, CF10 3NQ

We will acknowledge your complaint and respond within an appropriate timescale, in line with data protection legislation and our complaints process.

If we are not able to resolve your data protection complaint, you have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is the UK’s data protection regulator. However, the ICO will expect you to raise your concerns with us in the first instance. The ICO’s contact details are:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone number: 0303 123 1113

Website: ico.org.uk