Unless otherwise stated, the content published on this site is promoted by Heledd Fychan, 2 High Street, Pontypridd, CF37 1QJ.

 

I, Heledd Fychan am the Member of the Senedd for South Wales Central.

This document (“privacy notice”) sets out information relating to how I will use personal information relating to constituents. It also sets out information about what rights individuals have in relation to their personal information and various other matters required under data protection law.

In particular, this privacy notice provides information to constituents about how they can object to my use of their personal information, how they can withdraw any permissions they have given to enable me to process their personal information, and how they can make a complaint.

This privacy notice contains the following sections:

• Who does this privacy notice apply to?
• What’s my approach to privacy?
• How will I use your personal information?
• When will I use your personal information for Direct marketing?
• When will I share your personal information with others?
• Circumstances in which I will send your personal information outside the EEA
• What rights do you have under Data Protection Law?
• When and how can you withdraw your consent?
• How can you get in touch with me?
• How can you complain about my use of your personal information?
• How will I notify you of any changes to this privacy notice?

Who does this privacy notice apply to?

This privacy notice applies to constituents and those who contact me in my role as Member of the Senedd for South Wales Central / a member of Welsh Parliament committees / Plaid Cymru spokesperson.

One of my key roles as a Member of the Senedd is to raise issues on behalf of constituents. As such I will often collect and use personal information relating to constituents as part of my role. From time to time I will also contact my constituents to ask them to complete surveys to gather information and opinions on matters relevant to my role as a Member of the Senedd. Please note that any data collected from an activity or resource claimed through public monies through the Senedd will not be used to support political party activities.

In the sections below, when referring to constituents I will use the terms “you” or “your”.

What’s my approach to privacy?

I take your privacy extremely seriously and want you to feel confident that your personal information is safe in my hands.

I will only use your personal information in accordance with the data protection law applicable to England and Wales from time to time.

Under data protection law, when I use your personal information, I will be acting as a data controller. Essentially, this means that I will be making decisions about how to use your personal information and why.

Below, I summarise the main rules that apply to me as a data controller under data protection law when I use your personal information:

1.	I must be upfront about how I intend to use your personal information and must use your personal information fairly. Providing privacy information to individuals (such as in this privacy notice) is one aspect of using personal information fairly.
2.	I must only use your personal information if I have a legal basis to do so under data protection law. These legal bases include: ·       That you have consented to my use of your personal information; ·       That my use of your personal information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal data by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.
3.	I must only use certain types of sensitive personal information, also referred to as special category personal information (such as information relating to your health, racial or ethnic origin, political opinions, or criminal convictions) if I can also satisfy one of the conditions for processing this type of information set out in data protection law. These conditions include: ·       That you have given me your explicit consent to use the information; and ·       That the processing is necessary for reasons of substantial public interest.
4.	I am only permitted to share your personal information with others in certain circumstances and if I take steps to ensure that your personal information will be secure.
5.	Generally speaking, I must only use your personal information for the specific purposes I have told you about. If I want to use your personal information for other purposes, I need to contact you again to tell you about this.
6.	I must not hold more personal information than I need for the purposes I have told you about and must not retain your personal information for longer than is necessary for those purposes (this is known as the “retention period”). I must also dispose of any information that I no longer need securely.
7.	I must ensure that appropriate security measures are in place to protect your personal information.
8.	I must act in accordance with your rights under data protection law.
9.	I must not transfer your personal information outside the European Economic Area (“EEA”) unless certain safeguards are in place. One such safeguard is that the personal data is only transferred to a country that has been approved by the European Commission as having an acceptable level of data protection law.

 How will I use your personal information?

How I will use your personal information, the legal bases I will rely upon, how long I will keep your personal information and other details are set out below.

CASEWORK

What personal information I will use	·       Your name; ·       Your address; ·       Your contact details (email address, telephone number etc.); ·       Information provided about you when raising an issue or a concern with me. This information may include special category personal information such as your: ·       racial or ethnic origins ·       political opinions ·       religious or philosophical beliefs ·       membership of a trade union ·       physical or mental health (including details of any disability) ·       sexual orientation ·       details of any known disability ·       commission or alleged commission of any offence (this list is not exhaustive as information held will depend on the individual case)
How I will obtain the personal information	·       Provided by you when you contact me with an enquiry or concern, when you raise a concern or enquiry with me or my staff, or by a third party where the enquiry or concern is raised on your behalf.
What purposes I will use the personal information for	·       I will use your name, address and other contact details to communicate with you about the issue or concern raised and to provide you with updates and feedback; ·       I will use your personal information to progress your issue or concern and to take steps to address the matter.
The legal bases for processing I rely upon	·       My use of your personal information in connection with the purposes set out above is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal data by me will be in performance of casework activities which by their nature support or promote democratic engagement; ·       Where your issue or concern is one which involves the processing of special category data, my use of your special category personal data will be necessary for reasons of substantial public interest. This is because the processing is carried out by me in my capacity as an elected representative, in connection with the discharge of my functions and is in response to a request by you to take action or a request on your behalf.
How long I retain the personal information and why	·       I will retain your personal information until your case is closed or until the next Senedd election, whichever is sooner.  This is because my office reviews case files before a Senedd election, when you will have the choice to receive your file or ask for it to be destroyed securely.

 

 

SURVEYS

What personal information I will use	·       Your name; ·       Your address; ·       Your contact details (email address, telephone number etc); ·       Your opinions or other personal information provided by you in the survey.
How I will obtain the personal information	·       Provided by you when you complete the survey.
What purposes I will use the personal information for	·       To obtain information relevant to inform and appraise my role as the Member of the Senedd for the constituency;
The legal grounds I rely upon	·       My use of your personal information in connection with the purposes set out above is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal data by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.
How long I retain the personal information and why	·       I will retain your personal information until your case is closed or until the next Senedd election, whichever is sooner.

 

When will I use your personal information for direct marketing?

In addition to data protection law, if I use your personal information for direct marketing purposes, I may also be subject to additional rules that regulate direct marketing. The term “direct marketing” essentially means directing marketing material or political campaign communications at a particular individual.

To ensure compliance with both data protection laws and the specific rules relating to direct marketing, I will only use your personal information to provide you with political campaign information, whether by telephone, email, text or other forms of electronic communication or by post if you have given me your specific consent to do so.

My legal basis for such processing under data protection law will therefore be that you have given your consent to process your personal data for direct marketing purposes.

I will retain your personal information unless and until you inform me that you no longer wish to receive direct marketing information from me. You can ask me to stop sending direct marketing to you at any time by contacting me using the details set out in the section below titled – “How can you get in touch with me?”

NEWSLETTERS

What personal information I will use	·       Your name; ·       Your contact details (postal address, email address, telephone number etc.); ·       Your feedback to newsletters if including a feedback slip.
How I will obtain the personal information	·       Provided by you.
What purposes I will use the personal information for	·       To provide you with newsletters about the work I undertake in your area and in the Welsh Parliament. ·       To receive your opinion on issues included in the relevant newsletter. ·       To take further steps on your behalf as a result of feedback you provide.
The legal grounds I rely upon	·       You have given your consent OR ·       My use of your personal information in connection with the purposes set out above is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is because the processing of your personal data by me will be to provide you, by post, with communications about my work, an activity which I consider promotes democratic engagement.
How long I retain the personal information and why	Until you tell me that you no longer wish to receive newsletters and updates from me. You can ask me to stop sending direct marketing to you at any time by contacting me using the details set out in the section below titled – “How can you get in touch with me?”

 

When will I share your personal information with others?

Sometimes, I will need to share your personal information with others. This section sets out details of who I will share your personal information with and why. It also tells you about my legal basis for doing so under data protection law and steps I will take to protect your personal information.

THE SENEDD COMMISSION

Information about our relationship with the Senedd Commission	The Senedd Commission is the independent body which, amongst other things, supports Members of the Senedd in their work.
Why I need to share your personal information with staff of the Senedd Commission	To obtain advice and assistance in dealing with your issue or concern.
The legal basis I rely upon when sharing your personal information	Sharing of personal data with staff at the Senedd Commission in order to assist with your case will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal data by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.
What precautions do I take?	Staff at the Senedd Commission have undertaken data protection training and are aware of the importance of protecting personal data. The Senedd Commission has in place appropriate policies and security measures to protect your personal information.

 

OTHER ORGANISATIONS WHO CAN ASSIST WITH YOUR CASE

Who are these Organisations?	We will share such of your personal information as is necessary with organisations who can assist with your case. Often these will be organisations such as local authorities and health boards which will, from time to time, depending on the nature of your query or concern, be able to assist with your case or will have information relevant to your case.
Why I need to share your personal information with them	To assist with your case or to obtain information relevant to your case.
The legal bases I rely upon when sharing your personal information	Sharing of personal data with such organisations will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal data by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.
What precautions do I take?	I will only share personal data as is necessary and will take steps to determine that the organisations are aware of the importance of protecting personal data.

 

PROVIDERS OF INFORMATION TECHNOLOGY SERVICES

Who will we be sharing your personal information with?	Suppliers of information technology products and services such as: ·       Tricostar who provides me with my casework software system. ·       The Senedd Commission’s ICT infrastructure, which includes cloud service provided by Microsoft.
Why I need to share your personal information with such providers	I use suppliers of information technology products and services in connection with the supply, maintenance and/or improvement of my IT network, to manage casework effectively through appropriate software provision, and the creation, development hosting and maintenance of my website.
The legal bases I rely upon when sharing your personal information	I rely upon my legitimate interests in ensuring that my work as a Member of the Senedd is managed efficiently and my IT system can function properly and efficiently and that my IT network is secure.
What precautions do we take?	I enter into contracts with my IT providers which require them to put appropriate security measures in place and which restrict their use of your personal information.

 

OTHER THIRD PARTIES

I may also need to share your personal information with others in the following circumstances:

Legal or regulatory requirements	On occasion, I may be required to disclose your personal information to organisations such as the courts or the police to comply with legal obligations we are subject to and/or to prevent fraud or crime.
Safeguarding	On occasion, I may need to disclose your personal information to other organisations such as the local authority or the police for safeguarding purposes in the substantial public interest.
Professional advice and legal action	I may need to disclose your personal information to my professional advisers (for example, lawyers and accountants) in connection with the provision by them of professional advice and/or the establishment or defence of legal claims.

Circumstances in which I will send your personal information outside the EEA

Other than the cloud service provided by Microsoft, I do not envisage a need to send your personal data outside the EEA. As far as Microsoft is concerned Microsoft has put a written contract in place incorporating EC model clauses relating to the transfer of personal data outside the EEA which provide safeguards to protect your personal data.

If it becomes necessary in any other circumstance to transfer your personal data outside the EEA I will let you know but rest assured that if I do need to transfer your personal data outside the EEA, I will use one of these safeguards to make sure it is protected:

• I will only transfer it to a non-EEA country which the European Commission has decided has an adequate level of protection for personal data. You can find more about such countries here https://ec.europa.eu/info/law/law-topic/data-protection_en; or
• I will put a written contract in place between me and the recipient that incorporates EC model clauses relating to the transfer of personal data outside the EEA; or
• I will obtain your explicit consent to do so.

WHAT RIGHTS DO YOU HAVE UNDER DATA PROTECTION LAW?

Under data protection law, you have a number of different rights relating to the use of your personal information. The table below contains a summary of those rights and my obligations. More information about your rights and my obligations can be found on the ICO website https://ico.org.uk/.

Your rights	What this involves	What our obligations are
A right of access	This is a right to obtain access to your personal data and various supplementary information.	·       I must provide you with a copy or your personal information and the other supplementary information without undue delay and in any event within 1 month of receipt of your request; ·       I cannot charge you for doing so save in specific circumstances (such as where you request further copies of your personal information).
A right to have personal data rectified	This is a right to have your personal information rectified if it is inaccurate or incomplete.	·       I must rectify any inaccurate or incomplete information without undue delay and in any event within 1 month of receipt of your request; ·       If I have disclosed your personal information to others, I must (subject to certain exceptions) contact the recipients to inform them, that your personal information requires rectification.
A right to erasure	·       This is a right to have your personal information deleted or removed. ·       This right only applies in certain circumstances (such as where I no longer need the personal information for the purposes for which it was collected). ·       I have the right to refuse to delete or remove your personal data in certain circumstances.	·       If this right applies, I must delete or remove your personal information without undue delay and in any event within 1 month of receipt of your request; ·       If I have disclosed your personal information to others, we must (subject to certain exceptions) contact the recipients to inform them that your personal information must be erased.
A right to object	·       This is a right to object to the use of your personal information. ·       The right applies in certain specific circumstances only. ·       You can use this right to challenge my use of your personal information based on my legitimate interests or where the processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in me; ·       You can also use this right to object to use of your personal information for direct marketing	·       If you object to me using your personal information for direct marketing, I must stop using your personal information in this way as soon as I receive your request. ·       If you object to other uses of your personal information, whether I have to stop using your personal information will depend on the particular circumstances.
A right to restrict processing	·       This is a right to ‘block’ or suppress processing of your personal information. ·       This right applies in various circumstances, including where you contest the accuracy of your information).	·       If I am required to restrict my processing of your personal information I will be able to store it but not otherwise use it. ·       I may only retain enough information about you to ensure that the restriction is respected in future. ·       If I have disclosed your personal information to others, I must (subject to certain exceptions) contact them to tell them about the restriction on use.

 

If you wish to exercise any of your rights, you can make a request by contacting me using the details set out in the section below titled – “How can you get in touch with me?”

If you request the exercise of any of your rights I am entitled to ask you to provide me with any information that may be necessary to confirm your identity.

 

Your right to withdraw consent

If you have given me your consent to use any of your personal information, you can withdraw your consent at any time. To do so, please contact me using the details set out in the section below titled – “How can you get in touch with me?”

 

How can you get in touch with me?

You can get in touch with me in the following ways:

Postal address	Heledd Fychan MS Plaid Cymru Group Welsh Parliament Cardiff Bay Cardiff CF99 1SN
Email address	[email protected]
Phone number	01443 853214

 

I am the person overseeing compliance with data protection law and this privacy notice. If you have any questions about this privacy notice, how your personal information is handled or if you wish to make a complaint, please contact me.

Right to complain to the information commissioner’s officer

If I am unable to deal with a complaint to your satisfaction or if you are unhappy with the way I am using your personal data, you also have the right to make a complaint at any time to the UK’s supervisory authority for data protection issues, the Information Commissioner’s Office.

Changes to this privacy notice

I may update this privacy notice from time to time. If I make any substantial updates, I will provide you with a new privacy notice. I may also notify you in other ways from time to time about the processing of your personal information.

 

Privacy policy for Plaid Cymru – the Party of Wales

This is our privacy policy. It is for anyone who comes into contact with us – voters, members, young people, volunteers and donors.

We can provide a copy of the policy in other formats such as large print. If you would like a copy in a different format, please contact our Data Protection Officer.

This privacy policy demonstrates our commitment to protecting your personal information.

We will process your personal information in line with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

Political parties gather information about people’s political opinions. This is entirely proper and in the public interest, as long as appropriate protection is in place. This privacy notice provides information about how we protect your personal information.

Contacting us about your information rights

If you would like more information about how we use your personal information, or to exercise your rights relating to it, you can contact our Data Protection Officer as follows.

By post:          Plaid Cymru, Tŷ Gwynfor, Llys Anson, Glanfa’r Iwerydd, CAERDYDD, CF10 4AL

By email:        [email protected]

By phone:      02920 472272

The information we process

We process the personal information of every person on the electoral register in Wales. We do this to help us encourage people to become involved in politics, as well as to promote our own political aims. We process your political opinions if you provide them to us directly or if they are publicly available. We also process information on the political opinions of our members, donors, supporters and volunteers.

We will not make your information (including information on your political opinions) public, unless we have to do so by law.

We will never sell your personal information to third parties. Sometimes we share your information with companies that help us in our work, but only if we have the legal right to do so. For example, we share people’s names and addresses with companies that send you election leaflets.

The information we collect

The electorate in Wales

We get a copy of the electoral registers from the local authorities in Wales. The electoral register gives us the following information.

• Your name
• Your address
• Your date of birth (if you are )
• Your electoral registration number (which allows us to know where you will vote at elections and referendums)
• Whether or not you have a postal vote
• Whether you voted in an election or referendum (but not how you voted)

If we contact you to ask for your political opinion and you give us that information, we will keep a record of it. We do this so that we can:

• decide whether we should send you our campaigning materials;
• choose what campaigning materials to send you; and
• decide whether we think you are likely to vote, and for which party or cause (in a referendum).

The lawful basis (legal reason) for us processing this information is ‘public task’. This lawful basis allows political parties to process personal information. You can find out more about this from the Information Commissioner.

Members

When you sign up as a member you give us your name and contact information. We use this information to provide our membership services to you. We can also process your bank details if you give us them so you can pay by direct debit.

The lawful basis for us processing this information is ‘contract’. That is because your membership of Plaid Cymru means that we provide services for you as part of a contract. 

Donors

If you make a donation to Plaid Cymru, we will process your personal information to make sure the money gets to our bank account.

We must also process your personal information in the following circumstances.

• If you donate more than £500 we must check that you are registered to vote. We must also keep a record of your name and address.
• If you donate more than £7,500 we must also report your name, and the amount of the donation, to the Electoral Commission. They publish the information in a public register.

We keep a record of smaller donations on our database.

The lawful basis for processing your donations is ‘legitimate interest’. The lawful basis for processing your information if you donate more than £500 is ‘legal obligation’.

Supporters

When you become a supporter of Plaid Cymru online, we will record your support on our database. The lawful basis for processing this information is ‘public task’.

Volunteers

When you volunteer to help us, we will record how you want to help. The lawful basis for processing this information is ‘public task’.

Attending events

If you confirm that you will attend our conferences and events, we will keep your contact information on our database. The lawful basis for processing this information is ‘legitimate interest’.

Website

We will keep your contact details if you provide them through our website. We will use this information to keep you up to date with things you are interested in. The lawful basis for us processing this information is ‘public task’.

CCTV

We use CCTV to make sure that our staff are safe and our office is secure. We keep footage for 28 days and then delete it. We have signs so that staff and visitors know that they are being recorded. The lawful basis for processing this information is ‘legitimate interest’.

Who we share your information with

We will never sell your information. Sometimes we share it with companies that help us in our work, but only if we have the legal right to do so.

We may share information with:

• mailing companies, so that voters and members can be sent information
• email software providers such as NationBuilder
• elected representatives, candidates and local campaigners, and
• regulatory bodies and law-enforcement agencies, when necessary for investigations.

How long we keep your information for

We regularly review the information we hold, how relevant it is and whether we need to keep it. We will only keep your personal information for as long as we need it. Please contact us if you would like a copy.

Cookies

A cookie is a tiny text file that is stored on your computer. We may use cookies to track the ways people move about our website. We also use them to monitor the website’s security. You can usually prevent cookies by using the tools in your browser.

We may store the internet address you used to connect to our computer, the time and date you connected, browser information and the pages you visited.

Targeting cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
google.com
youtube.com

Performance & Analytics cookies:
Google Analytics

Log files and statistics

We use a range of technical systems to keep an eye on how our website is working, including:

• IP addresses
• URLs of documents downloaded
• timestamps
• HTTP user-agents, and
• Google Analytics (which itself uses cookies to analyse how visitors use our website).

Transferring your information outside the European Economic Area

Some of our service providers are based outside of the European Economic Area (EEA), so we may sometimes need to share your personal information outside of the EEA. If we do transfer your data outside the EEA we will make sure that it is protected in the same way as if the information was inside the EEA.

We will make sure of this by:

• sending the information to a service provider in a country where the data-protection standards are approved by the EU
• transferring it to an organisation that meets the standards of the EU-US ‘Privacy Shield’, and
• having a contract with the party we are sending the information to, the terms of which specify that they need to keep to the necessary standards.

How we protect your information

The security of your information is very important to us. We protect it with technical and organisational measures. We regularly review our security measures to make sure that your information is safe.

Your rights over your information 

We will act as quickly as possible when you ask to exercise any of your data rights (set out below), which will be within one month unless your request is particularly complex. In this case we will tell you about the delay and our reasons for it.

Your data rights

Right of access – you can ask for a copy of your personal information and details of how we use. This request is commonly known as a subject access request. 

Right of rectification – you can ask us to correct inaccurate or incomplete information about you.

Right to be forgotten – you can ask us to delete information we hold about you.

Right to restriction of processing – you can ask us to restrict how we process your information.

Right to object – you can ask us to stop contacting you personally. However, we still have the right to send you an addressed leaflet at election time, and you may still receive unaddressed leaflets.

Right to object to processing political data – you can ask us to stop processing information about your political opinions.

Profiling

If we have information about your voting intentions and your voting history, we will assess how likely it is that you will vote for Plaid Cymru. This is called profiling, and we don’t think that this has a significant effect on you.

Making a complaint 

If you are unhappy with how we have processed or handled your information you can complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate how personal information is collected, used and stored in the United Kingdom. The contact details for the Information Commissioner’s Office are as follows.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Phone: 0303 123 1113
Website: www.ico.org.uk/concerns/