Reaching Wider National Privacy Notice

The purpose of this privacy notice is to help you understand why Reaching Wider asks for your personal data, how we use your data, our obligations under the law and your rights.

The information you provide will only be processed in accordance with this privacy notice, and in accordance with to obligations laid out in the Data Protection Act 2018 (DPA) the UK General Data Protection Regulation (UK GDPR) and associated legislation.

Reaching Wider is made up of three separate partnerships. The controllers of your data will depend on the partnership that you are engaging with:

  • North and Mid Wales – Bangor University is the controller. Other educational institutions in the North Wales region process the data on behalf of Bangor University.
  • South East Wales – University of South Wales, Cardiff University and Cardiff Metropolitan University are ijoint controllers.
  • South West Wales – Swansea University is the controller. Other educational institutions in the South West region process the data on behalf of Swansea University.

Joint controllers – means that these universities are jointly responsible for determining the purpose and the means of processing the personal data. Each partnership has an agreement in place setting out the roles and responsibilities of the institutions.

What information does Reaching Wider collect about participants?

We may collect the following pieces of information for all participants who take part in our activities. this helps Reaching Wider demonstrate that our activities are engaging young people from backgrounds that are currently under-represented in Higher Education. Information indicated by a * may be shared with third parties for tracking the participant’s educational journey and / or research purposes including Universities and Colleges Admissions Service (UCAS).

  • Name*
  • Date of birth*
  • Gender*
  • Home address and postcode*
  • Unique Learner Number*
  • School / College / Organisation*
  • Highest level of education (adults only)
  • Whether the participant’s parent(s) or brothers and sisters went to university. (Providing this information is not essential but allows Reaching Wider to report on the number of participants who are potentially the first in their family to go to university) Whether the participant has experience of being in the care system (Providing this information is not essential but it allows Reaching Wider to report on an under-represented group and to provide priority access to some events)
  • During events Reaching Wider staff or third parties contracted by Reaching Wider may take and publish photographs (with consent) to be used for marketing purposes such as on our website, in our newsletter or within social media accounts.
  • Whether a participant / parent /guardian would like to receive marketing communication from Reaching Wider about other relevant activities.
  • Language preference
  • Whether the participant is a carer for a family member or dependant
  • Whether the participant in in receipt of free school meals or Educational Maintenance Allowance (EMA)
  • Disability¹
  • Ethnicity¹

¹Disability and Ethnicity information will not be shared with third parties but will be used to inform the Equality Impact Assessment And for equality monitoring

Reaching Wider also require additional mandatory information so that Reaching Wider staff and third parties delivering on behalf of Reaching Wider can provide appropriate support and ensure the health and safety of all participants and staff. These include:

  • Disability information
  • Emergency contact details
  • Dietary requirements
  • Cultural requirements
  • Allergies
  • Medical arrangements
  • Medication taken
  • Parental consent to provide paracetamol to under 16s should the need arise

South East Wales Partnership receive some information about all pupils in a year group directly from participating schools on an annual basis, before activities are arranged. This is for the purposes of evaluation, monitoring, research in the public interest and for arranging activities – see ‘why does Reaching Wider collect this information’. The information is shared under the terms of a Data Disclosure Agreement which shows that the partners have considered the requirements of the data protection legislation. Your school should have told you if they are signed up to this agreement and you will be able to opt out by contacting the school.

What information does Reaching Wider collect about teachers /other contacts?

Through an online form on the Reaching Wider website, we collect the following pieces of information from teachers and other contacts who would like to be kept informed of Reaching Wider activities; the newsletter and other relevant opportunities for their school/college.

  • Contact details
  • Subject area
  • Position held at school/college
  • Teaching responsibility for which year groups
  • Contact language preference
  • School / College

Why does Reaching Wider collect this information?

Reaching Wider collects data on individuals for the following five reasons.

  1. For the purposes of monitoring, which allows Reaching Wider to:
    • fulfil compulsory external reporting requirements to regulatory bodies such as Medr (the Commission for Tertiary Education and Research).
    • provide a clear picture of the activities we deliver and the people we work with.
    • ensure that we are reaching those that could benefit most from outreach activities.
  2. For the purposes of research and evaluation which helps us to assess the effectiveness of different initiatives on widening participation to Higher Education. This includes the anonymous long-term tracking of participants’ education journeys, to identify how many Reaching Wider participants go on to study at university.
  3. Identify participants who belong to groups, which are under-represented in Higher Education and to ensure that people from these groups are given priority access to Reaching Wider activities. For further information on this please see information on the Medr website.
  4. Ensure the health and safety and wellbeing of all participants in our programmes and to assist with pastoral and welfare needs e.g., ensuring that we are aware of medical conditions and disabilities.
  5. To send relevant and necessary information regarding forthcoming activities as well as marketing communications.

What is the legal basis for processing the data?

Widening participation is a key component of the Welsh Government’s education policy and is represented in the three lead University’s civic mission. Reaching Wider processes personal data as it is necessary for it to perform a task in the public interest and for its official functions.

The legal basis for processing special category data (such as ethnicity) is on the basis that it is in the substantial public interest and is necessary for statistical purposes to monitor equality of opportunity in accordance with the Equality Act. This processing is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained.

The legal basis for processing special category data for residential and out of school activities (such as health data) is on the basis that it is in the substantial public interest and is necessary for the safeguarding of children or individuals at risk or providing support to individuals with a particular health condition or disability.

The legal basis for taking and using photographs for promotional purposes and sending marketing material in relation to forthcoming activities is ‘consent’. The parents/guardians/carers of all participants aged 16 and under are asked if they consent to photograph/film being taken of their child for publicity reasons (such as newsletters, website, social media). During an event, children whose parents have consented to this data usage will be given an opportunity to opt out.

We may rely on the ‘Legitimate Interests’ lawful basis for the following processing activities relating to this initiative:

  • Necessary administrative transfers between named HEI partners
  • The use of photographs of adult participants for promotional and marketing purposes, where it is in line with their expectations and where there is limited privacy impact
  • To demonstrate appropriate use of public monies as it is the personal data that confirms an individual’s eligibility against Reaching Wider criteria.

The legitimate interests identified are namely – ensuring that all eligible audiences are benefitting from the Reaching Wider provision and that the personal data can flow between the partners to achieve this objective, as well as promoting the Widening Participation Scheme which benefits participants and the universities.

How will Reaching Wider process the data and who might it be shared with?

For initiatives which are organised directly with schools and colleges, participant information forms and explanatory documentation will either be sent to the school/college for providing to the participant or parent as appropriate or populated during the activity. Children aged 13 and above may sometimes complete the forms themselves during the activity, depending on the partnership you are engaging with. The form collects information about the participant and asks for consent to process information for marketing purposes. The form is returned to the relevant Reaching Wider staff member.

The Reaching Wider staff member may use this information to create a secure attendance register, which will be stored on a secure university server. Access to this information is restricted to Reaching Wider members of staff and relevant information is shared with third parties contracted to deliver activities.

Next, the participant information is visually checked and transferred from the paper or e-forms into a secure online database which can only be accessed by Reaching Wider staff within the relevant partnership.

Organisations processing personal data of Reaching Wider’s behalf will be bound by a Data Processing Agreement which will outline their obligation to process personal data in accordance with all Data Protection legislation.

For the purposes of monitoring and research, participant personal data may be shared with the partner universities and colleges.

Personal data is shared with Universities and Colleges Admissions Service (UCAS) to enable anonymous long- term tracking of participants’ educational journey into Higher Education.

How long will Reaching Wider retain the information?

Reaching Wider will retain participants’ data in line with the Reaching Wider Retention Schedule.

In summary: paper copies of information will be securely destroyed once they have been scanned into the secure electronic database. Electronic records are held on a secure online database for a period of up to 15 years after an event.

Data shared / linked with third parties for research purposes will be retained in an anonymised format, meaning that individuals are no longer identifiable.

What are my rights?

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. Some of these rights are not absolute and only apply in certain conditions. More information on your rights can be found on the Information Commissioner’s website.

You have a right to withdraw consent at any time and you can do so by contacting the Data Protection Officer or the Reaching Wider Partnership Manager for the partnership that you are engaging with:

For South-East Wales any requests or objections should be made in writing to the University of South Wales Data Protection Officer: –

University Secretary’s Office
University of South Wales
Pontypridd
CF37 1DL
Email: dataprotection@southwales.ac.uk

For North and Mid Wales any requests or objections should be made in writing to Bangor University’s Data Protection Officer:

Data Protection Officer
Vice Chancellor’s Office
Corporate Services
College Road
Bangor
LL57 2DG
Email : info-compliance@bangor.ac.uk

For South-West Wales any requests or objections should be made in writing to Swansea University’s Data Protection Officer:

Information Compliance Manager
Vice-Chancellor’s Office
Swansea University
Singleton Park
Swansea
SA2 8PP
Email: dataprotection@swansea.ac.uk

Security of data

Data protection legislation requires Reaching Wider to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts of your information will be authorised to do so. All personal data which is stored electronically will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.

How do I complain?

If you are unhappy with the way in which your personal data has been processed, you may in the first instance contact the relevant lead university using the contact details provided above.

If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:
Information Commissioner’s Office,
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.org.uk