This privacy notice tells you what to expect when the Engineering Education Scheme Wales (EESW) collects information from you.  We treat privacy and confidentiality very seriously, and all information we collect, process, and store complies with the General Data Protection Regulation 2016/679 (GDPR) and the Data Protection Act 2018 (DPA). 

Collection purpose

To take part in our activities, we will collect personal data from you.  This is for our own purposes of monitoring and evaluating our activities, but may also be used for reporting to our various funders.  The information you provide will be processed by us so that we can record involvement with our activities.  We are the Data Controller for this information.  As the Data Controller, we are responsible for deciding how your personal data is processed and for what purposes.  When data is used for research purposes no identifiable data will be published without explicit consent from the individual; e.g. case studies.  For a list of information we collect on all individuals, please download the EESW Privacy Notice - Further Information.  

If you are a participant of a project funded by the UK Government Levelling Up (including our Introduction to Engineering and Manufacturing workshops) we we will collect and use your information for the purposes of the funding.  This privacy notice should be read in conjunction with the UK Shared Prosperity Fund: privacy notice at https://www.gov.uk/government/publications/uk-shared-prosperity-fund-privacy-notice/uk-shared-prosperity-fund-privacy-notice

During the course of our business and delivery of services to you we may take photographs and videos to promote our services, activities and events. Some of these photographs/videos may contain images of you.  This privacy notice explains when such images/videos may be taken, how the images/videos may be used and our lawful basis for taking and using the images.  

Where we intend to photograph or film at public events, we will ensure that there is appropriate signage in place to advise attendees of this.  We hold images and videos of the people we have photographed and recorded. Some of these images may be close up images that  clearly identify a person, whilst others may be images of a crowd for example, taken at a distance which only partly identifies a person. 

Where we require consent from an individual to take their photograph/video (see below) we may also hold the following details:

• Contact details, including name, address, telephone number and sometimes email address
• Details of when consent was provided
• Information relating to a parent/guardian/school and child where the consent relates to a child or young person under the age of 16.  

Lawful basis for processing your data

The relevant lawful bases within the GDPR for collecting your personal data are:

• Consent
• Legal obligation
• Public task
• Legitimate interests

Special category (sensitive) data

The GDPR recognises that some types of personal data are more sensitive, and are classed as “special category data”.  EESW may collect data about an individuals’ health to enable participation in some of our activities, specifically referring to medical conditions or allergies, for purposes of visits to companies or overnight stays at universities. 

EESW collects and processes this data in the interest of the data subject to ensure that individuals are safeguarded, particularly young people (the participant).  This data is collected with explicit consent from the parent/guardian/teacher.  For a list of special category data collected, please refer to the EESW Privacy Notice - Further Information.  

Who else will receive my data?

This privacy notice states how the information is used and who will have access to it.  EESW only shares information with third parties where absolutely necessary. 

Third parties include:

• The Welsh Government
• The Local Authorities of Conwy, Wrexham and Ceredigion and the UK Government for participants of the I2EM workshops funded by the UK Shared Prosperity Fund
• Accountants and auditors for financial obligations (where applicable)
• External evaluators appointed by EESW
• We may share images with third parties for marketing purposes, which may include newsletters, local/national press, printing companies and for use in online website content and social media or promotional materials.  

EESW uses email marketing campaigns to teachers, schools and participants (EESW and Headstart Cymru only where participants are 16 or over).  The MailChimp website is hosted outside of the European Economic Area and the only data that is uploaded by EESW to MailChimp includes name, school/company and email address.  MailChimp are committed to achieving complaince with the GDPR and has self-certified to both the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield regimes, and lawfully transfers EU/EEA personal data to the U.S. pursuant to our Privacy Shield Certification.  If you would like to opt-out at any time, please click the unsubscribe link at the bottom of the email.  Please note that if you unsubscribe we may keep a record of your personal information to ensure that we do not send any further communication. 

Retention period

For verification purposes, any data that you provide us with will be retained in line with our document retention policy at the time the data was provided.  Legacy data will be retained for at least three years following the end of the STEMCymru and STEM Cymru 2 operations and could be as late as 31 December 2026.  

Images and/or video may be retained and used by EESW until more up-to-date images replace them.  

Your rights

You have a number of rights in relation to your personal data, as follows, however not all of the rights apply in all circumstances. 

1. The right to be informed – this privacy notice sets out what information is collected and who it will be shared with
2. The right of access – you have a right to access the personal information we hold about you
3. The right to rectification – you have the right to have any inaccurate information rectified or completed if it is incomplete. You can make this request verbally or in writing. 
4. The right to erasure – Generally, participants do not have the right to erasure because this right does not apply if using the public task lawful basis. The only circumstances under which this right would apply would be if participants’ personal data is no longer necessary for the purpose which you originally collected or processed it for, or if you have processed the personal data unlawfully.
5. The right to restrict processing – this right only applies where you are contesting the accuracy of the data, the data has been unlawfully processed or if you have objected to processing and we are considering your case
6. The right to portability - under the lawful basis of data collection for WEFO this right is removed.
7. The right to object – you have the right to object however you must give specific reasons and we may be able to demonstrate legitimate grounds for overriding your objection.
8. Rights in relation to automated decision making and profiling – we will not undertake any automated decision-making so this right does not apply.

For more information, please refer to https://ico.org.uk/your-data-matters/

Who should you contact?

If you have any questions/queries relating to the above, or to make a Subject Access Request request, please contact info@stemcymru.org.uk 

If you want to exercise any of these rights, please contact our data protection lead either verbally or in writing:

Rebecca Davies
EESW
Waterton Centre
Bridgend
CF31 3WT 

Telephone: 01656 669381
Email: info@stemcymru.org.uk

You will receive a response within the required time limit (one month in most circumstances). 

You are also entitled to lodge a complaint with the Information Commissioner’s Office (ICO) who is the independent regulator for data protection as below:

Information Commissioner’s Office – Wales
2nd Floor, Churchill House
Churchill Way
Cardiff
CF10 2HH

Telephone: 016 2554 5297
Email: wales@ico.org.uk

Changes to this Privacy Notice

This privacy notice was last updated on 20th December 2023.  We keep this privacy notice under regular review and may change it from time to time by updating this page in order to reflect changes in the law and/or privacy practices.  We would encourage you to check this privacy notice for any changes on a regular basis.