Privacy Notice

About

We protect your personal information and respect your privacy rights.

We collect information when you apply, enrol, or use our services.
We use your information to provide education, support your learning, and meet legal requirements.
We share some information with government departments and support agencies to help you succeed.
You have rights including accessing your information, correcting errors, and making complaints.
We keep information secure using modern security measures and trained staff.
Questions? Contact our Data Protection Officer: data-protection@cymoedd.ac.uk

For learners under 18: You have the same privacy rights as adult learners. We may contact your parents/carers if you give us permission or if there is a perceived safeguarding risk.

Download and read the full Privacy Notice on the Policies and Documents page.

Getting started

Who this policy covers

This policy explains how Coleg y Cymoedd handles personal information for:

Current and prospective learners (including apprentices and work-based learners)
Parents and carers (where learners have given permission)
Website visitors and anyone using our digital services
Community users accessing college facilities or services

What “data controller” means: We decide how and why your personal information is used. Think of us as the organisation responsible for keeping your information safe and using it properly.

Important note about Welsh Government funded programmes: If you’re on a Welsh Government funded programme, the Welsh Government acts as data controller for some of your information through the Lifelong Learning Wales Record (LLWR) from 1st August 2024 until 1st April 2026. From April 2026, Medr (Wales’s Commission for Tertiary Education and Research) will process data relating to apprenticeships, further education, and adult community learning on behalf of Welsh Government.Our legal promise: We handle your information fairly, securely, and follow all data protection laws.

Your rights at a glance

Under UK data protection law, you have these rights:

Your right	What this means	How to use it
Access	Get a copy of information we hold about you	Email us with proof of identity
Correction	Fix errors in your information	Contact Learner Services
Deletion	Ask us to delete your information (in some situations)	Email us explaining why
Objection	Object to how we use your information	Email us with your concerns
Restriction	Limit how we use your information	Email us explaining what you want restricted
Complaint	Complain to the data protection regulator	Contact ICO directly or through us

Most requests are free, and we respond within one month.

Key contacts

Contact	Details	When to use
Data Protection Officer	Karen Workman data-protection@cymoedd.ac.uk Twyn Road, Ystrad Mynach, Hengoed, CF82 7XR	Privacy questions, data requests, complaints
Learner and Campus Services	enquiries@cymoedd.ac.uk	General queries, simple corrections
Information Commissioner’s Office	ico.org.uk 0303 123 1113	External complaints

Registration Number: Z7228714

Response time: We aim to respond to all queries within 3 working days.

What information we collect

When you apply or enrol

Basic information we need:

Name, address, and contact details
Date of birth and gender
National identity information (to confirm funding eligibility)
Previous education and qualifications
Emergency contact information

Additional information that helps us support you:

Disability or learning support needs (e.g. dyslexia support, wheelchair access)
Health conditions that might affect your studies (e.g. diabetes, anxiety)
Financial circumstances (for Grants and Financial Contingency funding)
Ethnic background (helps us ensure fair access)
Employment status and career goals

Legal basis:

Most information is required by law or necessary for your enrolment (Article 6(1)(b) and 6(1)(c) UK GDPR)
For Welsh Government funded programmes, we process your data under Article 6(1)(e) UK GDPR (public task)
Special category information (ethnicity, disability, health) is processed under Article 9(2)(g) (substantial public interest) and Article 9(2)(j) (statistical purposes) UK GDPR

Why we ask: This helps us:

Provide the right support for your learning
Meet our legal duties to monitor equality
Ensure you get appropriate funding
Keep you safe on campus
Comply with Welsh Government funding requirements through the Lifelong Learning Wales Record (LLWR)

Your choice: We clearly mark what’s optional vs. required

During your studies

Academic information:

Course attendance and progress
Assessment results and feedback
Learning support provided
Disciplinary matters (if any)

Support services:

Counselling or wellbeing support accessed
Financial support received
Career guidance received
Additional learning support

Online safety monitoring:

Internet activity on learner devices using Smoothwall monitoring software
Websites visited and search terms used on college-provided or college-managed devices
Online safety alerts and reports for safeguarding purposes
Time and date of online activity on learner devices

Why we collect this: To support your learning, track your progress, provide appropriate help, and meet our legal obligations as an education provider and Welsh Government funding requirements.

Investigation and complaints processes

CCTV footage:

Video recordings from college premises for security and safety
Audio recordings where legally permitted and clearly signposted
Automatic number plate recognition in car parks

AI-assisted notetaking during investigations:

Digital transcription of investigation meetings and interviews
AI-generated summaries of key points and actions
Automated identification of themes and patterns in complaints

Investigation records:

Formal complaints and their outcomes
Disciplinary proceedings and evidence
Witness statements and supporting documents
Risk assessments and safety measures

Legal basis: We process this information to:

Investigate complaints fairly and thoroughly
Ensure campus safety and security
Protect all members of our community
Meet legal obligations for safeguarding
Learn and improve our services

Our Ethical AI Commitments

Principle	What we do	Your benefit
Human oversight	All AI content reviewed by trained staff	Accuracy and fairness
Accuracy focus	Regular testing and updates of AI systems	Reliable records
Limited access	Only authorised investigation staff	Privacy protection
Secure storage	Encryption and secure storage	Data security
Clear retention	Delete when no longer needed	Limited data storage
Transparency	Always tell you when CCTV/AI is used	No hidden surveillance

Important: You’ll always know if CCTV footage or AI notetaking is being used in any process involving you.

Website and digital services

When you visit our website:

Pages you visit and time spent
Your device type and browser
General location (country/region)
How you found our website

When you use our online services:

Login information and activity
Course materials accessed
Online discussions and submissions

Why we collect this: To improve our website, protect against security threats, and provide better online services.

How we use your information

Supporting your learning

Course delivery and management:

Enrolling you on courses
Tracking attendance and progress
Providing feedback and assessment
Arranging work placements or apprenticeships

Student support:

Identifying and providing learning support
Health and safety measures
Financial support and guidance
Career and progression advice

Quality improvement:

Analysing course effectiveness
Learner satisfaction surveys
Learner destination tracking

Legal requirements

Government reporting:

Learner numbers and demographics
Course completion rates
Employment outcomes
Equality and diversity monitoring
Lifelong Learning Wales Record (LLWR) submissions for Welsh Government funded programmes

Funding compliance:

Eligibility verification
Attendance monitoring
Outcome reporting
Audit requirements

Safeguarding:

Protecting learners from harm
Prevent duty obligations
Supporting vulnerable learners
Investigating safety incidents using CCTV footage
Monitoring campus security and preventing crime
Monitoring online activity on learner devices using Smoothwall to identify safeguarding concerns and ensure learner safety

Investigation and complaint resolution:

Fair and thorough investigation of complaints and concerns
Disciplinary proceedings with accurate record-keeping
Using CCTV footage to establish facts and ensure safety
AI-assisted notetaking to create reliable investigation records
Pattern analysis to identify and address systemic issues

Improving our services

Research and analysis:

Understanding learner needs
Improving teaching methods
Developing new courses
Campus planning

All research uses anonymous information where possible.

Government and funding bodies

Welsh Government:

Learner records for the Lifelong Learning Wales Record (LLWR) for all Welsh Government funded programmes
Funding and performance data
Statistical information for policy development
Note: Welsh Government is the data controller for LLWR data from 1st August 2024 until 1st April 2026. Thereafter, Medr will take over processing responsibilities

UK Government agencies:

Student Loans Company (for funding)
Department for Work and Pensions (for benefit coordination)
HMRC (for apprenticeship levy)
Department for Education (for Longitudinal Educational Outcomes Study – LEO)

Medr (from April 2026):

Commission for Tertiary Education and Research
Will process apprenticeship, further education, and adult community learning data on behalf of Welsh Government

Why we share: Legal requirements for funding, statistical reporting, and coordinating support services.

Support organisations

Local Authorities:

Supporting 16-25 year olds into education and training
Coordinating local services
Safeguarding responsibilities

Careers Wales:

Career guidance and support
Tracking participation in education and training
Supporting young people into employment
Enhanced data sharing for active client matching and support services

Research and evaluation organisations:

Office for National Statistics (ONS) for aggregate statistics and Census accuracy
Digital Health and Care Wales (DHCW) for anonymised health research
Swansea University Secure Research Environment for statistical and research purposes
Research companies commissioned by Welsh Government (IFF Research, KPMG, PwC, BTP Associates, Mazars, RSM UK)

Education bodies:

Estyn (education inspectors) for inspection planning and thematic reviews
Qualifications Wales for analysis of qualification enrolments and outcomes
Sports Wales (for sports programs)
HE and FE partners (for franchise courses) e.g. University of South Wales, Open University, Skills Academy Wales

How we protect your information: All organisations sign formal agreements requiring them to protect your information and use it only for agreed purposes.

Parents and emergency contacts

Learners aged 16 and over can decide for themselves whether we share information with parents or carers.

We’ll share information with parents/carers when:

You’ve given us permission
There’s an emergency (e.g. medical, safeguarding)
We’re legally required to (rare situations)

You can change your mind about parent/carer contact at any time by telling Learner Services.

Exception: Learners with severe learning difficulties may need additional support with these decisions.

Your privacy rights

Accessing your information

You can request a copy of all information we hold about you.

How to request:

Email data-protection@cymoedd.ac.uk with proof of identity
We’ll confirm your identity and explain what we’ll provide
You’ll receive your information within one month (usually much sooner)

What you’ll receive:

All personal information we hold
Explanation of how we use it
Details of who we share it with
How long we keep it
CCTV footage where you appear (if still retained)
AI-generated notes from any investigations involving you
Investigation records where you’re mentioned
Smoothwall monitoring reports related to your online activity (if applicable)

This service is free unless you make excessive requests.

Correcting information

If information about you is wrong, we’ll fix it quickly.

Simple corrections (like address changes): Contact Learner Services
Complex corrections: Email our Data Protection Officer: data-protection@cymoedd.ac.uk

We’ll tell you when corrections are made and inform anyone we’ve shared incorrect information with.

Other rights and choices

Objecting to processing: You can object to how we use your information if you have a particular reason. We’ll stop unless we have compelling legitimate grounds to continue.

Restricting processing: You can ask us to limit how we use your information while we investigate a complaint or correction request.

Data portability: You can get your information in a portable format to transfer to another organisation (where this applies).

Withdrawal of consent: Where we rely on your consent, you can withdraw it at any time. This doesn’t affect previous processing.

Making a complaint:

First, contact us to try to resolve the issue: data-protection@cymoedd.ac.uk
If unsatisfied, contact the Information Commissioner’s Office (ICO)
You can do this directly or we can help you

Technical information

Website cookies

We use cookies to improve your experience and understand how our website is used.

Essential cookies:

Remember your language preference (English/Welsh)
Keep you logged in to online services
Remember accessibility settings

Analytics cookies (Google Analytics):

Count visitor numbers
See which pages are most popular
Understand how people navigate our site
Help us improve the website

We don’t use analytics cookies to identify individual people.

Social sharing cookies (AddThis):

Enable sharing content on social media
Remember your sharing preferences

Managing cookies:

You can disable cookies in your browser settings
This might affect website functionality
More information: aboutcookies.org

We advertise on social media platforms to reach potential learners.

What we do:

Create audience groups based on website visits
Show relevant course advertisements
Track which advertisements are effective

What information is used:

Your IP address and device information
Pages you visit on our website
General interests (not personal details)

Your choices:

Adjust privacy settings on social media platforms
Use browser settings to limit tracking
Opt out using platform preference centres

We don’t share personal details like names or contact information with social media platforms.

Security measures

How we protect your information:

Technical security:

Encrypted data storage and transmission
Regular security testing and updates
Access controls and authentication
Secure backup systems
CCTV systems with encrypted storage and restricted access
AI systems with data anonymisation and security protocols
Smoothwall monitoring system with secure data storage and restricted access to safeguarding staff

Staff training:

Data protection awareness training
Regular refresher sessions
Clear policies and procedures
Limited access based on job requirements
Specialist training for investigation staff using CCTV and AI systems
Ethical guidelines for AI-assisted processes
Specialist training for safeguarding staff using Smoothwall monitoring reports

Physical security:

Secure office and server locations
Locked filing cabinets for paper records
Clear desk policies
Visitor access controls
CCTV monitoring with appropriate signage
Secure storage for investigation materials

We regularly review and update our security measures to protect against new threats

Data retention

We keep information only as long as necessary.

While you’re studying: We keep all relevant information to support your learning and meet legal requirements.

After you finish: We keep some information for several years:

Academic records: Permanently (for qualification verification)
Financial records: 7 years (for audit purposes)
Support records: 3-7 years depending on type
General learner records: 6 years after you finish
LLWR data for Welsh Government funded programmes: 10 years (in line with Welsh Government requirements)
CCTV footage: 30 days (unless needed for investigation)
Investigation records: 6 years after case closure
AI-generated notes: Same period as underlying investigation
Smoothwall monitoring data: 12 months (unless required for safeguarding investigation)