Data Protection Policy 15.05.2018

Centre for Welsh Studies – Data Protection Policy

This document outlines how the Centre for Welsh Studies Ltd processes and manages personal data. It:

1) Identifies our data controller;

2) Outlines the scope of personal data we hold and process;

3) Outlines the scope of the special category personal data we hold and process;

4) Describes and justifies our data retention policy;

5) Shows how we intend to respond to Subject Access Requests; and

6) Contains a copy of our privacy notice.

  1. Data Controller

The Data Controller is Matthew MacKinnon.

  1. Data we hold

As of 25th May 2018, the office holds information on X number of supporters.

We operate an almost completely paperless office. Personal data is stored electronically and securely on our computer systems.


This information predominantly includes but is not limited to:

▪ Names, addresses and email addresses.

▪ Telephone numbers.

▪ Special category data on political beliefs.

Mailing lists

The Office also maintains a mailing list. These subscribers receive Centre’s monthly newsletter and information about upcoming advice surgeries. Personal data we hold in this regard includes:

▪ Names, addresses and email addresses.

This information is not political in nature and therefore it is not categorised as direct marketing.

Special category data we hold

The office may also hold special category data for a smaller number of data subjects. This data will be processed under the lawful basis indicated in point two, as is permitted in clauses 23 and 24 of schedule 1 of the Data Protection Act. The data may include:

▪ Political opinions

▪ Religious beliefs

▪ Trade union activities

▪ Sexual orientation

Data retention policy

Supporter’s details are often revisited to provide the best service and representation for our supporters, from whom we may continue to receive correspondence. Therefore, we feel it is reasonable for our team to hold personal data for as long as our supporters wish.

Subject Access Requests

We will comply to Subject Access Requests in line with the guidance given by the Information Commissioners Office (ICO).

  1. We will respond as quickly as possible, within 30 calendar days.
  2. We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.

iii. Data subjects have the right to the following:

  1. To be told whether any personal data is being processed
  2. To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
  3. To be given a copy of the information comprising the data, and given details of the source of the data where this is available.

Privacy notice

Our office will undertake to ensure all supporters sharing their personal data can have the opportunity to read our privacy notice. We will:

  1. Publish our privacy notice on our website,
  2. Add a link to our privacy notice to staff email signatures, and to Centre’s email signature.

iii. Direct supporters who contact us via letter and telephone to our privacy notice online.

  1. Modify our voicemail messages to include information about how constituents can read our privacy notice.

Privacy Notice

This privacy notice relates to the personal data processed by Centre for Welsh Studies Ltd, campaigns and policy queries.

Who is the Data Controller?

The Data Controller is Matthew MacKinnon, Director of the Centre for Welsh Studies Ltd.

What does the Office do?

The team runs a digital office from electronic devices. Our office runs various campaigns and research projects on Welsh political issues.

How do we process data?

This office processes supporter’s data under the lawful basis of public task. In instances where this lawful basis is not sufficient and explicit consent is required, a member of the office will contact you to establish your consent. Data Protection Policy v.1.4 – 30th April 2018