Cultural Recovery Fund Evaluation

PRIVACY NOTICE ​ What personal data do we hold and where do we get this information? ​ Personal data is defined under the UK General Data Protection Regulation (UK GDPR) as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier’. ​ In order to apply for support from the CRF the Welsh Government needed to collect personal information about you for the purposes of delivering, monitoring and evaluating the programme. ​ All grant recipients will receive a link to a survey either sent directly from the Welsh Government or via an intermediary public body. Completing the survey does not capture your email address or IP address and the survey does not require you to provide any other personal data so the survey results will be anonymous. Wavehill will analyse the results and if you choose to provide any personal information in any open questions Wavehill will remove personal data, or data which may identify you, from the responses you provide. ​ Around half of grant recipients will be asked to take part in a later interview to explore issues in more depth. The sample will be chosen to be as representative of grant recipients as possible. The Welsh Government research team will agree the sampling strategy with Wavehill and then only pass on contact details for the sample that will be interviewed. As a recipeint of a grant from the CRF your contact details have been shared in line with the privacy notice you were provided at the point of application. The interviews do not require the collection of additional personal data from you other than your image if you agree to an interview being video recorded. We may need to record interviews for operational reasons. This may include video and / or audio capture. If this is the case, we will make this clear to you before the interview begins, and you will have the opportunity to tell us if you are not happy for the discussion to be recorded. If interviews are recorded, personal data will be removed during the process of transcribing. Recordings will be deleted as soon as this process is completed. If discussions are not recorded, personal data will not be included in written notes prepared following the interviews. ​ Wavehill will only use email address and telephone number for the purposes of this evaluation. ​ If you raise a query or complaint and provide personal data requesting a response, the researcher will forward the request only to the relevant official and subsequently delete it from the research data. ​ What is the lawful basis for using your data? ​ The lawful basis for processing information in this data collection exercise is our public task; that is, exercising our official authority to undertake the core role and functions of the Welsh Government. ​ Participation is completely voluntary. Research studies such as this are important for the Welsh Government to collect information and actionable evidence about its ability to deliver government priorities. The information collected in this research, for example, might be used to inform the on-going delivery of the fund, and provide a source of robust evidence with which to judge the success of the support. It may also provide evidence which can be used to inform the delivery of any future funds. How secure is your personal data? ​ Personal information provided to Wavehill is always stored on a secure server. The data can only be accessed by a limited number of researchers working on this project. Wavehill will only use this data for research purposes. Wavehill has cyber essentials certification. ​ When conducting surveys, Wavehill use a survey software programme called Qualtrics. We have ensured that Qualtrics is GDPR compliant and meets our expectations in terms of the security of any data collected via the software (e.g. all data is processed within the EEA). ​ Wavehill has procedures to deal with any suspected data security breaches. If a suspected breach occurs, Wavehill will report this to the Welsh Government who will notify you and any applicable regulator where we are legally required to do so. ​ All data gathered through this research will be reported in an anonymised format. It will not contain your contact details and any identifiable information in open-ended answers will be removed. Wavehill will use the information gathered to produce a report that will be published on the Welsh Government website. This report will not include any information that could be used to identify individual participants. ​ How long do we keep your personal data? ​ Wavehill will hold personal data during the contract period, and any personal data will be deleted by Wavehill three months after the end of the contract. This includes your contact details. Wavehill will provide Welsh Government with an anonymised version of the data which will not include information that could identify you. Individual rights ​ Under UK GDPR, you have the following rights in relation to the personal information you provide as part of this [project], you have the right: ​ To access a copy of your own data; For us to rectify inaccuracies in that data; To object to or restrict processing (in certain circumstances); For your data to be ‘erased’ (in certain circumstances); and To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection. ​ The contact details for the Information Commissioner’s Office are: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. Website: www.ico.gov.uk ​ Further Information ​ If you have any further questions about how the data provided as part of this study will be used by the Welsh Government or wish to exercise your rights using the UK General Data Protection Regulation, please contact: ​ Name: Tom Stevenson E-mail address: tom.stevenson2@gov.wales Telephone number: 0300 062 2570 The Welsh Government’s Data Protection Officer can be contacted at: ​ Welsh Government, Cathays Park, Cardiff, CF10 3NQ, Email: DataProtectionOfficer@gov.wales

Cultural Recovery Fund Evaluation

PRIVACY NOTICE ​ What personal data do we hold and where do we get this information? ​ Personal data is defined under the UK General Data...