Digital Review of Cultural Organisations – Surveys Privacy Notice

The Welsh Government has commissioned Wavehill to undertake a digital review of cultural organisations. This aim of this review is to understand the digital activity, skills, and capacity across cultural organisations.

As part of this review the Wavehill will be gathering information through surveys. The first will collect information about Digital Operations and the second about Audience Engagement. You may be asked to only complete one of these based upon your role in your organisation.

The Welsh Government is the data controller for the research. However, Wavehill will delete any personal data provided through the survey.

The information collected during the project will be included in a report published on the Welsh Government website and possibly in other publications by Wavehill and Welsh Government.

Wavehill is also undertaking a separate project on the cultural sector workforce in Wales for Welsh Government. Where relevant, anonymised information from this survey may be shared with that project to inform its insights or analysis. No information that could identify you will be shared. If you do not want anonymised information from the survey to be shared in this way, you can opt out by selecting the opt-out option at the start of the survey.

Your Participation in this research is completely voluntary. However, your views and experiences are important in order to help inform Welsh Government policies.

The contact for this research at Wavehill is Michael Pang

E-mail address: surveys@wavehill.com

Telephone number: 0330 1228658

 PRIVACY NOTICE

What personal data do we hold and where do we get this information?

Personal data is defined under the UK General Data Protection Regulation (UK GDPR) as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier’.

Your organisation has been identified by Wavehill and the Welsh Government as being able to provide valuable insight into the sector landscape. Your contact details may have been identified through the Welsh Government, sector bodies, someone in your organisation, or publicly accessible online. information. This research does not require the collection of additional personal data from you. This survey is primarily focused on organisations. However, limited personal data may be collected incidentally, where required to contextualise organisational responses, for example:

• the name of your organisation;

• your professional role (where relevant to interpreting responses).

Your participation is voluntary and if you do not wish to take part or be sent reminders then please reply to the invitation email and your details will be removed. The Wavehill will only use email address and telephone number for the purposes of this review.

If you choose to provide additional personal data as part of the research we will try not to identify you from, or link your identity to, the responses you provide.

If you raise a query or complaint and provide personal data requesting a response, the researcher will forward the request only to the relevant official and subsequently delete it from the research data.

What is the lawful basis for using your data?

The lawful basis for processing information in this data collection exercise is our public task; that is, exercising our official authority to undertake the core role and functions of the Welsh Government.

Participation is completely voluntary. Research studies such as this are important for the Welsh Government to collect information and actionable evidence about its ability to deliver government priorities. The information collected in this research, for example, might be used to:

• to build an evidence base on digital audience engagement activity, reach, accessibility, skills, and challenges across the cultural sector

• establish a baseline understanding of digital operational capacity across the culture sector

• identify patterns, variation, and common challenges across organisation types and geographies

• inform Welsh Government policy, strategy, and future investment decisions.

How secure is your personal data?

Personal information provided to Wavehill is always stored on a secure server. The data can only be accessed by a limited number of researchers working on this project. Wavehill will only use this data for research purposes. Wavehill has cyber essentials certification.

When conducting surveys, Wavehill use a survey software programme called SurveySparrow. We have ensured that SurveySparrow is UK GDPR compliant and meets our expectations in terms of the security of any data collected via the software.

Wavehill may use secure third-party tools, including artificial intelligence tools (such as those within our Microsoft 365 environment, e.g. Microsoft Copilot), to support the coding and analysis of anonymised data only. These tools operate within approved, secure environments with appropriate technical and organisational measures in place to protect data. Any such use will be in accordance with Wavehill’s Artificial Intelligence Policy and its data protection and information security procedures. Project data will not be used to train or improve AI models. AI is used to complement, not replace, researcher judgement, and all outputs are reviewed and verified by the research team.

Wavehill has procedures to deal with any suspected data security breaches. If a suspected breach occurs, Wavehill will report this to the Welsh Government who will notify you and any applicable regulator where we are legally required to do so.

Wavehill will use the information gathered to produce a report that will be published on the Welsh Government website. This report will not include any information that could be used to identify individual participants.

How long do we keep your personal data?

Wavehill will hold personal data during the contract period, and any personal data not already removed will be deleted by Wavehill within six months of the end of the contract. This includes your contact details. 

Individual rights

Under UK GDPR, you have the following rights in relation to the personal information you provide as part of this review specifically you have the right:

• To access a copy of your own data;

• For us to rectify inaccuracies in that data;

• To object to or restrict processing (in certain circumstances);

• For your data to be ‘erased’ (in certain circumstances); and

• To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.

The contact details for the Information Commissioner’s Office are: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 0303 123 1113. Website: www.ico.org.uk

Further Information

If you have any further questions about how the data provided as part of this study will be used by the Welsh Government or wish to exercise your rights using the UK General Data Protection Regulation, please contact:

Name: Catrin Hughes

E-mail address: Catrin.hughes@gov.wales

Telephone number: 03000625758

The Welsh Government’s Data Protection Officer can be contacted at:

Welsh Government, Cathays Park, Cardiff, CF10 3NQ, Email: DataProtectionOfficer@gov.wales.

Int. Ref. 920-25