Review of Tertiary Provision in Cardiff and the Vale of Glamorgan Privacy Notice

Key points:

·         Taking part in this research is your choice

·         You can skip any question

·         You can stop at any time

·         Nothing you say will be shared in a way that identifies you

1. Who we are

Wavehill is an independent research company carrying out a ‘Review of Tertiary Provision in Cardiff and the Vale of Glamorgan’. The review has been commissioned jointly by Cardiff Council, the Vale of Glamorgan Council, Cardiff and Vale College and St David's Catholic College, and runs from May to August 2026.

Wavehill is the data controller for the research activities it undertakes. Our registered address is 21 Alban Square, Aberaeron, Ceredigion SA46 0DB, and we are registered with the Information Commissioner's Office. The commissioning organisations act as separate data controllers for the data they provide under their statutory functions.

In practice, this means that Wavehill is responsible for any information you provide directly as part of the research, while schools, colleges and councils remain responsible for the information they already hold about you and share with us.

2. What this notice covers

This notice explains how we collect, use, store and protect personal information from everyone who takes part in the research. That includes:

●     pre-16 learners (Year 10 and Year 11) and their parents or carers

●     post-16 learners in school sixth forms, Cardiff and Vale College and St David's Catholic College, and learners on adult and community learning, ESOL and apprenticeship pathways

●     school, college and provider staff

●     employers, council officers and wider stakeholders

The research uses online surveys, online and in-person focus groups, semi-structured interviews, and analysis of pupil, course and destinations data shared by schools, colleges and the local authorities.

3. What information we collect

The information we collect depends on how you take part.

Most of the research is anonymous. We only collect information that could identify you in specific situations (for example interviews or prize draws), and we keep this separate from your responses wherever possible.

Online surveys.

Surveys are anonymous. We ask for views and experiences, and for a small number of background details (for example year group, type of provision, broad area of residence) so we can understand patterns across different groups of learners. We do not ask for your name, address, date of birth or contact details as part of the survey itself.

Names and contact details for prize draws and incentives.

Where a survey or other element of the research offers a prize draw or another incentive for taking part, we will ask for a name and contact details so we can administer it. These details are collected separately from the research responses, through a separate form or page, so that your answers cannot be linked back to you as an individual. Contact details collected in this way are used only to administer the prize draw or incentive and are deleted once it has been completed.

Focus groups and interviews.

We collect your name, the organisation or school you are associated with and your role. We make an audio recording of the discussion so we can transcribe it accurately. Recordings are deleted once the transcript has been checked.

Pupil, course and destinations data from schools and colleges.

We work with schools, colleges, the local authorities, Estyn and Medr to access pupil-level data on enrolments, retention, attainment, destinations and progression. Where this data is shared with Wavehill, it is shared in pseudonymised form (with direct identifiers removed) wherever possible. Where identifiable data is shared, it is used solely to construct the analysis and is not reported in any form that could identify an individual learner.

Consent records. For focus groups and interviews we keep a record of the consent given by each participant (and, for under-16s, by a parent or carer).

Taking part in this research is also entirely voluntary.

4. Why we collect it, and our legal basis

We collect personal information to undertake the research the four commissioning organisations have asked us to carry out, and to make sure the findings reflect the experience of learners, parents, providers and employers across Cardiff and the Vale of Glamorgan.

Our legal basis under UK GDPR is:

●     Legitimate interests (Article 6(1)(f)) for research participation by adults: it is in the public interest to understand how post-16 provision is working, and the research cannot be done without hearing from the people it affects. This means we are carrying out this research because it is in the public interest and helps improve education services.

●     Consent (Article 6(1)(a)) for the participation of children and young people aged under 16 in focus groups and interviews, and for entry into any prize draw or incentive scheme. Parental or carer consent is sought alongside the young person's own consent.

●     Public task (Article 6(1)(e)) for data shared by the local authorities and the colleges, where they are processing it in the exercise of their official functions. Schools, colleges and councils share some data with us because they are required to do so as part of their official role.

Where we process pseudonymised or identifiable data provided by partner organisations, we rely on legitimate interests for research purposes, supported by data sharing agreements.

For any special category data (for example information about disability, additional learning needs or ethnicity that participants choose to share), we rely on Article 9(2)(j), processing for research purposes in the public interest, with appropriate safeguards.

5. Information about children and young people

Some of our participants could be aged under 16. Where this is the case:

●     questionnaires are distributed via the school in question

●     questionnaires and other research tools are approved by the school ahead of their use

●     focus groups and interviews are arranged through the school or college, and the school or college informs parents and carers in advance

●     written consent is sought from a parent or carer, and the young person's own informed assent is recorded at the start of the session

●     young people can choose not to answer any question and can withdraw at any point without giving a reason

●     nothing a young person says is shared with their school, college or family in a way that identifies them

6. How we use the information

We use the information to:

●     analyse patterns and themes across the research

●     write a report and supporting materials for the four commissioning organisations

●     inform recommendations on the future of post-16 provision in Cardiff and the Vale

Survey responses are reported in aggregate. Quotations from focus groups and interviews are used without attribution unless we have explicitly agreed otherwise with the participant in advance. We do not share any individual-level responses with school, college, employer or family.

7. Who we share it with

We share research outputs (the report, summary and underpinning analysis) with the four commissioning organisations: Cardiff Council, the Vale of Glamorgan Council, Cardiff and Vale College and St David's Catholic College. These outputs do not contain identifying information about individual learners or parents.

We do not sell personal information, and we do not share it with any other organisation, except where we are required to do so by law (for example, where a safeguarding concern arises that we have a duty to report).

We use a small number of secure third-party tools to deliver the research, including an online survey platform and a transcription service. These suppliers are bound by data protection contracts and process information only on our instructions.

8. How we store and protect it

Personal information is held on secure systems hosted in the UK or the European Economic Area. Access is restricted to members of the Wavehill research team working on this project. Audio recordings and consent forms are stored separately from analysis files. Contact details given for prize draws or incentives are held separately from survey responses. All transfers of pupil or course data from schools, colleges and local authorities use secure channels agreed with each organisation.

9. How long we keep it

We keep personal information only for as long as we need it for the research:

●     audio recordings are deleted once the transcript has been checked, and in any case within three months of the discussion

●     consent forms and contact details are kept until the research closes and then deleted

●     names and contact details collected for prize draws or incentives are deleted once the draw or payment has been completed

●     anonymised transcripts and survey data are kept for up to two years after the research closes, in line with Wavehill's research records policy, and then deleted

All pupil- and course-level data shared by schools, colleges, and local authorities will be held solely for the purposes of this research, retained only for the minimum period necessary, and securely deleted upon completion of the study, in accordance with the specific data-sharing agreements established with each organisation.

10. Your rights

Under UK GDPR you have the right to:

●     ask what personal information we hold about you

●     ask us to correct anything that is wrong

●     ask us to delete your information

●     object to how we are using it

●     withdraw your participation

For surveys, focus groups and interviews, you can withdraw your contribution at any point up to two weeks after you took part, by emailing wavehill@wavehill.com and quoting the date of the session or survey. After that point your contribution will already have been incorporated into the analysis and we will not be able to remove it.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

11. Welsh language

You can take part in the research, ask questions about it, and request a copy of this notice in Welsh or in English. Welsh-language requests are answered to the same standard and timescale as English-language requests.

12. Contact us

If you have any questions about the research or this privacy notice, please contact:

Endaf Griffiths, Project Manager, Wavehill — endaf.griffiths@wavehill.com

General enquiries — wavehill@wavehill.com 

If you would prefer to raise a question with the commissioning client, please contact:

Abbie Marks, Programme Officer, School Organisation Programme, Education and Lifelong Learning, Cardiff Council — Abigail.Marks@cardiff.gov.uk

This notice was last updated on 21 May 2026.

Int. Ref. 953-26