WJEC_Consortium_Web-banner_eng png

Privacy Notice

For https://hclw.wales

City & Guilds and WJEC take data protection seriously, and are committed to being upfront about our approach to privacy.  This privacy notice sets out how we will treat the personal data which you provide to us in compliance with applicable data protection law, in particular the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Who are we?

The City and Guilds of London Institute (“City & Guilds”) and WJEC CBAC Limited (“WJEC”) are each an independent ‘data controller’ of the personal data you provide to us in connection with the provision of vocational qualifications in Wales via City & Guilds Approved Centres.

City & Guilds is a charity incorporated by Royal Charter, with registered charity number 312832 (England and Wales) and SC039576 (Scotland). City & Guilds’ registered address is 5-6 Giltspur Street, London EC1A 9DE. If you have any queries about this Policy, the way in which City & Guilds processes personal data, or about exercising any of your rights, please send an email to gdpr@cityandguilds.com or write to Data Protection, City & Guilds, 5-6 Giltspur Street, London EC1A 9DE.

WJEC is a company incorporated in England and Wales under registered company number 3150875.  WJEC’s registered office is located at 245 Western Avenue, Cardiff, CF5 2YX.  The Data Protection Officer for WJEC is Ian Morgan, Director of IT.  You may contact him by sending an email to gdpr@wjec.co.uk.

What personal data do we collect?

If you make an enquiry about, or sign-up to receive, our products and services, then we will collect your name, e-mail address, and job role.  You may also choose to provide us with your telephone number.  We do not collect any sensitive personal data about you.

What purposes do we use your personal data for?

Contractual purposes

If you have registered to receive our products and services, we may use your personal data to:

  • provide the contracted products and services to you;
  • communicate with you in relation to the provision of the contracted products and services;
  • send you newsletters, surveys, events, offers, promotions, related to the products and services and other products and services which may be of interest to you; and
  • communicate with you for administrative purposes such as account creation, security, and support.

Legitimate interests

We may process your personal data for purposes which are within our legitimate interests, including:

  • sending you newsletters, surveys, events, offers, promotions, related our products and services which may be of interest to you;
  • improving the quality of experience when you interact with our products and services, including the testing of different page designs to see which performs better;
  • performing data analytics, determining the effectiveness of promotional campaigns.

You may have the right to object to this processing if you wish, as further detailed below under the heading Your Rights.

Marketing communications

Where you have given your express consent to receive marketing communications, we may use your personal data to:

  • send you newsletters, surveys, events, offers, promotions, related our products and services which may be of interest to you;
  • developing, improving, and delivering marketing and advertising for the products and services.

Legal purposes

We may also process your personal data if required by law, including responding to requests by government or law enforcement authorities, or for the prevention of crime or fraud.

How long will we retain your personal data?

We will retain your personal data for the duration of the contract and for a period of 6 years following its termination or expiry to ensure we are able to comply with any legal requirements, audit requirements, regulatory requests or orders from competent courts.

You may unsubscribe from marketing communications at any time by clicking on the link provided in the relevant email.

Who do we share your personal data with?

We may share your personal data with trusted third parties including:

  • our legal subsidiaries and/ or associated companies;
  • legal or other professional advisers, consultants, and experts;
  • service providers contracted to us in connection with provision of the products and services such as providers of IT services and customer relationship management services; and
  • analytics and search engine providers that assist us in the improvement and optimisation of our website.

We will ensure there is a contract in place which each of these data recipients which ensure the confidentiality, security, and lawful processing of all personal data shared with them.

Where we share personal data with subsidiaries / associated that are located outside of the European Economic Area, we will ensure that the transfer of personal data will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission.

What are your rights?

You have various rights with respect to our use of your personal data:

Access: You have the right to request a copy of the personal data that we hold about you. Please note that there are exceptions to this right, so that access may be denied if, for example, making the information available to you would reveal personal data about another person, or if we are legally prevented from disclosing such information. You are entitled to see the personal data held about you. If you wish to do this, please contact us using the contact details provided below.

Accuracy: We aim to keep your personal data accurate, current, and complete. We encourage you to contact us using the contact details provided below to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up-to-date.

Objecting: In certain circumstances, you also have the right to object to processing of your personal data and to ask us to block, erase and restrict your personal data. If you would like us to stop using your personal data, please contact us using the contact details provided below.

Porting: In certain circumstances, you have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format.  If you would like to request that your personal data is ported to you, please contact us using the contact details provided below.

Erasure: You have the right to erase your personal data when the personal data are no longer necessary for the purposes for which they were collected, or when, among other cases, your personal data have been unlawfully processed.  If you would like to request that your personal data is erased, please contact us using the contact details provided below.

Complaints: If you believe that your data protection rights may have been breached, you have the right to lodge a complaint the applicable supervisory authority or to seek a remedy through the courts. Please visit https://ico.org.uk/concerns/ for more information on how to report a concern to the UK Information Commissioner’s Office.

Please note that there are exceptions to these rights, if, for example, we are under a legal obligation to continue to process your personal data.

Changes to our Privacy Policy

Any changes we may make to our Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail.  Please check back frequently to see any updates or changes to our Policy.


- Privacy Policy Version 1, 25 May 2018