Privacy Notice

General information

This Privacy Notice tells you what to expect when the Welsh Language Commissioner (the Commissioner) collects, uses, discloses, transfers, and stores your personal information.
The Welsh Language Commissioner is the Data Controller of the data he collects from you
You are welcome to contact us to speak to the Welsh Language Commissioner's Data Protection Officer.
The Commissioner is committed to protecting the personal information he receives. Whenever the Commissioner receives information, he is legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the General Data Protection Regulations (GDPR UK) and the Data Protection Act 2018 (these laws are referred to collectively in this notice as the “data protection laws”).

How does the Commissioner get information

Most of the personal information the Commissioner processes is provided directly by you for one of the following reasons:

You have made a complaint or enquiry
You have made an information request
You wish to attend, or have attended, an event
You have applied for a job;
You are representing your organisation.

The Commissioner also receives personal information indirectly, in the following scenarios:

From an organisation the Commissioner has contacted about a complaint you have made and your personal information is in its response
A complainant refers to you in their complaint correspondence
Personal information is received in exercising the Commissioner’s statutory duties
From other public authorities, regulators or law enforcement bodies;
An employee gives your contact details as an emergency contact or a reference.

Your Rights under Data Protection Law

You have various rights under Data Protection Law. These rights depend on the reason for processing your information. These may include (as applicable):
Your right of access: you have the right to ask the Commissioner for copies of your personal information. This right always applies. There are some exemptions, which mean you may not always receive all the information he processes.
Your right to rectification: you have the right to ask the Commissioner to rectify information you think is inaccurate. You also have the right to ask to complete information you think is incomplete. This right always applies.
Your right to erasure: you have the right to ask the Commissioner to erase your personal information in certain circumstances.
Your right to restriction of processing: you have the right to ask the Commissioner to restrict the processing of your information in certain circumstances.
Your right to object to processing: you have the right to object to processing if the Commissioner is able to process your information because the process forms part of his public task, or is in his legitimate interests.
Your right to data portability : this only applies to information you have given the Commissioner. You have the right to ask that he transfers the information you have given from one organisation to another, or give it to you. The right only applies if information is being processed based on your consent or under, or in talks about entering into a contract and the processing is automated.
You are not required to pay any charge for exercising your rights. The Commissioner has one month to respond to you. Please contact post@welshlanguagecommissioner.wales if you wish to make a request.

Legal Basis

The legal basis for which the Commissioner will process your information is to allow him to exercise its statutory powers in accordance with the Welsh Language (Wales) Measure 2011.
Your consent can also be a legal reason for processing your personal data. This means your specific, informed and unambiguous consent given freely and can be collected by you, for example, when you agree to receive marketing correspondence from the Commissioner or when you agree to take part in surveys or market research (such as which apply). You have a right under Data Protection Law to withdraw your consent at any given time.

Sharing your information

The Commissioner will not share your personal information with any third parties for the purposes of direct marketing.
In some circumstances the Commissioner is legally obliged to share information, for example under a court order. In all circumstances, the Commissioner will satisfy himself that he has a lawful basis upon which to share the information and document the decision making and the legal basis on which to share the information.

Transfers to countries outside of the UK and the EEU

Your information will not be transferred outside of the UK.

Children’s Information

The Commissioner does not provide services directly to children or proactively collect their personal information. However, information about children is sometimes given while handling a complaint or conducting an investigation, or whilst exercising duties under section 8-10 of the Welsh Language (Wales) Measure 2011. The information in the relevant parts of this notice applies to children as well as adults.

Following a link to another website

When the Commissioner’s website contains links to other websites this privacy notice does not cover how that organisation processes personal information. You should read the privacy notice of any website you visit.

Visitors to the website

Information on how the Commissioner monitors visitor behaviours and uses cookies can be found on this website’s Cookies page.
The Commissioner uses a third-party web application firewall to help maintain the security and performance of his website. This service checks that traffic to the site is behaving as would be expected. The service will block traffic that is not using the site as expected.
The purpose for implementing the above is to maintain and monitor the performance of the website and to constantly look to improve the site and the services it offers users. The lawful basis the Commissioner relies on to process your personal data is either Article 6(1)(a) of the UK GDPR, for example when he requires your consent for the optional cookies used, or Article 6(1)(f) which allows him to process personal data when it’s necessary for his legitimate interests, for example in order to maintain the integrity of his IT systems and the continuity of his business.
As the Commissioner is processing your personal data for legitimate interests as stated above, you have the right to object to the processing of your personal data. There are legitimate reasons why he may refuse your objection, which depend on why he is processing it.

Your right to Complain

The Commissioner works to high standards when it comes to processing your personal information. If you have queries or concerns, please contact him using the above address and he’ll respond.
If you remain dissatisfied, you can make a complaint about the way the Commissioner has processed your personal information to the Information Commissioner.

Changes to this privacy policy

The Commissioner keeps this privacy notice under regular review to make sure it is up to date and accurate.

Reasons for contacting the Commissioner

Making a complaint about another organisation

The purpose is to investigate and take regulatory action in line with the Commissioner’s statutory duties. The lawful basis the Commissioner will rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows him to process personal data when this is necessary to perform his public tasks as a regulator.
If the information you provide in relation to your complaint contains special category data, such as health, religious or ethnic information the lawful basis the Commissioner will rely on to process it is article 9(2)(g) of the UK GDPR, which is also relates to his public task and the safeguarding of your fundamental rights, and Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.
The Commissioner needs information from you to investigate your complaint properly.
When he receives a complaint from you, an electronic file will be opened. This normally includes your contact details and any other information you have given about the other parties in your complaint.
The Commissioner needs to know the details of your complaint so he can investigate it and fulfil his regulatory function.
The Commissioner will use your personal information to investigate your complaint. The Commissioner complies and publishes statistics showing information like the number of complaints received in his annual report, but not in a form that identifies anyone.
No third parties have access to your personal information unless the law allows them to do so. However, if you have made a complaint about an organisation, the Commissioner usually discloses your identity to them. This is so he can clearly explain to them what you think has gone wrong. This also means the Commissioner may receive information about you from them.
If you don’t want your personal information to be shared with the organisation you want to complain about, the Commissioner will try to respect this, however this may affect his ability to carry out those functions.
If you are acting on behalf of someone making a complaint, the Commissioner may ask for information to satisfy him of your identity and if relevant, ask for information to show you have the authority to act on someone else’s behalf.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner is acting in his official capacity to investigate your complaint, so you have the right to object to his processing of your personal data. There are legitimate reasons why he may refuse your objection, which depend on why he is processing it.
The Commissioner does not use any data processors.

Making a complaint about the Commissioner

The purpose is to investigate and take action in line with the Commissioner’s statutory duties. The lawful basis the Commissioner will rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows him to process personal data when this is necessary to perform his public tasks.
If the information you provide in relation to your complaint contains special category data, such as health, religious or ethnic information the lawful basis the Commissioner will rely on to process it is article 9(2)(g) of the UK GDPR, which is also relates to his public task and the safeguarding of your fundamental rights, and Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.
The Commissioner needs information from you to investigate your complaint properly.
When he receives a complaint from you, an electronic file will be opened. This normally includes your contact details and any other information you have given about your complaint.
The Commissioner will use your personal information to investigate your complaint. The Commissioner complies and publishes statistics showing information like the number of complaints received in his annual report, but not in a form that identifies anyone.
No third parties have access to your personal information unless the law allows them to do so. However, sometimes the Commissioner may need to give your information to another individual for example, an independent consultant. Where information is disclosed, it will be done in line with the requirements of the Measure or in the interests of natural justice.
If you are acting on behalf of someone making a complaint, the Commissioner may ask for information to satisfy him of your identity and if relevant, ask for information to show you have the authority to act on someone else’s behalf.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner is acting in his official capacity to investigate your complaint, so you have the right to object to his processing of your personal data. There are legitimate reasons why he may refuse your objection, which depend on why he is processing it.
The Commissioner does not use any data processors.

Making an enquiry

When you contact the Commissioner with an enquiry, information including your personal data will be collected in order to respond to it and fulfil his statutory duties.
The lawful basis the Commissioner will rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows him to process personal data when this is necessary to perform his public tasks as a regulator.
If the information you provide in relation to your enquiry contains special category data, such as health, religious or ethnic information the lawful basis the Commissioner will rely on to process it is article 9(2)(g) of the UK GDPR, which is also relates to his public task and the safeguarding of your fundamental rights, and Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.
The Commissioner needs enough information from you to answer your enquiry. If you call the Commissioner, no audio recording of it will be made but personal information may be taken in order to provide you with a further service as required.
If you contact the Commissioner via email or post, a return address for a response will be needed.
The Commissioner will keep a copy of your enquiry and also a record of his response. The Commissioner uses the information supplied to him to deal with the enquiry and any subsequent issues that may arise.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner is acting in his official capacity to respond to your enquiry, so you have the right to object to his processing of your personal data. There are legitimate reasons why he may refuse your objection, which depend on why he is processing it.
The Commissioner does not use any data processors.

Applying for a job

The Commissioner’s purpose for processing this information is to assess your suitability for a role you have applied for.
The lawful basis the Commissioner relies on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.
If you provide the Commissioner with any information about reasonable adjustments, you require under the Equality Act 2010 the lawful basis he relies on for processing this information is article 6(1)(c) to comply with his legal obligations under the Act.
The lawful basis the Commissioner relies on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the UK GDPR, which relates to his obligations in employment and the safeguarding of your fundamental rights. And Schedule 1 part 1(1) of the DPA 2018 which again relates to processing for employment purposes.
The Commissioner processes information about applicant criminal convictions and offences. The lawful basis he relies on to process this data are Article 6(1)(e) for the performance of his public task. In addition, he relies on the processing condition at Schedule 1 part 2 paragraph 6(2)(a).
The Commissioner uses all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract, or to fulfil legal or regulatory requirements if necessary.
The Commissioner will not share any of the information you provide with any third parties for marketing purposes.
The Commissioner will use the contact details you give to contact you to progress your application. The other information you provide will be used to assess your suitability for the role.
The Commissioner does not collect more information than he needs to fulfil his stated purposes and will not keep it longer than necessary.
The information he asks for is used to assess your suitability for employment. You don’t have to provide what he asks for but it may affect your application if you don’t.
You will also be asked to provide equal opportunities information. This is not mandatory – if you don’t provide it, it won’t affect your application. The Commissioner won’t make the information available in a way that can identify you. Any information you provide will be used to produce and monitor equal opportunities statistics.
If a third party candidate management specialist is involved in the selection process then your personal information will be shared with them.
The Commissioner may ask you to complete tests and attend an interview. Information will be generated by you and by the Commissioner, for example, you might complete a written test or he might take interview notes. This information is held by the Commissioner.
If you are unsuccessful after assessment for the role, he may ask if you would like your details retained in a talent pool. If you say yes, you would be proactively contacted should any further suitable vacancies arise. The Commissioner keeps personal information about unsuccessful applicants for six months after the recruitment process has ended; thereafter the information is destroyed or deleted.
If the Commissioner makes a conditional offer of employment, he’ll ask you for information so that he can carry our pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. The Commissioner must confirm the identity of his staff and their right to work in the United Kingdom, and seek assurance as to their trustworthiness, integrity, and reliability.

You must therefore provide:

Proof of your identity with original documents; copies will be taken
Proof of your qualifications with original documents; copies will be taken,
A criminal records declaration to declare any unspent convictions.
Referees will be contacted directly, using the details you provide in your application.
The Commissioner will also ask you about any reasonable adjustments you may require under the Equality Act 2010. This information will be shared with relevant staff to ensure these are in place for when you start your employment.
If a final offer is made, the following information will be requested:
Bank details – to process salary payments
Emergency contact details – so the Commissioner knows who to contact in case you have an emergency at work,
Any membership of a pension scheme.
Our Code of Conduct requires all staff to declare of they have any potential conflicts of interest. The information will be held on your personnel file. You will also need to declare any secondary employment.
As an individual, you have certain rights regarding your own personal data.

Current and former officers

Officers should refer to the officers’ privacy notice. Following the end of your employment with the Commissioner, he will retain your information in accordance with the requirements of the retention and disposal policy and then delete it.

Institute or intervene in legal proceedings or provide legal assistance to an individual

The purpose is to institute or intervene in legal proceedings, or to provide legal assistance with the Commissioner’s statutory duties. The legal basis on which the Commissioner relies to process your personal data is article 6(1)(e) of the UK GDPR, which allows him to process personal data when necessary to perform his public task as a regulator.
If the information you provide contains special category data, such as health, religious or ethnic information, the lawful basis the Commissioner relies on to process it is article 9(2)(g) of the UK GDPR, which also relates to his public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.
In the event that it becomes necessary to use your data relating to any criminal convictions the Commissioner will do this, in relation to your legal application under his statutory functions and in accordance with Article 10 of the UK GDPR and the DPA 2018 Schedule 1 part 3(33).
The Commissioner needs information from you to consider initiating or intervening in legal proceedings, or to provide you with legal assistance.
No third party has access to your personal information unless permitted to do so by law. However, sometimes it may be necessary to pass on your information to someone else, for example the Commissioner’s solicitors. When your information is disclosed, it will be done in accordance with the requirements of the Measure or in the interests of natural justice.
The Commissioner has a policy on the retention and disposal of information which specifies how long personal information is kept.
The Commissioner is acting in his official capacity when considering initiating or intervening in legal proceedings, or providing legal assistance, so you have the right to object to his processing of your personal data. There are legitimate reasons why he may refuse your objection, which depend on why he is processing it.

Attending an event

The Commissioner collects information to facilitate the event and provide you with an acceptable service. He also needs this information to respond to you.
The lawful basis he relies on for processing your personal data is your consent under article 6(1)(a) of the UK GDPR. When he collects any information about dietary or access requirements he also needs your consent (under article 9(2)(a)) as this type of information is classed as special category data.
If you wish to attend one of the Commissioner’s events, you will be asked to provide your contact information including your organisation’s name and, if offered a place, information about any dietary requirements or access provisions you may need.
If you are not successful in securing a place, the Commissioner will let you know and hold your details on a reserve list in case a place becomes available.
If you are allocated a place at an event, he’ll ask for information about any dietary/access requirements. This information will not be shared in any identifiable way with the venue and will be deleted after the event.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner relies on your consent to process the personal data you give him to facilitate the event. This means you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent please email or call the Commissioner. If you do that, the records will be updated immediately to reflect your wishes.
From time to time the Commissioner uses data processors to help facilitate the events.

Register for a webinar or live broadcast event

The Commissioner collects this information to facilitate the video conference, webinar or live broadcast event and provide wider access to its content.
The lawful basis he relies on for processing your personal data is Article 6(1)(e) – public task.
If you are an attendee or presenter at one of these events, he will need an email address from you.
Some events are recorded and all presenters will have their image and audio captured in the recording. If you are an attendee, you may have the option of sharing your image and audio or not during this session. If you choose to do so, this will also be captured in the recording.
Some events will feature a moderated Q&A. If you choose to take part in the Q&A, your comments may be published to others at the event and will also form part of the recording.
If an event is being recorded, you will always be notified in advance.
The Commissioner will use your email address to provide you with the event details. This will include information about any recording taking place. For recorded events he will also email you a link to the recording once the event has concluded.
For some events the recording may be published on our website or YouTube channel so this is accessible to a wider audience. If an event recording will be published you will always be notified before the event.
The Commissioner will not publish delegate lists but your name and email address may be visible to others in attendance during the event.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner uses Zoom to deliver webinars and live broadcast events.
The Commissioner uses YouTube to publish the recordings of some events.

Request for Information

The Commissioner’s purpose for processing your personal data is so he can fulfil your information request to him.
The awful basis for this is article(1)(c) of the UK GDPR, which relates to processing necessary to comply with a legal obligation to which the Commissioner is subject to.
If any of the information you provide in relation to information request contains special category data, such as health, religious or ethnic information, the lawful basis he relies on to process it is article 9(2)(g) of the UK GDPR, which also relates to his public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.
The Commissioner needs information from you to respond to you and to locate the information you are looking for. This enables him to comply with his legal obligations under the legislation he is subject to:
- UK General Data Protection Regulations
- Data Protection Act (2018)
- Freedom of Information Act (2000)
- Environmental Information Regulations (2004)
- Re-use of Public Sector Information Regulations
When he receives a request from you, an electronic file containing the details of your request will be opened. This normally includes your contact details and any other information you have given the Commissioner. A copy of the information that falls within the scope of your request will also be kept in the file.
If you are making a request about your personal data, or are acting on behalf of someone making such a request, the Commissioner may ask for information to satisfy him of your identity and if relevant, ask for information to show you have the authority to act on someone else’s behalf.
If the request is about information the Commissioner has received from another organisation – regarding a complaint, for example – he will routinely consult the organisation/s concerned to seek their view on disclosure of the material.
Before contacting the Commissioner you should appreciate that the Commissioner is required under section 22 of the Welsh Language (Wales) Measure 2011 to treat as confidential any information obtained in connection with his functions. Any such information you supply will not be shared with anyone else unless this is authorised by section 22. You should however appreciate that in exceptional circumstances it may be necessary for the Commissioner to disclose this information to others although if this is necessary for any purpose you would usually be told about this first.
Section 22 does not in any way affect the Commissioner’s duties under Data Protection law nor the law of confidentiality. For more information on section 22, please contact the Commissioner.
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner does not use any data processors.

List of Standardised Welsh Place-names

The Commissioner’s purpose for processing your personal data is so he can fulfil his responsibility to offer advice on the standard forms of Welsh place-names.
The awful basis he relies on to process your personal data is article(1)(e) - public task.
The Commissioner follows specific guidelines in formulating its recommendations and also gives due consideration to evidence regarding current and historical usage as well as public opinion on the names. Personal details can form an integral part of this documentary evidence and the Commissioner may sometimes wish to record the views of individuals and evidence submitted by them regarding various forms to aid the formulating of recommendations.
That evidence will be kept until the end of the project unless a specific request is made from and individuals for it to be made anonymous or deleted.

Recording your opinion of dealing with the Commissioner in order to use the same in an awareness raising campaign.

The Commissioner collects your personal data in order to:
- contact you to receive your opinion about the Commissioner’s actions; and/or
- contact to ask if you would be willing for us to use your opinion as part of campaigns to raise awareness about the Commissioner; and/or
- record your experience of dealing with the Commissioner.
The lawful basis he relies on for processing your personal data is your consent under article 6(1)(a) of the GDPR.
If the Commissioner collects special category data from you as part of the above, your consent will be required for this (under article 9(2)(a).
The Commissioner has a retention schedule which details how long personal data is held.
The Commissioner relies on your consent to process the personal data you give him to be able to get in touch with you to receive your opinion about the Commissioner’s actions and in order to record the same. This means you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent, please email or call the Commissioner. If you do that, the records will be updated immediately to reflect your wishes.

Communicating with the Commissioner as a business

The Commissioner holds the names and contact details of individuals acting in their capacity as representatives of their organisations. If this related to the Commissioner’s regulatory functions, the lawful basis is article 6(1)(e) of the UK GDPR. If the interactions relate to suppliers, contracts, buildings management, IT services etc, the legal basis is article 6(1)(c) of the UK GDPR for any legal obligation or article 6(1)(f) because the processing is within the Commissioner’s legitimate interests as a public authority.
As a contracting authority, the Commissioner uses the Sell2Wales website. Sell2Wales’ privacy notice can be seen on their website.

This privacy notice was updated on 16/09/2022.