How we manage personal data when you communicate and engage with us at the Welsh Revenue Authority (WRA).
This notice informs you when you communicate and engage with us, about:
- how and when we process your personal data
- whom we may share data with
- third-party service providers we use
- the lawful uses to which your data will be put
- your rights according to the General Data Protection Regulation (GDPR)
When we process your personal data
We interact with individuals and people working for other organisations daily. In some cases, we may collect, hold and use your personal information, when you communicate and engage with us.
We obtain personal information directly, such as when you:
- contact us for advice and guidance
- visit our website (and manage your cookie settings)
- register or attend our events
- sign up for email updates
- tell us your communication preferences
- engage with us on social media
- take part in user research or user testing
- give us feedback
- use our third-party service providers
We’ll be the data controller for any personal data you provide when engaging with us or using our contact forms and social media services.
Data we collect from you
To communicate and engage with you, we may collect your personal data, such as your:
- title and full name
- email address
- phone number
- business or employer details
- dietary requirements
- car registration details
- social media identifiers and interaction
- opinions and feedback
- contact language preference
We may also collect other technical information when you use our services, such as web cookies for analytics.
All personal data we hold is subject to:
How we use your data
We’ll only use your personal data and information to:
- to offer services and information
- give advice and guidance to you, as requested
- capture and store your preferred means of communication
- help us improve our services
We’ll also ensure:
- you’re not identified in any analyses or research reports we publish
- information about you is not shared with an external partner, unless:
- lawful reason to do so, and
- the processing is fair and necessary
- information about you is not used or held further where you have applied your right to stop processing or ask us to delete it
How long we’ll keep your data
We’ll keep your personal data for as long as:
- you give us consent
- the law requires us to
- we need to for the purposes listed in this notice
- accepted or needed for website cookies
Sharing your data
As data controller, we may decide to share your data and information with non-government agencies. And researchers for statistical or research purposes.
In every case, disclosures will be approved and controlled by an appropriate data access agreement, which:
- limits the use to the specific need, to not identify you in any published reports
- allows your data to only be stored for the duration of the research project, requiring your data to be destroyed after that period
- demands that the transfer, storage and eventual destruction of your data are carried out securely
We’ll collect and store data and information about you securely.
We’ll only pass your data and information to other parties where it’s lawful to do so and via controls which:
- require an identified purpose
- ensure your data and information are transmitted to those parties securely
GDPR lists certain rights which apply to you when your personal data is stored and used as mentioned above.
These rights relate to the legal basis for processing your data and the uses made of your data. In this case, information about you - collected as a customer or stakeholder of the WRA - that does not directly relate to specific tax queries. For example, your:
- communication preferences
- website use
- information gathered as part of receiving feedback
You have the right to:
- be informed
- access your information
- correct any errors in your information
- have your information removed (except where the data is required by law)
- restrict use of your information
- to be notified of a correction, removal or restriction applied to your information
- to receive your information in a format suitable for transmission to another body
- not be subject to a decision based solely on automated processing, unless you give explicit consent for that
If you have any requests to apply these rights, please contact us.
Interacting with us online
We use and work with different service providers to carry out how we communicate and engage online. Our service providers will sometimes process personal data on our behalf. This include use of website cookies.
About website cookies
Cookies are small text files sent to your computer or mobile device by the websites that you visit. They're used in ways to improve your online experience, such as keeping you signed in or understanding how use a website.
Where we link to other websites, third parties will have their own privacy and cookies information that you can view on their own website.
Our website (GOV.WALES)
When we say ‘our website’, we mean any of our content, such as corporate information or guidance, hosted on GOV.WALES and LLYW.CYMRU.
These online services are managed by Welsh Government.
For more information on how GOV.WALES use your information, see:
This does not apply to our online tax services, hosted separately that still use the ‘GOV.WALES’ web domain. When using our online tax services, refer to the separate privacy notices in the footer, as with our Land Transaction Tax calculator.
Contact forms and surveys
We collect information and feedback using forms created in SmartSurvey, such as our online contact form.
We use the Welsh Government’s email newsletter and alert service through GovDelivery (supplied by Granicus). The online service gives us statistics around email opening rates and interaction. See GDPR on Granicus.
You can change your subscription preferences and details through GovDelivery at any time. This includes deleting your account.
Training and events
Using social media
We use social media to support and engage with a variety of people and organisations.
We have 3 social media accounts:
We use a third-party provider, Hootsuite, to manage our social media interactions.
For your own safety online, never include personal information in a social media post. Your comments are visible to all.
Lawful use of your data
We'll sometimes need to process special categories of personal data, as described in Article 9(1) of GDPR. This may be to provide extra support to you or to store communication preferences which may reveal something about your health. For example, we could be asked to provide information in Braille, even if you've not told us directly yourself. For these cases, we'll rely on consent to hold your data.
For any questions about this notice or your rights, please contact our Data Protection Officer.
Data Protection Officer
Welsh Revenue Authority
PO Box 110
Complaints should also be directed to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues.
Information Commissioner’s Office - Wales
17 Churchill Way
Telephone: 029 2067 8400 / 0303 123 1113
Changes to this privacy notice
Any changes to this privacy notice will be updated on this page; for example, any new uses of personal data.
From time to time, we may also contact you through other means about the processing of your personal data.