Privacy notice for communicating and engaging with us

We interact with individuals and people working for other organisations daily. In some cases, we may collect, hold and use your personal information, when you communicate and engage with us.

We obtain personal information directly, such as when you:

• contact us for advice and guidance
• visit our website (and manage your cookie settings)
• register or attend our events
• sign up for email updates
• tell us your communication preferences
• engage with us on social media
• take part in user research or user testing
• give us feedback
• use our third-party service providers

We’ll be the data controller for any personal data you provide when engaging with us or using our contact forms and social media services.

To communicate and engage with you, we may collect your personal data, such as your:

• title and full name
• address
• email address
• phone number
• business or employer details
• dietary requirements
• car registration details
• social media identifiers and interaction
• opinions and feedback
• contact language preference

We may also collect other technical information when you use our services, such as web cookies for analytics.

All personal data we hold is subject to:

• UK GDPR
• Data Protection Act 2018
• any other applicable domestic and EU law

We’ll only use your personal data and information to:

• offer services and information
• give advice and guidance to you, as requested
• capture and store your preferred means of communication
• help us improve our services

We’ll also ensure:

• you’re not identified in any analyses or research reports we publish
• information about you is not shared with an external partner, unless:
  • lawful reason to do so, and
  • the processing is fair and necessary
• information about you is not used or held further where you have applied your right to stop processing or ask us to delete it

We’ll keep your personal data for as long as:

• you give us consent
• the law requires us to
• we need to for the purposes listed in this notice
• accepted or needed for website cookies

As data controller, we may decide to share your data and information with non-government agencies. And researchers for statistical or research purposes.

In every case, disclosures will be approved and controlled by an appropriate data access agreement, which:

• limits the use to the specific need, to not identify you in any published reports
• allows your data to only be stored for the duration of the research project, requiring your data to be destroyed after that period
• demands that the transfer, storage and eventual destruction of your data are carried out securely

We’ll collect and store data and information about you securely.

We’ll only pass your data and information to other parties where it’s lawful to do so and via controls which:

• require an identified purpose
• ensure your data and information are transmitted to those parties securely

UK GDPR lists certain rights which apply to you when your personal data is stored and used as mentioned above.

These rights relate to the legal basis for processing your data and the uses made of your data. In this case, information about you - collected as a customer or stakeholder of the WRA - that does not directly relate to specific tax queries. For example, your:

• communication preferences
• website use
• information gathered as part of receiving feedback

You have the right to:

• be informed
• access your information
• correct any errors in your information
• have your information removed (except where the data is required by law)
• restrict use of your information
• to be notified of a correction, removal or restriction applied to your information
• to receive your information in a format suitable for transmission to another body
• not be subject to a decision based solely on automated processing, unless you give explicit consent for that

If you have any requests to apply these rights, please contact us.

We use and work with different service providers to carry out how we communicate and engage online. Our service providers will sometimes process personal data on our behalf. This include use of website cookies.

About website cookies

Cookies are small text files sent to your computer or mobile device by the websites that you visit. They're used in ways to improve your online experience, such as keeping you signed in or understanding how use a website.

Where we link to other websites, third parties will have their own privacy and cookies information that you can view on their own website.

Our website (GOV.WALES)

When we say ‘our website’, we mean any of our content, such as corporate information or guidance, hosted on GOV.WALES and LLYW.CYMRU.

These online services are managed by Welsh Government.

For more information on how GOV.WALES use your information, see:

• the website privacy notice
• details about cookies on GOV.WALES

This does not apply to our online tax services, hosted separately that still use the ‘GOV.WALES’ web domain. When using our online tax services, refer to the separate privacy notices in the footer, as with our Land Transaction Tax calculator.

Contact forms and surveys

We collect information and feedback using forms created in SmartSurvey, such as our online contact form.

SmartSurvey has issued assurances that they meet UK GDPR standards. We have an agreement with SmartSurvey for the data collected to be stored in the United Kingdom. See SmartSurvey’s privacy policy.

E-newsletter

We use the Welsh Government’s email newsletter and alert service through GovDelivery (supplied by Granicus). The online service gives us statistics around email opening rates and interaction. See GDPR on Granicus.

You can change your subscription preferences and details through GovDelivery at any time. This includes deleting your account.

Training and events

We use Business Wales to manage registration and bookings for our stakeholder events across Wales, such as our tax forums. See Business Wales' privacy notice.

We use social media to support and engage with a variety of people and organisations.

We have 3 social media accounts:

• X/Twitter (English and Welsh)
• LinkedIn
• YouTube

We use a third-party provider, Hootsuite, to manage our social media interactions.

If you send us a private or direct message via social media, the message will be stored by Hootsuite for 6 weeks. This is to enable us to take any action required, such as replying to your messages. See Hootsuite’s privacy policy.

For your own safety online, never include personal information in a social media post. Your comments are visible to all.

Social media sites also use cookies. You should refer to their relevant privacy and cookie notices when engaging with us via social media.

UK GDPR requires a lawful basis for processing personal data. When you contact us or use our website and forms, we will ask for your consent to process your personal data or use cookies, if applicable.

We'll sometimes need to process special categories of personal data, as described in Article 9(1) of UK GDPR. This may be to provide extra support to you or to store communication preferences which may reveal something about your health. For example, we could be asked to provide information in Braille, even if you've not told us directly yourself. For these cases, we'll rely on consent to hold your data.

For any questions about this notice or your rights, please contact our Data Protection Officer.

Complaints should also be directed to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues.

Any changes to this privacy notice will be updated on this page; for example, any new uses of personal data.

From time to time, we may also contact you through other means about the processing of your personal data.