Our contact details
Any queries regarding our use of your information should be sent to the Data Protection Officer at:
0300 200 6565
How will your information be used?
We are collecting your personal information in order to consider applications for the three month PhD Research in Practice placement with the Senedd Commission’s Research team, in partnership with the Wales Graduate School of Social Sciences. This privacy notice covers the processing of your personal data provided in the application form.
The Senedd Commission is the data controller of the information you provide and will ensure it is protected and used in line with the UK’s data protection legislation.
What information are we processing?
Utilising the application form, we will be collecting the following information:
- Your name;
- Email address;
- Academic institution;
- Year(s) of study;
- Overview of your PhD project;
- Reasons for applying for placement, and;
- Preferences for start date/hybrid or in person working
Why are we processing it?
We are collecting this information as part of application process for three month PhD Research in Practice placement with Senedd Research.
The placement scheme is in conjunction with the Wales Graduate School for Social Sciences, who fund and advertise the placements, which they offer with a number of public sector and third sector organisations. The placement hosts (Senedd Research in this case) are responsible for developing advertising materials, managing the application and interview process, and making placement offers.
Who will have access to the information?
The information you provide will be accessible to key members of Senedd Research staff in relation to this internship, including:
- The Head of Senedd Research
- The Knowledge Exchange Lead
Will the information be shared with any third parties, or publicised?
As this internship is offered in partnership with the Wales Graduate School of Social Sciences, some information will be shared with their Research in Practice Placement lead. The information shared with the lead will be:
- The applicant’s name;
- Their institution;
- Their start date preference, and;
- whether an interview/placement was offered to them.
The Wales Graduate School of Social Sciences will already hold some of this information as all applicants will be part of its existing PhD programme. The information will be shared securely via email, at the end of each placement recruitment round – once per year.
Storage, retention and deletion
The information will be stored securely on our ICT systems which includes third party cloud services provided by Microsoft. We may also use of Microsoft’s artificial intelligence tools to process your information. Any transfer of data by Microsoft outside of the EEA is covered by contractual clauses under which Microsoft ensure that personal data is treated in line with domestic legislation. To find out more about how Microsoft will use your information, you can read their privacy statement here.
After each round of applications, the application data will be held for a period of 1 year. Following this, information will be securely deleted.
Legal basis for processing Personal Data
Data protection law sets out various legal bases which allow us to collect, hold and use your personal information. For the purpose of processing the personal data you provide, we rely on the following legal bases:
- Article 6(1)(e) Public Task - The processing is necessary for the performance of a task carried out in the public interest.
Our processing of this information relates to the official function as the Welsh Parliament, and encouraging engagement in democracy in Wales. Under Schedule 2 of the Government of Wales Act (‘GOWA’) 2006, the Senedd Commission may:
“promote public awareness of
(a) the current or any pending system for the election of Members of the Senedd, and
(b) the current or any pending system of devolved government in Wales.
[…] (3)The Commission may exercise its power under sub-paragraph (1) in such manner as it thinks fit but may, in particular, do so by—
(b) making grants to other persons or bodies for the purpose of enabling them to carry out such programmes.
The legal basis we rely on to use personal data in these instances is often known as 'public task'. This basis is used where "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law".
The basis in law we rely on is identified in Section 8 of the Data Protection Act 2018 (‘DPA 2018’)
- (b) the exercising of our parliamentary functions; […] or
- (e) activities that support or promote democratic engagement.
The processing of your information in order to appoint an individual into the PhD internship will ultimately enable the Commission to continue in it’s promotion of awareness of the Senedd, it’s Members and pending changes to the system of devolved government brought about by the upcoming dissolution period and following elections.
The position of the PhD intern within the Senedd Research service will likely have a direct impact due to the work of the service in preparing information for publication.
Legal basis for processing Special Category Data
Article 9(1) GDPR defines special category personal data as including personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Whilst application does not ask anyone to provide their special category data, there are questions that allow you to type your own answer. Please do not share anything related to the categories above unless it is needed for your answer.
If you do respond with special category data, the lawful basis that the Commission will rely upon to process it is:
- Article 9(2)(g) Reasons of substantial public interest (with a basis in law)
- The basis in law that we rely upon is Schedule 1 Part 2(7) of the Data Protection Act 2018; Administration of justice and parliamentary purposes.
Any special category data that is not relevant to the project will be immediately deleted.
Sharing data
In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that you provide. We will only do this if we are required to do so by law.
Your rights
As a data subject, you have a number of rights. The rights which apply depend on the legal bases we are relying on to use your personal information. Those rights will not apply in all instances, and the Commission will confirm whether or not that is the case when you make a request.
The rights include the right to request access to your own personal information, sometimes called a ‘subject access request’.
Additionally, you have the right to request from us:
- that any inaccurate information we hold about you is corrected (please note that you are required to keep us up to date with any changes to your personal information);
- that information about you is deleted (in certain circumstances);
- that we stop using your personal information for certain purposes or in certain circumstances; and
that your information is provided to you or a third party in a portable format (again, in certain circumstances).
If you would like to engage any of the rights that you have under data protection legislation ask a question or make a complaint about how your information is used.
Making a complaint
You can complain to the Data Protection Officer if you are unhappy with how we have used your data. Contact details can be found above.
If, following a complaint, you remain dissatisfied with our response, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113