PN072 - Participant Privacy Notice

The wording in this document reflects the requirements of the General Data Protection Regulation (GDPR) effective from the 25th May 2018.

TCBC Service Area: NSPPP
Work area: Skills and Employability
Contact Details: Matthew Davies
Privacy Notice Name: Bridges into Work; Nurture, Equip, Thrive; and Working Skills for Adults (Lead) participant full notice.

Data Controller: Welsh Government, Cathays Park, Cardiff, CF10 3NQ

Data processor: Torfaen County Borough Council, c/o Civic Centre, Pontypool, NP4 6YB

Data Protection and Information Governance Officers:

Welsh Government - Data Protection Officer - Email:

Torfaen County Borough Council - Data Protection Officer - 01495 762200 - Email:

This notice is intended for participants of the three projects Bridges into Work 2; Nurture, Equip, Thrive; and Working Skills for Adults 2. The Welsh European Funding Office (part of the Welsh Government) is the data controller with Torfaen County Borough Council acting as the main data processor

Have we sourced your personal data, directly from you?

Welsh Government receive data about you from the data processor Torfaen County Borough Council (Torfaen CBC).

Torfaen CBC gets most of this data from you from all of the forms that you complete as part of the project. These forms are completed with help of staff from the organisations that deliver the project and include:

  • Aneurin Leisure Trust
  • Bridgend County Borough Council
  • Caerphilly County Borough Council
  • Groundwork Wales
  • Merthyr Tydfil County Borough Council
  • Torfaen County Borough Council (a different team to the Lead Body team that is issuing this notice)

These organisations are also processors for this data and we have an agreed policy with them in how they will securely collect, handle and share the data with us.

The project may also receive data from third parties such as awarding bodies and placement or volunteering providers.

What information does the project collect about you?

The project collects and processes a range of information about you. This includes:

  • Personal Identifiers such as Name, Date of Birth, National Insurance number, your previous surname (if any) and a project issued identification number
  • Your contact details
  • Household status data such as if you live in a single adult household or a jobless household, have caring responsibilities or are at risk of becoming homeless
  • Employment status details such as if you are currently out of work and for how long, if in work your employment details, if you are participating in other government funded schemes or programmes
  • Equality of Opportunity data such as gender, ethnicity, memberships of a minority ethnic group, migrant worker status and disabilities or work limiting health conditions
  • Assessment and eligibility data such as your starting qualifications, your goals and barriers to employment and/or career progression
  • Welsh language data such as your skills using the language and your preferred language for communication
  • Data relating to the activities you undertake with the project such as course or group work details, dates, support received and agreed action plans
  • Placement Details: Placement provider, placement dates and reviews
  • Data relating to the outcomes of the activities you undertake with us such as qualifications attained, gaining employment or other changes in your employment status.

The Council may collect this information in a variety of ways:

Your data is collected via our representatives through the application forms and other paperwork you complete on the project.

Data about the qualifications you attain may be collected from the awarding bodies of those qualifications and details of your work placement or volunteering will be obtained from the organisation that hosts you.

We will store your data:

Our representatives hold the original paper copies of the data in secure restricted access filing areas whilst Torfaen CBC holds the data in electronic form in a secure project database accessible only to a small number of authorised staff.

Why does the project process your personal data?

The Welsh Government processes this data in order to monitor and evaluate the EU funds in Wales as well as to verify the eligibility of participants, activity and expenditure. WG process this data under GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the exercise of official authority”. The authority comes from EU Regulation 1303/2014 (Common Provisions regulation) Article 54(2) which requires member states to provide the data necessary for evaluation and programme specific indicators.

Torfaen CBC also needs to process this personal data to carry out a task in the public interest as above in order to supply this data to the data controller and to effectively deliver the project.

We and our data processors will use this data for any or all of the following purposes:

  • To contact you about matters relating to your current and future project activity (don’t worry this does not include marketing services from other service areas or providers);
  • To assess your eligibility and suitability for and progression in the services offered by the project;
  • To keep track of your journey and all of the activities and support you may have taken up;
  • To make decisions about the effectiveness of the services we offer to continually improve our delivery;
  • To provide reports and support funding claims to our funding body;
  • To provide an audit trail of evidence of project activities;
  • To provide data for an evaluation of the project.

Special categories of personal data:

The Welsh Government processes special category data relating to ethnicity; whether from a Black and Minority Ethnic background; Migrant status; disability and Work Limiting Health Condition as this is required by the ESF regulations.

Torfaen CBC processes this data in order to provide it to WG and to comply with the Equality Act 2010. In the case of data about your health we also use it to ensure that we provide the most appropriate and effective support that meets your needs and circumstances.

Special category data will be highlighted on the project paperwork and you will be given the option to refuse to provide such data unless it is need to demonstrate eligibility for the project.

We can process this category of data because:

The data is processed under GDPR Article 9 (g) “processing is necessary for reasons of substantial public interest”. You have given explicit consent for us to do so.

Who has access to your data?

Welsh Government/WEFO may share the monitoring data (including the individual participant records) with commissioned research organisations interviewing participants so they can talk to them about their experiences. Not everyone who takes part in the programmes will be contacted. If a participant is contacted by researchers, the purpose of the research will be explained to the individual and will be given the option to not take part in the research. The research organisations will delete the participants’ contact details once the research is complete.

To support the research Welsh Government/WEFO may link participant records from the monitoring data to other information about them held by the Welsh Government and UK Government departments. This might include the Longitudinal Educational Outcomes dataset, Careers Wales data, the Lifelong Learning Wales Record, records held by HMRC and DWP, the Labour Force Survey, Annual Population Survey and ESF Participants Survey. This will be done only for the purpose of evaluating the impact EU funds support has had on the people who took part and research on related topics undertaken by the Welsh Government/WEFO or approved social research organisations. Welsh Government/WEFO will never publish information which would identify any individuals.

Monitoring data (including the individual participant records) will also be shared with relevant Welsh Government teams and European Commission (EC) auditors to help determine whether the project has followed the correct procedures and to ascertain the validity of claims. The eligibility information will also be shared with these teams for such purposes. Welsh Government may also share both types of data with independent auditors.

Torfaen CBC and its representatives may share the minimum necessary data with the following organisations. Each of these controllers are also directly responsible to you for the data that they hold and will have their own privacy policies that will apply to their use of your data. We will endeavour to provide you with links to these policies where possible.

  • Awarding and/or certifying bodies (such as Agored Cymru, BCS etc) for your course in order for you to receive a qualification.
  • A professional social and economic research organisation for the purposes of evaluating the project.
  • Our contracted delivery providers in order for them to organise and run courses for us.
  • Where we agree that you need additional support such as transport to venues or childcare we may share your contact details with appropriate providers (taxi firms, crèche facilities etc.) in order to make bookings for you.
  • In some cases, where you agree that a referral to another provider would benefit you, we will request your consent to forward your details to another provider. This consent will be collected at the time of the referral and will only be used to share contact details with the provider named on the consent form.

Is the Data transferred out of the EEA?


How does the Council protect data?

The Council has internal policies in place to ensure the security of the data it processes is not lost, accidentally destroyed, misused or disclosed. Furthermore data is not accessed by employees except in the performance of their duties.

Where the Council engages third parties to process personal data on its behalf, they do so on the basis of written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data.

How long does the Council keep your data?

The Council will hold your personal data only for the period that is necessary and will follow organisational and Local Authority standards in this area.

We will keep your information in line with our Local Authority retention schedules. The ESF funded projects have separate retention policies that comply with statutory obligations. The documents will be kept for 2 calendar years from the 31 December that follows the inclusion of the final eligible expenditure that signifies the completion of the projects. For example if the project closes in December 2022 and the final claim is submitted in January 2023 then the documents will need to be retained until 31st December 2025.

Are we making automated decisions/profiling with your data?


Your rights

You have a number of rights you can exercise:
  • access and obtain a copy of your data on request
  • require the controller and processors to change incorrect or incomplete data
  • under certain circumstances you can require the Council to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
  • to know the period of time that the data will be stored for
  • the right to data portability does not apply to this data
  • the right to withdraw your consent at any time
  • the right to lodge a complaint with a supervisory authority (Information Commissioners Office)
  • to be informed of the potential consequences of if you fail to provide data to the Council
  • to be informed of the existence of any automated decision-making, including profiling and the consequences of this for you.

If you would like to exercise any of these rights, please contact Torfaen County Borough Council, Neighbourhood Services Planning and Public Protection, Matthew Davies,

Last Modified: 17/07/2023 Back to top