Privacy Notice

For constituents and contacts

I, Carolyn Thomas, am a Member of the Senedd for North Wales.

One of my key roles as a Member of the Senedd is to raise issues on behalf of constituents and to engage with contacts on a range of issues relevant to my role as a Member of the Senedd. As such I will often collect and use personal information relating to constituents and contacts as part of my role. From time to time I will also make contact with surveys to gather information and opinions on matters relevant to my role as a Member of the Senedd.

In the sections below, when referring to constituents I will use the terms “you” or “your”.

This privacy notice sets out information relating to how I will use your personal information and sets out what rights you have in relation to your personal information under data protection law.

What’s my approach to privacy?

I take your privacy extremely seriously and want you to feel confident that your personal information is safe in my hands.

I will only use your personal information in accordance with the data protection law applicable to England and Wales from time to time.

Under data protection law, when I use your personal information, I will be acting as a data controller. Essentially, this means that I will be making decisions about how to use your personal information and why.

How will I use your personal information?

How I will use your personal information, the legal bases I will rely upon, how long I will keep your personal information and other details are set out below.

CASEWORK & DEMOCRATIC ENGAGEMENT

What personal information I will use	Your name, your contact details (postal address, email address, telephone number etc.); Information provided about you when raising an issue or a concern with me. This information may include special category personal information such as your racial or ethnic origins, political opinions, religious or philosophical beliefs, membership of a trade union, physical or mental health (including details of any disability) or sexual orientation. It may also include information concerning criminal convictions or the commission or alleged commission of any offence. Any opinions you provide (including political opinions) in response to any survey or information gathering exercise.
How I will obtain the personal information	Provided by you when you contact me with an enquiry or concern or by a third party where the enquiry or concern is raised on your behalf.
What purposes I will use the personal information for	I will use your name, address and other contact details to communicate with you about the issue or concern raised and to provide you with updates and feedback. I will use your personal information to progress your issue or concern and to take steps to address the matter. I will use your name, address, and other contact details to undertake surveys and information and opinion gathering in order to inform and appraise my work as your Member of the Senedd. Please note that I will not share any of your personal information which you provide in engagement activities which are funded by the Senedd Commission for party political or campaigning purposes.
The legal bases for processing I rely upon	My use of your personal information in connection with the purposes set out above is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal information by me will be in performance of activities which by their nature support or promote democratic engagement. Where your issue or concern is one which involves the processing of special category personal information, my use of your special category personal information will be necessary for reasons of substantial public interest. This is because the processing is carried out by me in my capacity as an elected representative, in connection with the discharge of my functions and is in response to a request by you to take action or a request on your behalf. Where any opinions (including political opinions) you provide in response to any survey or information gathering exercise involves the processing of special category personal information, my use of your special category personal information will be necessary for reasons of substantial public interest in respect of my political activities, namely political surveys.
How long I retain the personal information and why	I will retain your personal information until your case is closed and for a further 3 year period, or until the next Welsh Parliament/Senedd Cymru election, whichever is sooner. This is because issues arising may have knock on effects seen later on and to maintain statistical data on communication trends.

NEWSLETTER UPDATES AND DIRECT MARKETING

What personal information I will use	Your name, your contact details (postal address, email address, telephone number etc.).
How I will obtain the personal information	Provided by you or obtained from the Electoral Register.
What purposes I will use the personal information for	To provide you with newsletters and updates about the work I undertake in your area and in the Welsh Parliament/Senedd Cymru.
The legal bases for processing I rely upon	For electronic communications, you have given your consent. For communications other than by electronic means, my use of your personal information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is because the processing of personal information by me in order to communicate with electors will be in performance of activities which support or promote democratic engagement.
How long I retain the personal information and why	Where I process your personal information to communicate for direct marketing purposes, I will retain your personal information unless and until you inform me that you no longer wish to receive direct marketing from me. You can ask me to stop sending you these communications at any time by contacting me on [email protected]

OTHER CONTACTS

I will collect and process contact details of individuals (including: councillors, community groups, organisations, group contacts, and other stakeholders) who I work with on particular issues in order to progress constituents cases and other activities which support or promote democratic engagement.

What personal information I will use	Your name, your contact details (postal address, email address, telephone number etc.). Information provided may also include special category personal information such as your political opinions. Any opinions you provide (including political opinions) in response to any survey or information gathering exercise.
How I will obtain the personal information	Provided by you where you have contacted me, or I have taken from the public domain.
What purposes I will use the personal information for	To obtain advice and assistance in dealing with a case; to progress issues; to inform you of pertinent information; and, to undertake other activities which support or promote democratic engagement (for example political surveys. To provide you with newsletters and updates about the work I undertake in the Welsh Parliament/Senedd Cymru.
The legal bases for processing I rely upon	My use of your personal information in connection with the purposes set out above is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal information by me will be in performance of activities which by their nature support or promote democratic engagement. Where I process your special category personal information, my use of your special category personal information will be necessary for reasons of substantial public interest. This is because the processing is necessary in connection with the discharge of my functions and is in response to a request by an individual, or on behalf of an individual, to take action on their behalf. Where any opinions (including political opinions) you provide in response to any survey or information gathering exercise involves the processing of special category personal information, my use of your special category personal information will be necessary for reasons of substantial public interest in respect of my political activities, namely political surveys.
How long I retain the personal information and why	I will retain your personal information until the case it is connected with is closed and for a further 3 year period, or until the next Welsh Parliament/Senedd Cymru election, whichever is sooner. This is because issues arising may have knock on effects seen later on and to maintain statistical data on communication trends. Where I process your personal information to communicate for direct marketing purposes, I will retain your personal information unless and until you inform me that you no longer wish to receive direct marketing from me. You can ask me to stop sending you these communications at any time by contacting me on [email protected]

When will I share your personal information with others?

Sometimes, I will need to share your personal information with others. This section sets out details of who I will share your personal information with and why. It also tells you about my legal bases for doing so under data protection law and the steps I will take to protect your personal information.

Please note that I will not share any of your personal information which you provide in engagement activities which are funded by the Senedd Commission for party political or campaigning purposes.

THE SENEDD COMMISSION

Information about our relationship with the Senedd Commission	The Senedd Commission is the independent body which, amongst other things, supports Members of the Senedd in their work.
Why I need to share your personal information with staff of the Senedd Commission	To obtain advice and assistance in dealing with your issue or concern.
The legal basis I rely upon when sharing your personal information	Sharing of personal information with staff at the Senedd Commission will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal information by me will be in performance of activities which by their nature supports or promotes democratic engagement.
What precautions do I take?	Staff at the Senedd Commission have undertaken data protection training and are aware of the importance of protecting personal information. The Senedd Commission has in place appropriate policies and security measures to protect your personal information.

OTHER ORGANISATIONS WHO CAN ASSIST WITH YOUR CASE

Who are these Organisations?	I will share such of your personal information as is necessary with organisations who can assist with your case. Often these will be organisations such as local authorities and health boards which will, from time to time, depending on the nature of your query or concern, be able to assist with your case or will have information relevant to your case.
Why I need to share your personal information with them	To assist with your case or to obtain information relevant to your case.
The legal bases I rely upon when sharing your personal information	Sharing of personal information with such organisations will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal information by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.
What precautions do I take?	I will only share personal information as is necessary and will take steps to determine that the organisations are aware of the importance of protecting personal information.

PROVIDERS OF INFORMATION TECHNOLOGY SERVICES

Who will we be sharing your personal information with?	The Senedd Commission’s ICT infrastructure, which includes cloud service provided by Microsoft; Website hosting company, namely caseworkermp.com, WP Engine via Social Media. For those organisations we share data with like County Councils and Health Services, will also have their own case management and IT storage.
Why I need to share your personal information with such providers	I use suppliers of information technology products and services in connection with the supply, maintenance and/or improvement of my IT network, to manage casework effectively through appropriate software provision, and the creation, development hosting and maintenance of my website.
The legal bases I rely upon when sharing your personal information	In relation to electronic communications sent to, you have given your consent. In all other circumstances, I rely upon my legitimate interests in ensuring that my work as a Member of the Senedd is managed efficiently and my IT system can function properly and efficiently and that my IT network is secure.
What precautions do we take?	I or the Senedd Commission (as appropriate) enter into contracts with my IT providers which require them to put appropriate security measures in place and which restrict their use of your personal information.

OTHER THIRD PARTIES

I may also need to share your personal information with others in the following circumstances:

Legal or regulatory requirements	On occasions, I may be required to disclose your personal information to organisations such as the courts or the police to comply with legal obligations we are subject to and/or to prevent fraud or crime.
Safeguarding	On occasions, I may need to disclose your personal information to other organisations such as the local authority or the police for safeguarding purposes in the substantial public interest.
Professional advice and legal action	I may need to disclose your personal information to my professional advisers (for example, lawyers and accountants) in connection with the provision by them of professional advice and/or the establishment or defence of legal claims.
Group Leader	I may need to disclose your personal information to the Group Leader of my political party in order to obtain advice and assistance from staff of the Group in order to deal with your issue or concern. Sharing of personal information will be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me. This is generally because the processing of your personal information by me will be in performance of casework activities which by their nature supports or promotes democratic engagement.

Engaging with me on Social Media

Any social media posts or comments you send (on my Facebook page, for instance) will be shared under the terms of the relevant social media platform (e.g. Facebook or Twitter) on which they are written and could be made public. I do not control these platforms and am not responsible for this kind of sharing. Before you make any remarks or observations, you should review the terms and conditions and privacy policies of the social media platforms you use. That way, you will understand how they will use your information, what information relating to you they will place in the public domain, and how you can stop them from doing so if you are unhappy about it.

Circumstances in which I will send your personal information outside the UK

Other than the cloud service provided by Microsoft, I do not envisage a need to send your personal information outside the UK. Microsoft has put a written contract in place incorporating model clauses relating to the transfer of personal information outside the UK which provide safeguards to protect your personal information.

If it becomes necessary in any other circumstance to transfer your personal information outside the UK I will let you know, but rest assured that if I do need to transfer your personal information outside the UK, I will use one of these safeguards to make sure it is protected:

I will only transfer it to a country outside the UK which the UK Government has decided has an adequate level of protection for personal information. You can find more about such countries here https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/; or
I will put a written contract in place between me and the recipient that incorporates model clauses relating to the transfer of personal information outside the UK ; or
I will obtain your explicit consent to do so.

What rights do you have under data protection law?

Under data protection law, you have a number of different rights relating to the use of your personal information which apply in certain circumstances. In summary, those rights are:

A right of access – this is a right to obtain a copy of our personal information that is processed by me and some additional supplementary information.
A right to have inaccurate personal information rectified
A right to erasure – this is a right, in certain circumstances, to have your personal information deleted or removed
A right to object – this is a right, in certain circumstances, to object to the use of your personal information. If you object to me using your personal information for political campaigning or direct marketing purposes I must stop using your information in this way.
A right to restrict processing – this is a right to ‘block’ or suppress processing of your personal information.
Request data portability of your personal information – this is a right, in certain circumstances, to require that I provide you with an electronic copy of your personal information either for your own use or so that you can share it with another organisation.

More information about your rights and my obligations can be found on the ICO website https://ico.org.uk/.

If you wish to exercise any of your rights, you can make a request by contacting me at [email protected]

If you request the exercise of any of your rights I am entitled to ask you to provide me with any information that may be necessary to confirm your identity.

Your right to withdraw consent

If you have given me your consent to use any of your personal information, you can withdraw your consent at any time by contacting [email protected] or by another method outlined below.

How can you get in touch with ME?

You can get in touch with me in the following ways:

Postal address	49a Mold Road, Buckley CH7 2JA
Email address	[email protected]
Phone number	0300 11 00 176

I am the person overseeing compliance with data protection law and this privacy notice. If you have any questions about this privacy notice, how your personal information is handled or if you wish to make a complaint, please contact me.

Right to complain to the information commissioner’s officer

If I am unable to deal with a complaint to your satisfaction or if you are unhappy with the way I am using your personal information, you also have the right to make a complaint at any time to the UK’s supervisory authority for data protection issues, the Information Commissioner’s Office.

Changes to this privacy notice

I may update this privacy notice from time to time. If I make any substantial updates, I will provide you with a new privacy notice. I may also notify you in other ways from time to time about the processing of your personal information.