Privacy Policy – My Choice

Protecting your privacy is incredibly important to us.

Summary

This privacy policy is operated by the Education department at Swansea Council, and relates specifically to the My Choice web application (referred to as a website).

You may contact us with regard to this privacy policy, via:

education@swansea.gov.uk

In summary, depending on your relationship with us, we will use your personal information:

As needed to authenticate your access to the web application.
As needed to transfer your application to the organisation for which it is related.
As needed to transfer applications made to your organisation to you.
As required by Welsh Government to ensure the Local Authority can provide statistics on Post-16 applications.
As required by other Swansea Council teams and departments to assist with your well-being and safeguarding.
To provide you with personalisation features, such as Welsh/English language preference.
To provide you with the ability to save and continue your application at a later date.
To provide you with support should a problem with the web application arise.
To manage and improve the My Choice web application service.
To comply with the law as defined in England and Wales, as applied in Wales.

This privacy policy, which covers all of your personal information whether collected online or offline, including by telephone or where you write to us, provides detail on those activities and explains your rights and how to exercise them.

This privacy policy shall be construed in accordance with the law in England and Wales as applied in Wales. Any changes we make to our privacy policy in the future will be posted on this page.

By using this website you confirm that you accept the terms of this privacy policy and that you agree to comply with them.

In addition to this specific web application Privacy Policy; Swansea Council supply information with regards to how your information is collected, used, and protected, on a wider basis.

Our Commitments to You

The Education department at Swansea Council is committed to protecting and respecting your privacy when using the My Choice web application.

Although we will do our utmost to protect your information, we cannot guarantee the security or reliability of third party services. Your use of the internet and transmission of personal data is done so at your own risk. Once we have received your information, we will use relevant security procedures to try to prevent unauthorised access.

We will never pass on information about you unless we are legally obliged to do so under law in England and Wales as applied in Wales. We will never use any of your data in ways that might have unjustified adverse effects on you. We will never use information provided via My Choice to make automated decisions that would affect you.

My Choice may contain web links to third party educational organisations, apprenticeship schemes, charities, and advice websites. If you follow a link to any external website, please note that they will have their own privacy policy and are not affiliated with My Choice or Swansea Council. It is your responsibility to check these policies before you submit any personal data to such websites.

Swansea Council will not display or make use of commercial advertising unless directly related to the education sector on the My Choice website. Swansea Council will not make use of behaviour targeting, fingerprinting, or tracking services on the My Choice website.

Data Controller and Processor

This privacy policy sets out the basis on which any personal data we collect from you in the course of a browsing session, or that you provide to us during a browsing session may be processed by Swansea Council and the affiliated education providers that make use of My Choice.

Swansea Council will not collect any personally sensitive information about you unless you have chosen to give it to us. Therefore, the My Choice web application is structured so that you can visit it without identifying yourself or revealing any personally sensitive information.

The My Choice web application is structured in to three elements:

The public facing web application (referred to as a “website” or “web site”);
the private Applying for Post-16 process, used by young people to apply for a Post-16 placement; and
the private Provider Dashboard, used by providers to manage applications.

In relation to use of the public facing web application – the My Choice website; Swansea Council will act as both the Data Controller and the Data Processor.

In relation to the private Applying for Post-16 process; Swansea Council will act as the Data Processor, and the relevant education provider will act as the Data Controller.

In relation to the private Provider Dashboard; Swansea Council will act as both the Data Controller and the Data Processor.

As an applicant, both your chosen education provider and Swansea Council will handle all of your personal information in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018 (GDPR).

As a member of staff acting on behalf of an education provider, Swansea Council will handle all of your personal information in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018 (GDPR).

Information We May Collect

Swansea Council and the education providers using My Choice will typically collect details provided by you as well as information relating to your visits to the My Choice website. We may collect and process the following data about you:

Information you give us. You may give us information about you by visiting the website, completing or partially completing and “saving for later,” an application for Post-16 education, or by corresponding with us by phone, e-mail or otherwise. This information may include, and not be limited to, your name, school and exam history, date of birth, e-mail address, phone number, home address, nationality, and the contact details of your parent or guardian. We may also collect your IP address, UPN, and other identifiers to help ensure data security and correct identification.

Information we collect about you. With regards to each of your visits to the My Choice website, we may automatically collect technical information, including the IP address used to connect your computer to the internet, browser vendor, language preference, and your log-in information without directly asking you. This is necessary for the web application to perform correctly.

We may process this information in order to:

Securely share your Post-16 application with your chosen education provider, and
identify those applicants who may require additional support in their application.
Understand what support could help improve both applicants and education providers, and
respond to anonymised data queries from Welsh Government related to Post-16 take-up.
Enable you to “save and continue,” your Post-16 application at a later date.
Enable education providers to identify applicants, and
enable education providers to manage applications on behalf of applicants.
Improve our services and detect or prevent fraud, abuse of our web application; and
ensure the continuity of our service without interruption.
Facilitate your choice of Welsh or English language, and
facilitate your access to the web application and different parts of the website.
To comply with the law in England and Wales as applied in Wales.

We may also process this information in order to:

Respond to a legal enquiry, and
to assist with ensuring the safeguarding and well-being of young people.
To keep a record of our correspondence with you.

This personal information may also be used to communicate with you if we have a legal obligation to do so, or you have consented. This personal information will not be used for the purposes of marketing or advertising.

This personal information may also be used to ensure that content from the website is presented in the most effective manner for you and for your computer, and/or to notify you about important changes to our web application.

In such instances, Swansea Council will always give you the opportunity to opt out of consent based communications.

Any personal information collected will be treated as confidential and, save as set out in this privacy policy, the City and County of Swansea will not disclose any of your personal information except with your specific permission.

Post-16 Applications

Swansea Council will not make publically available personally identiable information or sell Post-16 application information supplied through the My Choice web application.

Swansea Council may need to provide anonymised information related to Post-16 applications (e.g. total number of applicants to a school), if requested by Welsh Government or other parties. Any such information will only be given if it does not risk identifying an individual.

Swansea Council will not knowingly retain pupil personal information or Post-16 applications taken from the My Choice web application beyond the time period required in order to support an Education provider which has lodged a support request, or to support a well-being or safeguarding case.

If a Post-16 applicant wishes to ammend or revoke their application under the General Data Protection Regulation, then they have the right to do so. All such requests should be made directly to the Education provider with which the application was made.

Education providers making use of My Choice will be responsible for supporting access to, deletion of, and correction of personally identifiable information held in a Post-16 application related to their organisation when requested to do so by the applicant or their authorised parent, guardian, or other legal representative.

Both Swansea Council and the education providers making use of My Choice will take reasonable steps to protect the security, privacy, confidentiality, and integrity of personal information against risks – such as unauthorised access or use, or unintended or inappropriate disclosure – through the use of administrative, technological, and physical safeguards appropriate to the sensitivity of the information.

Data Security

Keeping your information secure is important to us and we take great care to limit what we collect through My Choice and how we use it.

Swansea Council has tried to create a secure and reliable web application. Swansea Council has put in place appropriate organisational and technical safeguards and security measures given the nature of the information.

You should note however that e-mail enquiries may be transmitted by insecure means and stored off-line. You should recognise that the use of the internet and My Choice is entirely at your own risk. Swansea Council accepts no responsibility or liability for the security of personal information transmitted via the internet.

We are based in Swansea, Wales, in the United Kingdom. Where possible, our servers are hosted in Microsoft Azure’s Cardiff data centre. Wherever possible, we will not transfer your personal information outside of the European Economic Area. In order to send a confirmation email to you, we need to transfer your email address and confirmation code to our upstream email provider based in the United States of America. No other personal information is sent to the email provider.

We keep your personal information only for as long as we need it for the purpose for which it was collected, plus an additional period of time as required to ensure your application is processed correctly and the education provider is able to maintain accurate records.

Post-16 applications will not be stored within the My Choice web application beyond the length of time required for use by the associated education provider, up to a maximum of 2 years from the date the application was completed. Education providers may keep records of applications themselves separate from My Choice, if they are required to do so as part of a legal basis.

All personal information is stored in encrypted databases. Information related to your browsing of the My Choice website is not stored on the server beyond the length of time required to manage your session and to provide Swansea Council with anonymised statistics, typically up to 12 months. We do not use information related to your IP address or browser vendor to track you on the Internet. We do not use third party analytics services.

Disclosure to Third Parties

Swansea Council will not share the content of Post-16 applications with any third party outside of the education department unless required to do so by law or as described in this agreement. Any request for access to the content of a Post-16 application should therefore be made directly to the associated Post-16 provider as they are responsible for maintaining the data.

Post-16 providers acting as the Data Controller for Post-16 applications will only disclose such information to appropriate bodies and authorities in good faith where required to do so by law. This could include teams within the education department (e.g. psychologists), social services, health authorities, and the police.

Unless required to do so under a legal obligation, Post-16 providers will seek consent from the applicant or their parent, guardian, or other legal representative, prior to disclosure.

Swansea Council will only share data related to browsing sessions (see IP Addresses and Cookies) in order to:

Comply with legal obligations, or
enforce or apply our terms of use and other agreements, or
protect the rights, property, or safety of Swansea Council, or
protect the rights, property, or safety of it’s employees, or others, or
investigate or prevent a crime, or
obtain professional legal advice, or
with your consent.

Personal information obtained from My Choice will not be shared by Swansea Council or affiliated providers with:

Third party advertisers, or
social media providers, or
analytics companies.

Swansea Council and Post-16 providers may from time to time release anonymised statistics based on Post-16 applications, however this data will be anonymised in such a way as to avoid identifying an individual applicant. For example, “200 applicants in Swansea applied to School X.”

IP Addresses and Cookies

We need to collect information about your IP address when visiting the My Choice website, in order to ensure the security of the web application. We may analyse anonymised details of visits to our website, including but not limited to, peak time usage patterns, and popularity of content.

We will not share analytics data with third party web services.

Most websites use cookies to make the browsing experience more efficient, and to help you use websites to their full potential. Cookies are a small text file that is transferred to your hard drive or the internal memory of your mobile device. You can clear cookies in your browser settings.

Like most websites, My Choice makes use of cookies.

When you visit our website, we use only strictly necessary cookies to enable navigation around our website, personalisation choices, and to maintain your log-in details for the duration of your authenticated session.

We do not use any third party analytics or cross-site tracking cookies.

You may refuse to accept cookies by activating the relevant setting on your web browser; however, if you refuse cookies you may be unable to access certain parts of the website, e.g. continuing an application, and you may not be able to make personalisation choices.

Unless you have adjusted your browser setting so that it will refuse cookies, they will be used automatically by your browser where necessary.

If you want to learn more about cookies or if you want to know how to delete or control the cookies that are stored on your computer, you can visit:

How We Use Cookies

My Choice uses cookies for three purposes:

To help you personalise your experience with the My Choice website.
For session management, to assist with the completion of the Post-16 application.
To assist with authentication and session management; for security.
Personalisation cookies allow you to decide between different languages (e.g. Welsh and English).

Information in regards to this personalisation is not stored or monitored by us and only takes place within your web browser. We would never use information derived from personalisation cookies to try to identify any individual, and will not share the information with third parties.

Authentication and session management cookies help us to ensure that your data remains secure. They are only one part of a larger set of security measures that we utilise. We need to use these session cookies each time you undertake the Post-16 application, or access the Provider Dashboard.

Access to Information

We believe that the following legal reasons permit the use of your personal data:

A. Where it is needed to provide you with My Choice, such as:

To manage authenticated sessions and log-in information.
To allow your chosen provider to manage your application for a Post-16 placement.
To allow Swansea Council to identify people who may need assistance.

B. Where it is in our legitimate interests to do so, such as:

To test the performance of My Choice and internal processes.
To follow guidance and best practice of regulatory bodies, such as Welsh Government.
For management and audit of our web server and network operations.
To keep records of communications between you and us.
In order to perform our duties or comply with any legal obligations.

C. With your consent, such as.

For you to freely apply for a Post-16 placement at your chosen provider.
For you to make use of the Provider Dashboard.

Under the Data Protection Act 1998 and General Data Protection Regulation 2018 (GDPR), you have certain rights in respect of the information that both Swansea Council and the affiliated provider hold about you.

The Information Commissioner’s Office has useful information in respect of your rights over your personal data.

https://www.ico.org.uk/

If you wish to exercise your rights, you should contact either the Post-16 provider to which you have applied.

1. Your right to withdraw consent. If you wish to withdraw consent in regards to your personal information being stored, then you will need to withdraw your Post-16 application. To do this, you should contact the Post-16 provider to which you originally applied.

2. Your right to access the information held about you. If you wish to obtain a Post-16 application that you have made, then you should contact the Post-16 provider to which you originally applied.

If you wish to access information related to the IP address or for staff members, the authentication account that you accessed our system using; you should contact Swansea Council.

In both cases, with some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that is held about you, as well as information about what we do with it, who we share it with, and how long we will hold it for.

3. Your right to have inaccurate information about you rectified. You have the right to have information held about you corrected if it is factually inaccurate.

If you wish to rectify information held in relation to a Post-16 application, then you should contact the Post-16 provider to which you originally applied.

If you wish to rectify information held in relation to the staff authentication account that you sign in to our system using, then you should contact Swansea Council.

4. Your right to object to what we do with your data, and to have restrictions placed upon it. Where we process your personal data on the basis of our legitimate interest, you have the right to object to that processing and have restrictions placed upon it while we consider your objection.

5.** Your right to have your information erased in some circumstances.** You have the right to require us to delete the information that we hold about you if it is no longer necessary for the purpose we collected it for, and there is no other legal basis on which we must, or are allowed to, retain it.

If you wish to have your Post-16 application erased, then you must contact the Post-16 provider to which you originally applied.

6. Your right to complain to the Information Commissioner’s Office. You have the right to lodge a complaint about our handling of your personal data with the supervisory authority, which in the United Kingdom is the Information Commisioner’s Office. But before you do so, please contact us first to give us a chance to put matters right.

education@swansea.gov.uk
You can contact the Information Commissioner’s Office on 0303 123 1113.