QMS - K09  
Privacy Policy  
Version Number: 3  
Issue Date  
06/03/2024  
Website Privacy Policy  
Introduction  
Mentera understands that the information you trust us with is important to you,  
and we are committed to protecting and respecting your privacy, as well as clearly  
stating how the information we gather is used to deliver our service to you.  
Aim  
This privacy policy aims to give you information on how Mentera collects and  
processes your personal data through your use of this website (mentera.cymru),  
including any data you may provide through this website when you take part in a  
survey.  
Summary  
• Mentera is a not for profit company and therefore  
we do not aim to profit from the data we store.  
• We will not sell or share your personal  
information with any third-party marketeers.  
• We will protect all personal information using  
appropriate organisational and technical controls.  
• We will only retain your data for as long as it is necessary.  
• You have the right to request a copy of the  
personal information we hold about you and  
to suggest corrections or deletions.  
QMS - K09, Version 3  
Controller  
Mentera is the controller and responsible for your personal data (collectively  
referred to as “we”, “us” or “our” in this privacy policy).  
If you have any questions or concerns about Mentera’s policies and practices for  
handling your personal data, please contact us by e-mail at dpo@mentera.cymru  
or by post at DPO Officer, Mentera, Uned 3 Y Parc Gwyddoniaeth, Aberystwyth,  
Ceredigion, SY23 3AH  
You have the right to make a complaint at any time to the Information  
Commissioner’s Office (ICO), the UK supervisory authority for data protection  
issues (ico.org.uk). We would, however, appreciate the chance to deal with your  
concerns before you approach the ICO so please contact us in the first instance.  
QMS - K09, Version 3  
Information we may collect from you  
Personal data, or personal information, means any information about an individual  
from which that person can be identified. It does not include data where the  
identity has been removed (anonymous data).  
We may collect, use, store and transfer the following information:  
• Identity data including your first name, maiden name, last  
name, username or similar identifier, marital status, title,  
date of birth, gender and name of your company.  
• Your contact data including email address,  
postal address and telephone number.  
• Data you send to us via this website, including information  
you provide through surveys on our website, or other  
written information that relate to an enquiry.  
• Website usage data which includes information  
about how you use our website.  
• Technical data including internet protocol (IP) address, browser  
type and version, time zone setting and location, browser plug-  
in types and versions, operating system and platform, and other  
technology on the devices you use to access this website.  
• Marketing and communications data which includes your preferences  
in receiving marketing from us and your communication preferences.  
We gather and use personal information about individuals who:  
• Contact us using post, phone, email or otherwise;  
• Use Mentera ICT Systems;  
• Complete a registration form via our website  
for one of our programmes;  
• Enter a survey via our website;  
• Subscribe to our services or publications;  
• Request marketing to be sent to them;  
• Use our website – as you interact with our website or our ICT  
systems, we will automatically collect technical data about  
your equipment, browsing actions and patterns. We collect this  
personal data by using cookies and other similar technologies.  
QMS - K09, Version 3  
Data received from third parties  
We may receive personal data about you from the following third parties:  
Google – we use Google Analytics which is a web  
analytics service offered by Google;  
The Rocket Science Group, LLC – who operate Mailchimp. We use Mailchimp to  
manage email marketing subscriber lists and send emails to our subscribers.  
The Welsh Government (WG) – where we have partnered with the WG  
or the WG have contracted us to provide a particular programme.  
How we use your personal data  
We will only use your personal data when the law allows us to. Most commonly, we  
will use your personal data in the following circumstances:  
Where we need to perform the contract we are about  
to enter into or have entered into with you.  
Where it is necessary for our legitimate interests (or those of a third party)  
and your interests and fundamental rights do not override those interests.  
Where we need to comply with a legal obligation.  
We have set out overleaf, in a table format, a description of all the ways we plan to use your  
personal data, and which of the legal bases we rely on to do so. We have also identified what  
our legitimate interests are where appropriate.  
QMS - K09, Version 3  
Lawful basis for processing including basis  
of legitimate interest  
Purpose/Activity  
Type of Data  
To register you as:  
(a) Identity  
(b) Contact  
(a) Performance of a contract with you  
(a) a new client or subscriber; or  
(b) attendee of an event  
(b) Necessary for our legitimate interests (to run our business  
and keep our records updated)  
To send you details of any events you  
may be attending  
(a) Identity  
(b) Contact  
(a) Performance of a contract with you  
(b) Necessary for our legitimate interests (to keep our  
records updated)  
To manage our relationship with you  
including notifying you about changes  
to our terms or privacy policy  
(a) Identity  
(b) Contact  
(a) Performance of a contract with you  
(b) Necessary to comply with a legal obligation  
(c) Marketing and  
Communications  
(c) Necessary for our legitimate interests (to keep our records  
updated and to improve our services)  
To enable you to complete a  
registration form or survey  
(a) Identity  
(b) Contact  
(c) Usage  
Necessary for our legitimate interests (to run our business,  
provision of administration and IT services, to develop our  
business)  
(d) Technical  
(e) Marketing and  
Communications  
To administer and protect our  
(a ) Identity  
(b) Contact  
(c) Technical  
(a) Necessary for our legitimate interests (for running our  
business, provision of administration and IT services, network  
security and fraud prevention)  
business and this website (including  
troubleshooting, data analysis, testing,  
system maintenance, support, reporting  
and hosting of data)  
(b) Necessary to comply with a legal obligation  
QMS - K09, Version 3  
Lawful basis for processing including basis  
of legitimate interest  
Purpose/Activity  
Type of Data  
To deliver relevant website content  
(a) Identity  
(b) Contact  
(c) Usage  
Necessary for our legitimate interests (to keep our website  
updated and relevant, to develop our business and to inform  
our marketing strategy)  
(d) Marketing and  
Communications  
(e) Technical  
To use data analytics to improve our  
website, services, marketing, client  
relationships and experiences  
(a) Technical  
(b) Usage  
Necessary for our legitimate interests (to develop our  
services, grow our business and to inform our marketing  
strategy)  
To make suggestions and  
(a) Identity  
(b) Contact  
(c) Technical  
(d) Usage  
Necessary for our legitimate interests (to develop our  
services and grow our business)  
recommendations to you about services or  
events that may be of interest to you and to  
contact you for market research  
(e) Marketing and  
Communications  
QMS - K09, Version 3  
Storing Information  
We always hold your information securely.  
To prevent unauthorised disclosure or access to your information, we have  
implemented strong physical and electronic security safeguards to ensure, as far  
as reasonably possible, the confidentiality of your information at all times.  
Any personal information we hold about you is stored and processed in  
accordance with relevant data protection legislation.  
Google analytics & re-marketing  
Our websites use Google analytics and Google’s re-marketing technology. This  
technology enables users who have already visited our online services and shown  
interest in our services to see targeted advertising on Google partner network  
websites. Likewise, users that are similar to the visitors of our websites can be  
addressed. The advertising will be displayed through the use of web cookies.  
Using cookies, the user behaviour on a website can be analysed and subsequently  
utilised to provide targeted product recommendations and advertising based on  
the user’s interests.  
If you would prefer to not receive any targeted advertising, you can deactivate  
the use of cookies for these purposes through Google. Alternatively, users can  
deactivate the use of cookies by third-party providers by visiting the Network  
Advertising Initiative’s deactivation website. Please note that Google has its  
own data protection policy, which is independent of our own. We assume no  
responsibility or liability for their policies and procedures. For more information,  
please read Google’s privacy policy: How Google uses data  
Cookies  
A cookie is a small text file that is added to the hard drive of your device by a web  
server within our domain. Cookies cannot be used to run software programmes or  
add a virus to your device. They are unique to you and avoid you having to input  
the same information and preferences each time you visit our website.  
You can block cookies by activating the setting on your browser that allows you to  
refuse the setting of all or some cookies. However, if you use your browser settings  
to block all cookies you may not be able to access all or parts of our website.  
QMS - K09, Version 3  
Disclosures of your personal data  
We may share your personal data with the parties set out below for the purposes  
set out in the table:  
• Service providers who provide IT and system  
administration services and general business support.  
• Professional advisers including lawyers, accountants and insurers who  
provide consultancy, banking, legal, insurance and accounting services.  
• The Welsh Government, HM Revenue & Customs and other  
authorities based in the United Kingdom who require reporting  
of processing activities in certain circumstances.  
• Organisations contracted by the Welsh Government to  
deliver a particular service and/or programme.  
We shall only share personal information with trusted third parties where we have  
the appropriate contracts and controls in place, which will have taken into account  
their information handling processes.  
Links to external websites  
Our website may contain links to third party websites. We are not responsible for  
the content of other websites, or for the protection or privacy of data you submit  
to them. This privacy notice only applies to the Mentera website.  
Marketing  
We may use your personal data, including data received from third parties, to form  
a view on what we think you may want or need, or what may be of interest to you.  
This is how we decide which products, services and offers may be relevant for you.  
You can ask us to stop sending you marketing messages at any time by following  
the opt-out links on any marketing message sent to you or by contacting us at any  
time.  
QMS - K09, Version 3  
Your legal rights  
You have the right to:  
• Request access to your personal data (commonly known  
as a “data subject access request”). This enables you to  
receive a copy of the personal data we hold about you  
and to check that we are lawfully processing it.  
• Request correction of the personal data that we hold about  
you. This enables you to have any incomplete or inaccurate  
data we hold about you corrected, though we may need to  
verify the accuracy of the new data you provide to us.  
• Request erasure of your personal data. This enables you to ask us  
to delete or remove personal data where there is no good reason for  
us continuing to process it. Note, however, that we may not always be  
able to comply with your request of erasure for specific legal reasons  
which will be notified to you, if applicable, at the time of your request.  
• Object to processing of your personal data where we are  
relying on a legitimate interest (or those of a third party) and  
there is something about your particular situation which makes  
you want to object to processing on this ground as you feel  
it impacts on your fundamental rights and freedoms.  
• Request restriction of processing of your personal data.  
This enables you to ask us to suspend the processing  
of your personal data in the following scenarios:  
- If you want us to establish the data’s accuracy.  
- Where our use of the data is unlawful  
but you do not want us to erase it.  
- Where you need us to hold the data even if we  
no longer require it as you need it  
to establish, exercise or defend legal claims.  
- You have objected to our use of your data  
but we need to verify whether we have  
overriding legitimate grounds to use it.  
QMS - K09, Version 3  
• Request the transfer of your personal data to you or to a third  
party. We will provide to you, or a third party you have chosen,  
your personal data in a structured, commonly used, machine-  
readable format. Note that this right only applies to automated  
information which you initially provided consent for us to use or  
where we used the information to perform a contract with you.  
• Withdraw consent at any time where we are relying on consent to  
process your personal data. However, this will not affect the lawfulness  
of any processing carried out before you withdraw your consent.  
If you wish to exercise any of the rights set out above, please contact us at  
dpo@mentera.cymru  
Or send a letter to:  
DPO Officer, Mentera, Uned 3 Y Parc Gwyddoniaeth, Aberystwyth, Ceredigion,  
SY23 3AH  
We will aim to respond within 10 working days and provide the information within  
28 days.  
You will not have to pay a fee to access your personal data (or to exercise any  
of the other rights). However, we may charge a reasonable fee if your request is  
clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply  
with your request in these circumstances.  
QMS - K09, Version 3  
Complaints  
We work hard to ensure that your personal information is treated appropriately  
and would always welcome the opportunity to rectify any complaints that you may  
have about your data held within Mentera and again you can contact us using the  
details outlined above.  
Retaining your data  
Mentera, and the information we retain about you is subject to some regulatory  
and legal requirements. Our aim is not to keep your personal information for any  
longer than we have to for us to fulfil our obligations to you. If your data needs  
to be retained, we will ensure that the appropriate security and organisational  
measures are put in place to protect the use of your data.  
International transfers  
The majority of our company’s activity is within the UK and we therefore operate  
under the auspices of the ICO – the lead data protection supervisory authority  
within the UK.  
We do hold some personal information data relating to businesses in other EU  
and non-EU countries. This information is not held to benefit our company but  
in respect of developing business opportunities for Welsh companies in other  
countries. This information will be protected using our same stringent protocols.  
Some of our third-party suppliers are based outside the European Economic Area;  
so their processing of your personal data may involve a transfer of data outside the  
EEA.  
Please note that some countries outside the EEA may not have similar safeguards  
in place regarding protection and use of your data as those inside the EEA.  
Therefore, if we do transfer your personal data to countries outside the EEA, we will  
comply with the relevant legal rules governing such transfers and take reasonable  
steps to ensure that your data is treated securely.  
Changes to our policy  
We will review our Privacy Policy regularly and will inform you of any updates  
through our website and appropriate communication channels.  
QMS - K09, Version 3