Privacy Policy

OUR POLICIES

Cadw is committed to the protection of your rights and your privacy.  

OUR PRIVACY PROMISE
We are committed to protecting the privacy of our supporters. We take your privacy seriously and treat all the information you give us with great care.

We value and respect all the people whose support helps us to care for over a hundred historic sites across the country and to keep the story of Wales alive for future generations.

Our Privacy Policy explains how we collect, store and use the personal information you give to us. If you have any questions concerning your personal data and how we look after it then please contact us at cadw@gov.wales

As a data controller we fully comply with the Data Protection Act 1998, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the General Data Protection Regulations.

WE PROMISE
• access the personal data that we are processing about you
• require us to rectify inaccuracies in that data
• object to or restrict processing (in certain circumstances)
• ask for your data to be erased (in certain circumstances)
• obtain and reuse your personal data for your own purposes across different services (in certain circumstances)
• lodge a complaint with the Information Commissioners Office (ICO) who is our independent regulator for data protection

POLICY OVERVIEW
We collect personal information from our visitors to our website; supporters who apply to become Members, make a purchase from our online shop and from those who get in touch with us directly. We do this both electronically and in paper format.
In addition we also collect details automatically about the pages you visit on our website. Please see our Cookies policy below for more information.

In choosing to share your personal information with us, you will be agreeing to our collection and use of your information as described in this policy.
If you no longer want us to process your personal details you can ask us to stop at any time by contacting cadwmarketing@gov.wales

We use the information you share with us to:
• Make sure you receive the product, service or information you have requested or bought
• Carry out reasonable administration of your membership, bookings, volunteering and other services
• To keep in touch with you in the way that you want us to
• To better understand our supporters so that we can personalise and improve the services we offer
• For details of how we do this please see the full policy below.

We will need to make changes to this policy from time to time, to make sure that we are always providing you the latest information about what is happening to your personal information.  
This policy was last updated on 24/03/2018.

WHAT INFORMATION DO WE COLLECT AND HOW?

We collect personal information about you that helps us to deliver and improve our services. This includes:
• Name and address
• Email address and telephone numbers
• Date of birth
• Payment information such as credit card and bank details
• How you would like to hear from us
• Details of purchases and  membership.
• Details of your volunteering application
• Enquiries and feedback

Under our membership scheme we also ask for details of your children who you would like to include on the membership. We use this information to better understand how to provide the best service to your family in terms of offers and events, and we will not contact your children directly.  

If you have provided details for someone else, for example by buying a gift for them, we will not contact that person until they have been given the opportunity to let us know their communication preferences.

If you have contacted us on behalf of an organisation, for example making an Educational Booking or a Travel Trade enquiry, we will also store details of your employer.
When visiting our website we also collect information about your IP address and the pages you visit. This helps us to understand which areas of our website are most useful to our supporters and make improvements. This does not tell us who you are and where you live until you choose to provide us with that information.  Please see our Cookies policy below for more information.

WHAT DO WE DO WITH YOUR INFORMATION?  

PROCESSING

We will make sure that you receive the product or service you have requested, process any payments and send you information relating to that service.
If you have joined as a Member this will include sending you confirmation of your purchase and membership materials such as membership cards, information on how to use your membership, regular magazines, handbook and email newsletters. We will also send you information about membership renewal and information relating to your Direct Debit payments.
Please do let us know if your details have changed.

MARKETING AND COMMUNICATIONS

Receiving marketing information from Cadw will always be your choice, and you can choose how you would like to receive that information from us.
You can also change your mind at any time, and we will keep your preferences up to date.
We limit the number of marketing communications we send to make sure we are not sending you too much. The maximum you would receive is two per month, in addition to communications that are not marketing related described above.
We will only contact you by email if you have told us you would like to hear from us this way, or to let you know about services you have previously bought. Every email will have a link to help you unsubscribe if you wish to stop this.
We may contact you occasionally by post, however you can also stop this at anytime by contacting cadwmembership@equinox.wales  

WHO WILL HAVE ACCESS TO MY INFORMATION?

Your information will be only be accessible to our staff, volunteers and contractors if they are trained and it is appropriate in order for them to carry out their role in line with this Privacy Policy.
We will never sell your personal information, or let other organisations use it for their own purposes.
We will only share your personal information where: 

• We are legally required to, or as a result of a lawful request by a governmental or law enforcement authority.
• We have engaged a supplier or contractor to carry out services on our behalf, such as order fulfilment, sending our communications or carrying out research and analysis. 

We only work with trusted suppliers in compliance with the requirements of the Data Protection Act 1998.

Our website may contain links to other websites that are outside our control and are not covered by this Privacy Policy. If you access other sites using the links provided, the operators of these sites may collect information from you that will be used by them in accordance with their privacy policy, which may differ from ours. 

HOW DO WE KEEP YOUR INFORMATION SAFE?

The security of your information is paramount to us. We use encryption for transfer of data and our networks are regularly monitored to ensure they remain secure.
We also regularly review our measures to ensure they are up to date and in line with latest developments, particularly when we are handling payment information.  
If you have a password to allow access to certain parts of our website, you must keep that password safe and not share it with anyone or your personal information could be at risk.
Data that is transmitted via the internet or in email, cannot be 100% secure. As a global environment, transmitting data to us may take place outside the European Economic Area.
We will take every reasonable precaution to keep your information safe but it cannot be guaranteed and so please be aware that any information you do transmit to us is at your own risk. Once we have received your information we will use our best effort to ensure its safety within our network, which sits within the European Economic Area.
We will only hold your personal information for as long as reasonably necessary to carry out services and administer your relationship with us. Typically this is two years since your last interaction with us unless we are required to hold it longer for legal or taxation reasons. 

If we dispose of your information it will always be done securely. 

HOW TO GET IN TOUCH AND UNDERSTANDING YOUR RIGHTS 

You have the right to a copy of the information we hold about you.

Should you wish to contact us regarding the use of your data for the purpose of administering your membership, please email our membership team cadwmembership@equinox.wales or call 0800 0743121. (This replicates the information that we have included on the existing terms and conditions for online membership sign up).

Should you wish to lodge a complaint regarding the use of your data, please write to our Marketing Manager / Interim Head of Marketing and Tourism Development – Cadw, Welsh Government, Plas Carew, Unit 5/7 , Cefn Coed Parc, Nantgarw, CF15 7QQ or e-mail us cadwmarketing@gov.wales

Or you are able to write to the Data Protection Officer Data Protection Officer, Welsh Government, Cathays Park, Cardiff, CF10 3NQ or e-mail DataProtectionOfficer@gov.wales for any general information you would require on the new data protection legislation.
You also have the right to have incorrect information corrected and the right to object to further processing of your personal information for direct marketing.

COOKIES
Cookies are small text files sent to your computer or mobile device by the websites that you visit. They help make websites work better and provide information to the owners of the site. For instance, this site uses YouTube cookies to embed videos in its pages and Google Analytics cookies to track users’ behaviour whilst on the site. By understanding how people use our site, we can improve the navigation and content to better meet people’s needs. The information collected by the Welsh Government includes IP address, pages visited, browser and operating system. The data will not be used to identify any user personally. The cookies we use on our site are:


Cookie Name Purpose
Language version langPrefWAG This cookie is created by the content management system and is essential for the site to display to correct language version of the site.
GoogleAnalytics __utma
__utmb
__utmc
__utmz These cookies are used to find out how visitors use our site. We use the information to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, whether they have visited before and the pages they visit.
CookieControl civicAllowCookies
civicShowCookieIcon This cookie records whether a user has accepted the use of cookies on our site.


YouTube VISITOR_INFO1_LIVE
PREF
use_hitbox These cookies are essential for the display of YouTube videos on our site.


Web browsers allow some control of cookies through browser settings. To find out more about cookies and how to manage them, visit www.allaboutcookies.org

THIRD PARTY COOKIES

To make it easy for you to use and share our website we embed features from other websites such as Facebook, Twitter and TripAdvisor. Browsing the Cadw website may place cookies from these third party websites on your computer. Cadw have no control over these cookies so it is not always possible to list them, and they are liable to change without notifying us.
We may refer to companies, organisations and public bodies and enable access to their websites directly from our website. Each company, organisation or public body operates its own policy regarding the sale of personal data and the use of cookies. If you have a particular interest in, or concern regarding the way your data will be used then you are advised to read the Privacy Statement on the relevant website.
In addition to these policies your personal data is protected in the UK by the Data Protection Act 1998 and the General Data Protection Regulations. Under this legislation, we will only process any data we hold about you in a lawful and fair manner. We will keep your data securely to prevent unauthorised access by third parties. Your personal data may have to be disclosed if we are required to disclose it by law, or as a result of a lawful request by a governmental or law enforcement authority.

Registration

You do not have to register to use the Welsh Government website, but you do need to register to take part in the discussions and if you want to receive e-mail updates.

The registration information we require as mandatory for you to register is: your username (which does not need to be your real name however you should not try to impersonate), a password, and e-mail address. This information is stored securely on our database. Until such time as you choose to delete your account, your details are stored securely so that you do not need to re-register when you come back to the site.

You can change your registration preferences, e-mail address and login details through the website at any time. If you wish to amend your personal profile, please click on the 'Subscribe' link at the top of the page, log in to your account, and check/uncheck the options available. If you are no longer interested in using Welsh Government site services you can delete your account on your personal profile page. 

If this privacy policy changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.