Legal Innovation Lab Wales: using your personal information   

Personal information which you supply to us will be held by Legal Innovation Lab Wales, an operation part-funded by the European Regional Development Fund through the Welsh Government and Swansea University.   

The Legal Innovation Lab Wales operation is committed to protecting the rights of registered users in line with Data Protection legislation. For data the Welsh Government or the Welsh European Funding Office (WEFO) requires the operation to collect (Section A below), the Welsh Government is the data controller and Swansea University is a data processor.   

The Data Protection Officer for the Welsh Government can be contacted at Data.ProtectionOfficer@gov.wales  

For other personal data collected by Legal Innovation Lab Wales (Section B below), Swansea University is a data controller and has a dedicated Data Protection Officer contactable at dataprotection@swansea.ac.uk    

This document provides an explanation of why we collect personal data as part of the Legal Innovation Lab Wales operation, how we process it and the steps we take to ensure data security at all stages. All data collected through the operation is processed and stored in accordance with Data Protection legislation.   

What personal information do we collect?  

A. Data which we are required to collect on behalf of the Welsh Government and WEFO    

Data covers the European Structural Funds 2014-2020 in respect of a) the monitoring data laid out in the Structural Funds definitions and b) information requirements under the Eligibility rules and conditions for EU funds support.   

Monitoring Data  For further information on the required monitoring data, see the Structural Funds definitions at  https://gov.wales/funding/eu-funds/2014-2020/wefo-guidance/monitoring/?lang=en    

Eligibility Information  For information on the required data collected under the Eligibility rules and conditions, see  https://gov.wales/funding/eu-funds/2014-2020/wefo-guidance/eligibility/?lang=en    

For Legal Innovation Lab Wales to satisfy the above requirements and process data on behalf of WEFO, we collect the following personal information from enterprises and individuals (including Swansea University academics in some cases) who wish to collaborate on research projects and/or explore joint external funding opportunities:   

• Name of enterprise lead contact/ technical officers/ employees involved in the project;  

• Work contact details of personnel involved in the project;  

• Job role/title of personnel involved in the project;   

• Total monthly employment costs attributed to the project/research activity of associated personnel;   

• Employment documentation of academics/individuals employed as part of a research project;   

• Funding application proposals which may contain information relating to academic/individual achievements and track record including curriculum vitae in some cases.   

B. Data which is collected and processed by Legal Innovation Lab Wales   

Direct Marketing  In the interests of providing national and international enterprises, academics, researchers and the wider community with an opportunity to benefit from the operation’s research programme and facilities by hearing about the research activities we can offer and our events, to learn from business engagement activities across the University such as funding training programmes or graduate placements, or to keep in touch with those enterprises with whom we have collaborated, the following information may be collected, stored and used or otherwise processed by Legal Innovation Lab Wales:   

• Name and contact details of individuals who make enquiries to the Legal Innovation Lab Wales team via telephone, email or the webpage and/or who self-register for events and/or newsletters; 

• Name and contact details of named individuals within organisations with whom we make contact by telephone, email or post where appropriate;   

• Data including registration documentation for events, seminars etc. and consent forms for school engagement activities;   

• Photographs and video footage taken during Legal Innovation Lab Wales related events for official use, including during School of Law engagement activities. Delegates will be informed when photographs and/or video footage are taken during events. Where an image clearly identifies an individual and constitutes personal data, informed consent will be obtained from the relevant delegate/s before its release. Parents/guardians will always be asked to provide consent for photographs/footage to be taken and for media release by Swansea University, and/or our funder, as a result of any school engagement activities.   

 Why do we collect personal information and how do we use it?   

We collect your personal information for the following reasons:   

1. To evaluate eligibility for Legal Innovation Lab Wales support according to funding compliance requirements and the operation’s approval process, thus ensuring effective value for money and selection of those enterprises with potential to achieve maximum impact;   

2. To monitor and evaluate projects at operation management and governance boards and as part of the operation’s external evaluation so as to assess the effectiveness of working practices, delivery of projects and project outputs and impacts in line with funding requirements;   

3. To report to the Welsh Government and the European Commission for regulatory operation monitoring, claim and audit purposes;   

4. To keep in touch and provide optimal support, informing you on Legal Innovation Lab Wales news, event and highlights that could benefit you or your enterprise and promoting the operation and its world-class research and facilities; and   

5. To statistically analyse the commercial relationships existing across Swansea University on a periodic basis.   

What is our legal basis for processing?   

Data which we are required to collect on behalf of WEFO (Section A above)   

The relevant section of the GDPR for collecting personal data in relation to the Structural Funds is Article 6(1)(e) where:   

“processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller”   

The European Regulations governing Structural Funds give the Welsh Government official authority to process the personal data referred to above. Article 54(2) of Regulation (EU) No 1303/2013 common provisions on the European Structural and Investment Funds (CPR Regulation) states that “Member States shall provide the resources necessary for carrying out evaluations, and shall ensure that procedures are in place to produce and collect the data necessary for evaluations, including data related to common and where appropriate programme specific indicators.”   

Data which is collected and processed by Legal Innovation Lab Wales  (Section B above)   

There is a legitimate interest for us to process data to provide you with direct marketing including information relating to opportunities for collaboration, up-to-date news and up-and-coming events of interest (Article 6(1)(f) of the GDPR). A legitimate interests’ assessment has been carried out to ensure your personal data is used appropriately and in ways you would reasonably expect with minimal privacy impact. You have the right to object to processing for the purposes of direct marketing if you wish and will always be given the opportunity to unsubscribe to future communications. Where an image constitutes personal data/special category data, we will always seek the data subject’s consent for its use under Article 6(1)(a) and 9(2)(a) of the GDPR.   

Who receives your personal information?   

Information is made available to personnel requiring access in limited circumstances for the reasons outlined above. These include:  

• Operation and University technical and administrative staff;   

• The operation governance and management boards;   

• External advisors and consultants directly engaged with the operation;   

• The Welsh European Funding Office and the European Commission including their independent auditors and commissioned research organisations.   

In some circumstances, images or video footage may be released on our operation website, Swansea University website, social media platforms and/or via press release. Where an image or footage constitutes personal data, you will be informed of this and your consent for media release will be obtained. Legal Innovation Lab Wales may use third party processors, under a data processing agreement, for event organisation and material distribution.    

How your personal information is stored.   

Data Protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts or all of your information will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access. The data will be held for the duration of the Legal Innovation Lab operation and for a reasonable period of time upon its conclusion to comply with regulatory audit and document retention requirements.   

How long will the data be retained for?   

Where it is necessary for Swansea University to collect data in order to provide you with key information about research activities, your information will be held for the duration of programme. Information which is required for audit/verification purposes by Welsh Government and the European Commission will be held by Swansea University until 31st December 2026 in accordance with Welsh European Funding Office requirements.  

What are your rights?   

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase and to restrict your personal information (please note, however, that exercising these rights may compromise our ability to collaborate due to the operation’s contractual funding constraints). In the case of direct marketing, you have an absolute right to object to processing for this purpose. Please visit the Swansea University Data Protection webpages for further information in relation to your rights.  

Any requests or objections should be made in writing to: Swansea University Compliance Officer (FOI/DP), Vice-Chancellor’s Office, Swansea University, Singleton Park, Swansea, SA2 8PP.   

If you are unhappy with the way in which your personal information has been processed, you may in the first instance contact the University Data Protection Officer using the contact details above. If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision.   

The Information Commissioner can be contacted at: - Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF www.ico.org.uk   

Your responsibilities   

Please advise of any changes to your name, address, contact details as soon as practically possible so that we can amend our records accordingly.