1. Who we are
The Modern Foreign Languages Student Mentoring Project (MFL Mentoring) is being carried out by Cardiff University on behalf of Welsh Government. Cardiff University is the main body that will be collecting, storing, processing, maintaining, cleansing, and retaining personal data including data defined as sensitive. Cardiff University will be the data controller for your personal data.
Our university partners include Aberystwyth University, Bangor University, Cardiff University, Cardiff Metropolitan University, Swansea University, University of South Wales,the Royal Welsh College of Music and Drama, University of Oxford, University of Wales Trinity St. David, and Wrexham Glyndŵr University. Our consortia partners include Central South Consortium (CSC), GwE, South East Wales Education Achievement Service (EAS), Partneriaeth and Growing Mid Wales.
The programmes delivered by MFL Mentoring aim to increase the number of pre-GCSE learners opting to choose an International Language for GCSE through mentoring.
References to ‘the programmes’ in this notice refer to MFL Mentoring’s programmes, including but not limited to, Year 8/9 Mentoring, Linking Language Workshops, Multilingual Mentoring in Primary Schools and the Love Reading Mentoring Project.
The following document explains why we (MFL Mentoring) collect data, how this data is processed and the steps we take to ensure data security at all stages.
2. How we will use your data
We use your personal data to facilitate your involvement in the MFL Mentoring project. Any data that is collated about you is needed to deliver the programme effectively. As part of the project’s remit, this might also include research conducted into the language learning sector. Your data is collated in a variety of different ways, which could include Qualtrics, and/or paper surveys. Our analysis is not about any specific person and so you will not be identified as an individual. All data will be anonymised in any report or research outputs.
3. The nature of the personal data we will be using
The categories of your personal data that we will be using for this project may include the following depending on the nature of your involvement in the project. If your data is being collated, you will be informed in advance so that you can give your consent.
University Students:
Any student from our partner university who wants to apply to participate with the project will be asked to share the following during their engagement with the project:
- Full name
- Gender
- Date of birth
- Nationality
- Disability
- Email address
- Phone number
- Postal address
- University
- Degree programme
- Year of study
Teachers:
Any teacher based in a Welsh primary/secondary school that wants to apply to participate with the project will be asked to share the following during their engagement with the project.
- Full name
- Gender
- Email address
- Phone number (school and personal)
- School
- Job title
Parents/Care givers:
Parents are asked to share their full name whilst consenting to allow their child to participate with the project.
- Full name
Secondary School Learners:
Learners will be asked to share the following when engaging with the project, and can choose to provide an anonymous name at any point of the survey.
- Full name
- Gender
- Ethnicity
- School/Hwb email address
- School
- Year group
Primary School Learners:
- First name and Surname
- Gender
- School
- Year group
4. Why does MFL Mentoring collect this information and why our use of your personal data is lawful
MFL Mentoring collects data on individuals for the following main purposes. In order for our (MFL Mentoring) use of your personal data to be lawful, we need to meet one (or more) conditions in the GDPR and DPA 2018 data protection legislation. For the purpose of this project (MFL Mentoring) and the programmes it delivers, we will process your personal information in accordance with the following legal basis.
| Type of personal data | Purpose | Legal basis |
| Any personal data shared with the project via surveys/applications collated through Qualtrics or paper surveys. | For the purposes of monitoring which allows MFL Mentoring to: Fulfil compulsory external reporting requirements to regulatory bodies such as Welsh Government. Monitor and evaluate the effectiveness of the programmes. Provide a clear picture of the activities we deliver and the people we work with. Produce statistics, including event application and participation numbers, and participant outcomes. | Cardiff University is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities. As such, personal data is processed on the basis that doing so is necessary for our public task, is for scientific and historical research purposes which are in the public interest and is subject to necessary safeguards UK GDPR Art.6.1(e) and Art. 9.2(j). |
| Personal data such as information about disabilities. | Ensure the health and safety and well-being of all participants who engage with the project and to assist with pastoral and welfare needs, for example ensuring that we are aware of medical conditions and disabilities. | Processing is necessary for compliance with a legal obligation to which the Data Controller is subject.Processing of Special Categories data is necessary for reasons of substantial public interest based on the duties in the Equalities Act 2010 (UK GDPR Article 9(2)(g)) Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 10 “Preventing or detecting unlawful acts” and Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 16 “Support for individuals with a particular disability or mental condition” |
| Personal data such as information about ethnicity. | To understand if ethnicity has impact on attitudes towards language learning, this supports the project to better understand barriers towards language learning. | Cardiff University is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities. As such, personal data is processed on the basis that doing so is necessary for our public task, is for scientific and historical research purposes which are in the public interest and is subject to necessary safeguards UK GDPR Art.6.1(e) and Art. 9.2(j). |
| Bank details shared by students via a Payee Capture Form. Collated by the project team. | For administering finance for university students that participate with the project for example, to pay bursaries and travel reimbursements. | Art.6 1 (b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the requests of the data subject prior to entering into a contract”. |
| Personal data such as name and email address via Qualtrics survey or paper copy of survey. | To send relevant and necessary information regarding forthcoming activities as well as marketing communications. | Art.6 1 (a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. |
| Criminal Offence Data of students via Enhanced DBS checks. | For safeguarding of children and individual at risks due to the nature of the work that will be undertaken by students participating with the project. Please see below for further information. | Art.6 1 (e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Safeguarding of Children and Individuals at Risk (Condition 18 DPA Schedule 1). Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 10 “Preventing or detecting unlawful acts” and Data Protection Act 2018, c.12 Schedule 1, Part 2 Paragraph 11 “protecting the public against dishonesty” |
5. Sharing your personal data
We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes). Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. Cardiff University is the main body which will be processing your data.
Our partners include:
- Welsh Government (https://gov.wales/). Welsh Government fund the project.
- Reaching Wider (reachingwider.org). Reaching Wider fund some partner schools to engage with the project. A school will be made fully aware of this if it applies to them.
- Ondata Research Ltd (http://ondata.org.uk/). To support evaluation components of the project. When data is shared, a data sharing agreement is in place.
- A university and/or school. To support mentors and learners who are engaging in the project.
- Consortia Leads. To support teachers and schools who are engaging in the project.
Enhanced DBS Checks
All students must complete an Enhanced DBS check as part of the project processes prior to visiting partner secondary or primary schools. Any individual who does not want to complete an Enhanced DBS check has the right to refuse to complete this check. However, this does mean that the individual in question will be unable to participate with MFL Mentoring and the programmes it delivers.
The information provided within the Enhanced DBS check can and sometimes will be shared with schools that engage with the project. Individuals will be told in advance of any sharing of information between MFL Mentoring and a partner school.
Accreditation
If you are a student completing one or both of the accreditation units, the details you provide will also be shared with the following partners in order to process and award your units:
- Creo Skills Ltd (https://creo-skills.co.uk/)
- Agored Cymru (https://agored.cymru/)
6. How long we will keep your personal data
Cardiff University will keep your personal data for no longer than is necessary for the purposes. Please see table below for any personal data that is used for research purposes.
| Description | Retention Period | Notes |
| Research records and data from non-clinical and non-public health research projects | Data to be retained for a minimum period of 5 years after the end of the project* or after publication of any findings based upon the data (whichever is later). *End of project is defined as completion of project closure report or publishing of final articles. | If any patents emerge from the research, the records and data may need to be retained for a longer period. |
7. Security of Data
Data protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure.
Only members of staff who need access to relevant parts of your information will be authorised to do so. All staff with access to any personal data which is stored electronically will have multi-factor authentication installed on their accounts, while paper files will be stored in secure areas with controlled access.
When any identifiable data is shared with MFL Mentoring’s partners, any documents will be password protected and the password shared in a separate email to the document containing the data. Schools will receive data that includes personally identifiable information but only for their own learners and this data is shared with the contact teacher in order to determine which learners should engage with the programmes offered. All other data shared is fully anonymised and no personally identifiable information is shared with partners.
8. Your data protection rights
Under data protection legislation you have some rights relating to your personal data. Some of these may be limited depending on the circumstances. You can find some information on Cardiff University’s website at: Your data protection rights – Public information – Cardiff University.
In the first instance you should contact us at Lucy Jenkins (jenkinsl27@cardiff.ac.uk) with your request:
- to have your personal data rectified, if it is inaccurate or incomplete
- to restrict how we process your personal data
- to withdraw consent for direct marketing purposes
9. Withdrawal of consent and the right to lodge a complaint
Where we are processing your personal data with your consent, you have the right to withdraw that consent. You can do this by contacting Lucy Jenkins (jenkinsl27@cardiff.ac.uk)
If you are unhappy with our use of your personal data, please let us know by contacting Lucy Jenkins (jenkinsl27@cardiff.ac.uk) in the first instance. If you remain dissatisfied you can contact Cardiff University’s DPO at inforequest@cardiff.ac.uk and state the name of this project. You also have the right to raise any concerns with the Information Commissioner’s Office (ICO) via their website at https://ico.org.uk/concerns/.
10. Last updated
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 1st September 2023.
11. Contact info
If you have any questions about how your personal information will be used, please contact Lucy Jenkins, Project Director, at Jenkinsl27@cardiff.ac.uk.