Cyber Innovation Hub
Privacy Policy

Cyber Innovation Hub (CIH) is a Welsh Government and Cardiff Capital Region funded programme which is led by Cardiff University, in partnership with University of South Wales, the Alacrity Foundation and TramShed Tech and which aims to transform the Cardiff Capital Region into a leading UK cyber cluster by 2030.  It has high-level KPIs to create at least 25 new cyber companies and train at least 1500 people in cyber skills.

CIH is part of Cardiff University – registered charity no. 1136855. Cardiff University is the data controller of your information under the General Data Protection Regulation.

Cardiff University
Cardiff
Wales
CF10 3AT
UK

Our privacy notices

To help you understand how your personal data is being processed CIH has set out in its data protection notices what information it holds, why it is required, the legal basis for processing and who that data may be passed to. You can also find out how your information is secured and how long it will be retained.

Privacy policy

Nature of personal data

When you respond to one of our challenges, the categories of personal data that we will be using for this service are:

• Name of the person making the application
• Email address of the person making the application
• When you sign up to our mailing list, the categories of your personal data that we will use are:
• First name and last name
• Email address

What is the legal basis for processing the data?

The legal basis for processing the data we collect is Performance of a Contract in respect of operating the challenge programme and in respect of being able to offer skills training programmes to interest individuals and organisations.

Encouraging a broader awareness of cyber security and the opportunity to participate in challenges and to benefit from skills training for individuals and companies is a key part of CIH’s mission. CIH processes personal data as it is necessary for it to perform a task in the public interest and for its official functions.

The legal basis for processing the use of photographs and marketing communications is Consent.

We do not process any data without explicit consent from the parent/guardian for children aged 16 and under who are still in compulsory education.

How will CIH process the data?

• CIH will use information collected to provide you with information about CIH and to send you marketing materials about available opportunities where you have opted in to receive such communications..
• The CIH Team may use this information to create a database of expressions of interest to receive information on CIH challenges, skills programme and other CIH activities, which will be stored on a secure university server. Access to this information is restricted to CIH and Cardiff University members of staff and third parties contracted to deliver activities.
• Information is visually checked and transferred from the online forms into the secure online database.
• For the purposes of monitoring and research, compulsory data may be processed by a third party under contract to the University to enable long-term tracking of engagement with CIH activities.
• All internal and external reporting which utilises the collected data, does so in an aggregated fashion, meaning that only totals are shown, so individuals’ data is never disclosed within a report.

How long will CIH retain the information?

We will retain the data we collect in accordance with Welsh Government requirements for a minimum of 12 years from the end of the funding period of 2024 and will destroy personal data as soon as Welsh Government instruct us to do so.

In summary: paper copies of information will be retained for one complete academic year after the activity took place. For example for an event that took place 20 November 2014 the forms would be reviewed and permanently deleted on 31 August 2016.

Electronic records are held on a secure online database for a period of 12 years after an event, with data reviewed annually on 31 August.

Data shared/linked with third parties for research purposes will remain within the third party databases for the lifetime of the third parties’ projects, as individuals are no longer identifiable.

Who will your personal data be shared with outside of CIH?

If you have indicated you consent to receive marketing material, personal data will also be shared with BIC Innovation, a marketing company who will be supporting the establishment of the CIH website and may send marketing communications on behalf of CIH.

Personal Data may be shared with relevant CIH partners to facilitate your response to one of our challenges or your enquiry about the skills programme.

Statistical and anonymised data will also be shared with:

• Welsh Government
• Cardiff Capital Region
• CIH partner organisations
• Is personal data transferred outside of the EU?

Where you have consented for your data to be shared with BIC Innovation for marketing purposes, there are limited circumstances where your data may be transferred outside of the EEA. Please read BIC Innovations privacy policy for more information.

Links to external sites

Our site contains links to other sites. We cannot be responsible for the privacy policies and practices of other websites even if you access them using links from our websites and recommend that you check the policy of each site you visit.

In addition, if you linked to our websites from a third party website, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

What are my rights?

Under the GDPR you have rights relating to your personal data which could include: to object to the processing of your personal information, to access, to rectify, to erase, to restrict and to port your personal information. For further information please refer to https://www.cardiff.ac.uk/public-information/policies-and-procedures/data-protection/your-data-protection-rights

Please contact inforequest@cardiff.ac.uk to make the request.

Security of data

Data protection legislation requires CIH to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts of your information will be authorised to do so. All personal data which is stored electronically will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.

Some processing of data may be undertaken on the behalf of CIH by an organisation contracted for that purpose. Organisations processing personal data on behalf of CIH will be bound by a Data Processing Agreement which will outline their obligation to process personal data in accordance with all Data Protection legislation.

This site is protected by reCAPTCHA the Google Policy and Terms of Service apply.

Your acceptance of this Policy

By using our site, you consent to the collection and use of information by Cyber Innovation Hub in accordance with our Privacy Policy. If you do not agree to this Policy, please do not use our sites

How do I complain?

If you are unhappy with the way in which your personal data has been processed you may in the first instance contact:

Cardiff University Data Protection Officer
Main Building
Park Place
Cardiff
CF10 3AT

Email: inforequest@cardiff.ac.uk

If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk