Hwb Cloud Environment privacy notice

About this notice

The Welsh Government manage and oversee the development of the Hwb Cloud Environment and are responsible of the creation and management of user identities and accounts, as well ensuring the infrastructure and configuration align with industry standards to help ensure schools and our users stay safe online.

This privacy notice explains how the Welsh Government collects and uses personal information where it acts as the data controller. This covers:

• creating, maintaining, suspending, reactivating and deleting Hwb accounts and assigning associated permissions

• managing users and providing secure access to services offered through the Hwb Cloud Environment

• monitoring and protecting the security and integrity of the Hwb Cloud Environment

• administering the Hwb Cloud Environment and the Hwb web platform (please refer to the specific privacy notice for the web platform)

• responding to support enquiries

• maintaining records needed for audit, investigation and service management

“Personal information” means information that relates to an identified or identifiable individual.

For further information about the services in the Hwb Cloud Environment please refer to the terms and conditions.

Our lawful basis

Our principal lawful basis is that processing is necessary for the performance of a task carried out in the public interest by the Welsh Government.

Where applicable, we may also process personal information because:

• processing is necessary to comply with a legal obligation, or

• processing is necessary for Welsh Government’s legitimate interests, where UK data protection law permits a public authority to rely on that basis for the relevant activity

If you are a learner

The Welsh Government uses some information about you to create your Hwb account, let you sign in, provide support and keep Hwb safe.

Your school is responsible for information used in school activities, lessons and as generally as part of your schoolwork.

You can ask what information is held about you and ask for incorrect information to be fixed. Speak to a teacher, parent, carer or another trusted adult if you have questions or are worried about how your information is being used.

Where other organisations are the controller

Schools, local authorities and other authorised education stakeholders are responsible for the personal information and user generated data and information they choose to create, upload, share or otherwise process within Hwb services for educational purposes (e.g. teaching, learning, school administration or governance) or otherwise.

The school, local authority or relevant organisation, rather than the Welsh Government, is the data controller and their own privacy notice will explain how and why it processes that information. If you are unsure who is responsible for particular information, contact your school or local authority in the first instance.

Your rights

You have rights in relation to the personal information we hold about you. These are:

• the right to make a complaint about any alleged infringement of data protection law

• the right to request access to your own personal information that we hold, and this is sometimes known as a 'subject access request'

• the right to have any inaccurate information we hold about you corrected (rectification)

• the right to have your information deleted (erasure)

• the right to request the restriction or suppression of your personal information1 (restrict processing)

• the right to object to the use of your personal information for certain purposes (objection)

• the right to your information in a portable format

• the right to object to decisions about you being made by wholly automated means

Many of the rights listed above are limited to certain defined circumstances and we may not be able to comply with your request in full. We will tell you if this is the case. You can read more about your rights on the Information Commission’s (ICO) website.

We will normally respond to a valid request within one month. The response period may be extended where the request is complex or numerous. We will not charge a fee for dealing with your request.

Where the request relates to information controlled by a school, local authority or another educational stakeholder, you will need to submit the request directly to that organisation.

Contacting us

To ask about this notice, exercise a data protection right or raise a concern, contact:

Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ

Email: dataprotectionofficer@gov.wales

You also have the right to complain to the ICO, the independent UK regulator for data protection.

If you have any other questions about the Hwb Cloud Environment, contact:

Schools Digital Services Division (Hwb)
Welsh Government
Rhyd-y-car
Merthyr Tydfil
CF48 1UZ

Email: support@hwbcymru.net

When dealing with your enquiry we may refer to our technology suppliers or contact other government departments where this is necessary to investigate and respond. Where we do so, we will share only the information necessary for that purpose. Once we have replied to you, we keep a record of your message for audit purposes.

Personal information we collect

The information used to establish and maintain an Hwb account depends on the type of account and the user’s role. Account information is supplied by schools, local authorities, or other education stakeholders.

We process personal information about different types of individuals to create the following:

• Hwb username, email address and system identifier, and

• encrypted Unique Pupil Number (UPN) for learners only

We will receive and use the information detailed for the following account types:

Learner accounts

• first, middle and last names

• date of birth

• sex

• school name and school number

• year, national curriculum year, registration, class and subject-group information

• school admission number

• enrolment status i.e. whether you are currently on roll (active account) or if you have left the school (deactivated account)

• registration status i.e. if you attend one or more schools

• status as a learner

School staff accounts

• title, first, middle and last name

• school staff code or staff identifier

• school name and school number

• relevant year, registration, class or subject-group information

• status as a member of staff

• staff role or job function

Governors and other education stakeholders

• first and last name

• school name and number

• status as a governor

When you use your Hwb account we may collect:

• sign-in and authentication record

• account activity and audit records

• device, browser, network and session information

• security alerts and suspected misuse information

• account changes and administrative actions and

• information needed to investigate or resolve a technical or security incident

Who we share personal information with

We may share relevant personal information with:

• our service providers who process the personal data on our behalf and act on our instructions only. These include hosting and infrastructure providers, IT support and maintenance, security monitoring and incident response providers. These providers are our data processors and are bound by contracts that require appropriate security measures. They must act on our documented instructions, protect the information and will not use it for its own purposes except where they are permitted by law.

• schools, local authorities and education stakeholders where this is necessary to administer or support an account query

• law enforcement bodies, regulators, courts or other public authorities where disclosure is required or permitted by law

• parties involved in investigating a security, safeguarding or legal matter where disclosure is necessary and lawful

We disclose only the information reasonably necessary for the relevant purpose.

The Welsh Government shares personal information with educational technology providers of Hwb services. Details of our educational technology providers, links to their privacy notice and the data they process are as follows:

The privacy notices for our service providers can be found in the links below:

Just2easy

Microsoft Corporation

Google Inc, also includes YouTube (the API Client uses YouTube API Services)

Adobe Systems Software Ireland Limited

Apple Inc

South West Grid for Learning Trust Ltd (SWGfL)

Freshworks Ltd

In addition to our service providers, we share information with other parts of Welsh Government where necessary for the collection of pupil attendance data and the provision of personalised assessments.

Attendance data

Since September 2020, the Welsh Government has collected pupil level attendance data on a weekly basis. We are doing this to help support schools and local authorities to address the challenges of improving attendance and reducing inequalities in attendance. Weekly attendance data helps us to respond to changing circumstances in a timelier manner. This data will only be used for statistical or research purposes.

For further detail regarding the Welsh Government’s data collection processes, please refer to the Collecting Attendance and Personal Characteristics Data from Schools Privacy Notice.

Personalised assessments

As part of our commitment to improving educational standards in Wales, the Welsh Government has introduced personalised assessments for learners in Years 2 to 9 in maintained schools in Wales.

The Welsh Government has a legal obligation to provide assessment arrangements for reading and numeracy for learners.

The personalised assessments are developed by a consortium of partners, led by AlphaPlus Consultancy Ltd, on behalf of the Welsh Government.

Information about personalised assessments can be found on Hwb.

Learners

The Welsh Government will collect your assessment feedback and share with your school. Personalised Assessments collects, processes and retains your data until you have completed Curriculum Year 13 (18 years old), after which it will be anonymised.

Details of the data processed by our supplier on our behalf are as follows:

• first and last name

• date of birth

• sex

• Hwb username, email address and system identifier

• school name and number

• year, national curriculum year, registration, class and subject-group information

• school admission number

• enrolment status i.e. whether you are currently on roll (active account) or if you have left the school (deactivated account)

• registration status i.e. if you attend one or more schools

• encrypted Unique Pupil Number (UPN)

• status as a learner

• outcomes from assessments taken

The Welsh Government may use information which can identify you to:

• resolve incidents raised with PA service desk

• share information back with you and your school in a reporting format

• match and/or link datasets from statutory data

• enable statistical analysis to inform wider education and social policies

Information used for statistical analysis and research purposes (carried out in a way that ensures individual children and young people cannot be identified), will be:

• used to monitor the performance and assess the quality of our education policies and services so that they can be improved

• used to help inform, influence and improve education policy for people in Wales

• used to link with other datasets, including non-educational datasets, to inform wider education and social policies

• used for publication purposes, which includes a range of statistical outputs on the Welsh Government website

Staff

Information derived from the assessments of individual learners, and information available for collation at a group or class, year and school level, can be seen by members of staff who have been given relevant access. The level of staff access is determined by the school’s headteacher.

Details of the data processed by our supplier on our behalf are as follows:

• first and last name

• Hwb username, email address and system identifier,

• school name and number

• year, registration and class groups

• status as a member of staff

• staff role, for example headteacher, deputy headteacher, teacher, teaching assistant, IT technician, administrator etc.

The Welsh Government may use information which can identify you to:

• resolve incidents raised with PA service desk

• share information back with you and your school in a reporting format

Trials of personalised assessments

From time to time, the Welsh Government will carry out large-scale trials of new assessment material in which schools will be asked to participate. Schools wishing to participate will be asked to register in advance. The purpose of these trials is to support the development of the personalised assessments, check that new questions are working as intended, and gain feedback from learners and teachers.

If your school is taking part in a trial, you may be asked to participate, using your Hwb Cloud Environment log-in details at school. Schools should explain to learners how to access the assessments and provide specific instructions as per the provider guidance.

Learner responses will be kept confidential and will be used to help us understand how the assessments are working. The responses will be kept by the Welsh Government for 18 months after the end of each trial, after which time the information will be destroyed. The answers to any questions will not contribute to learners’ assessment outcomes or be included in any reporting.

Live trialling of single questions

From time to time a learner’s assessment may include a single additional ‘trial’ question at the end. The learner’s answer to the question will not be part of the assessment outcome or be included in any reporting.

Adding a trial question to an assessment is a way of collecting data on how learners answer the new questions before they are added to the assessment question bank. If you get a trial question it will be matched to your curriculum year and it will always be the last question in an assessment. A response to the trial question will be held in accordance with other assessment data.

Support and correspondence information

If you contact Hwb support or complete a Welsh Government form, we may collect:

• your name and contact details

• your school, organisation and role

• account and technical information

• details of your enquiry or support request

• correspondence and supporting information you provide and

• records of the action taken to address your request

Please do not include any unnecessary personal or sensitive information in support requests to support@hwbcymru.net.

International transfers

Some suppliers may process or provide access to personal information from outside the United Kingdom. Where this happens, an appropriate transfer mechanism and safeguards are in place as required by UK data protection law.

How long we retain personal information

Hwb account information is retained while the account remains active and for up to 12 months after deactivation, after which the account and associated Welsh Government controlled identity information will be deleted, unless:

• the account is reactivated during the deactivation window

• where there are extenuating circumstances and information must be retained because of an investigation, safeguarding concern, legal claim or litigation hold

Learner accounts remain active throughout their school life, while non-learner accounts remain active for the duration of their association with the school or organisation.

The retention period for user generated data and information in a Hwb service should be determined by the controller responsible for that information. Where no local retention policies apply, all user generated data and information will be deleted in accordance with account deletion.

Security

Welsh Government uses organisational and technical measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction. Access is restricted to authorised individuals and suppliers who require it for their role. Security events may be monitored and investigated to protect users and the Hwb Cloud Environment.

Users must follow the account security and acceptable use requirements contained in the Hwb Terms and Conditions.

Cookies

Service provided through the Hwb Cloud Environment use essential cookies and similar technologies needed to authenticate users, maintain sessions, protect accounts and provide core functions. Where non-essential cookies are used, users will be provided with appropriate information and choices. Further information on the Welsh Government managed services is detailed below:

Microsoft provide the following resources through their central privacy documentation:

• Microsoft Privacy Statement

• Microsoft Cookies Policy

• Microsoft Trust Center

Google provide details of their cookie types and technologies overview for their services, found on this web page Google Cookie Types & Technologies Overview, this provides details for:

• Google “Core” Services (e.g. Classroom, Drive, Docs, Sheets, Meet)

• strictly Essential Cookies

• zero Advertising Cookies

• additional services (for example, YouTube, Google Maps, Earth)

Adobe provide details of their cookie policies.

Changes to this notice

We may update this notice to reflect changes to the Hwb Cloud Environment or the way Welsh Government processes personal information.

The latest version will be published in the Hwb Cloud Trust Centre. Where a change materially affects how personal information is used, we will email users to bring it to their attention.