Llywodraeth Cymru
Welsh Government


Digital Learning for Wales


Hwb Privacy Notice

1. About us

This privacy notice sets out how the Welsh Government (we or us) collects and uses information about you as part of your use of hwb@gov.wales (the Web Site).

Please read this privacy notice carefully to understand how we will use your personal information.

2. Browsing the Web Site without logging in

The Web Site is structured so that you can visit it without either identifying yourself or revealing any personal information. If you do not log in to the Web Site, we will not collect any personal data that specifically identifies you. However, we may still collect information about your browsing session in accordance with our cookies policy (please see paragraph 9 'Cookies' below).

3. Personal information we collect about you

Depending on how you interact with us, we may collect the following information about you:

  • Information you give to us.

  • You may give us information about you by completing an online form, registering for an event, contacting us by phone or e-mail, or otherwise interacting with us.

    You may also wish to upload information, personalise your profile page and share information with others.

    Please note that sometimes we will require you to provide additional personal information. When we do this we will provide further information about why we are collecting your information and how we will use it.

  • Information we receive from others.

    We will receive your information directly from your school / institution in order to provide you with a unique log-in to use the Web Site:

    • For teachers and pupils, information about you will be obtained directly from your School. This comprises your name and staff code or a salted hashed identifier based on the UPN and your class, year and registration group. For learners, this will also include your date of birth.
    • For governors, information about you will be provided by your School. This comprises your first and last name.
    • For other Stakeholder Users, information about you will be provided by the relevant Stakeholder. This comprises your name, organisation and e-mail address.
  • Information we automatically collect about you.

    We automatically collect certain information when you visit one of our websites. This may include technical information, such as the Internal Protocol (IP) address used to connect your computer to the internet, your log-in information, browser type and version, time zone setting, browser plug-in types and versions, operating systems and platform.

    This personal information may be used to ensure the consent from the Web Site is presented in the most effective manner for you and for your computer.

    Please see paragraph 9 'Cookies' below.

4. How we use your personal information

We obtain, store and use information about you so that we can provide you with access to our Web Site, and so that you can enjoy and benefit from the services we offer via our Web Site. How we use your information depends on the reasons why we have collected it.

If you are entitled to access the secure areas of the Web Site, your personal information will be used to create a unique log-in. This will allow you to access the Web Site and to authenticate each browsing session.

In order to set up your unique log-in and authenticate your browsing sessions, information about you may be disclosed to our contractors, including CDSM Interactive Solutions Limited and Microsoft Corporation. This information will be used only to allow you to log in and to authenticate your browsing sessions

We may also use information we hold about you in the following ways:

  • to confirm your identity
  • to provide our services, activities or online content
  • communicate with you
  • notify you of any changes to the Web Site
  • to update and correct our user records
  • to carry out statistical and market analyses, including benchmarking exercises, to enable us to understand you better and improve our services
  • to develop, test and improve our systems
  • to ensure that the content of our websites are presented in the most effective manner for you and for your computer
  • to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
  • to manage event bookings that you make via the Web Site

5. Sharing your information

Keeping your information secure is key to us. Welsh Government does not sell your information to any third party, but in certain limited circumstances and in accordance with this privacy policy, Welsh Government may disclose your personal information to:

  • A third party if Welsh Government is under a duty to disclose or share your personal data in order to comply with any legal obligation, in order to enforce or apply our terms and conditions and other agreements, to protect the rights, property or safety of Welsh Government or others, or to investigate or prevent a crime;
  • Obtain professional advice; and/or
  • To a third party with your consent. In these circumstances you will have a choice as to whether we disclose information about you.

Sometimes we use third parties to process your information on our behalf, for example to provide us with services. We will only do so where we have appropriate contracts in place to ensure that you information remains secure. Third parties include:

  • CDSM Interactive Solutions Ltd – Hwb platform
  • Just2Easy – J2e Toolsuite
  • Microsoft Corporation – Office 365
  • Google – Google for Education
  • Alpha Plus – Online Personalised Assessments

If you register for an event, we will share your personal information with the event organiser (see paragraph 12, below) and with SmartSurvey Limited, who are a contractor providing this service on our behalf.

We may transfer the personal information we collect about you to be stored at a destination outside of the European Economic Area (EEA). It may also be processed by individuals operating outside the EEA who work for us or one of our contractors. To ensure that your personal information is protected we have put in place the appropriate contractual protections and security measures, including encryption, to ensure that your information is treated by those organisations in a way that is consistent with EU and UK data protection laws.

6. Our legal basis for collecting, holding and using your information

Data protection law requires us to tell you the reason for collecting, holding and using your information. There are various lawful bases (or ‘conditions’) which allow us to collect, hold and use your personal information:

  • Where we are processing your personal information for the purposes of undertaking our statutory functions in relation to education.
  • We will sometimes use your personal information based upon your consent. We will always tell you where this is the case and ask you to agree before we process your information. For example, where you agree that your personal information may be viewed by other registered users of our Web Site.

Data protection law recognises certain "special categories" of personal information, which is information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning a person's sex life or sexual orientation. Information relating to criminal offences and convictions is treated in a similar way.

We will only collect and use special categories information where you have given us your explicit consent or where we have a legal obligation to do so.

7. Security and storage of your personal information

Welsh Government has tried to create a secure and reliable Web Site for you. Welsh Government has put in place appropriate organisational and technical safeguards and security measures given the nature of the information. We will take steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

You should note however that e-mail enquiries are transmitted by insecure means and stored off-line. You recognise that the use of the internet and the Web Site is entirely at your own risk. Welsh Government accepts no responsibility or liability for the security of personal information transmitted via the internet.

Personal data that is used for the creation of a Hwb user account will be retained for the period that the account remains active and for 1 year whilst the account is subsequently inactive. After this time, any personal data associated with the creation of a Hwb user account will be deleted, which includes their Microsoft Office 365 account (including OneDrive) and Google for Education (including Google Drive) account. Any personal data that is uploaded to the Hwb platform or its associated services (including SharePoint Online and Hwb Networks) by the individual must have local data retention periods established. This personal data will remain for the duration of the contract with that service provider with transition support being offered in the event of contract termination.

8. Your rights

You have the right to request from us access to your own personal information that we hold. This is sometimes known as a 'subject access request'.

From 25 May 2018, you will have additional rights to request from us:

  • That any inaccurate information we hold about you is corrected (Rectification)
  • That your information is deleted (Erasure)
  • That we stop using your personal information for certain purposes (Objection)
  • That your information is provided to you in a portable format
  • That decisions about you are not made by wholly automated means

Many of the rights listed above are limited to certain defined circumstances and we may not be able to comply with your request. We will tell you if this is the case.

If you choose to make a request to us, we will respond to you within one month. We will not charge a fee for dealing with your request.

If you are dissatisfied with how we are using your personal information or if you wish to complain about how we have handled a request, then please contact DataProtectionOfficer@gov.wales and we will try to resolve any issues you may have.

You also have the right to complain to the Information Commissioner's Office, which is the statutory regulator for data protection law. Details of how to complain to the ICO can be found at https://ico.org.uk/concerns/.

9. Cookies

Like many web sites, Welsh Government uses cookies on the Web Site. Cookies are small pieces of information sent by a web server to a web browser which enables the server to collect information from the browser.

Our cookies collect information relating to your IP address, operating system and about your usage of our Web Site. By continuing to browse the Web Site, you are agreeing to our use of cookies. When you visit our site, we use strictly necessary cookies to enable navigation around the Web Site and provide use of its basic features, such as maintaining your log-in details for the duration of the session. We also use cookies to enhance the functionality of the Web Site by, for example, storing any preferences you enter.

Our Web Site uses Google Analytics, the most widely-used website statistic service. When you visit our site, Google Analytics stores a cookie on your computer or mobile device. This cookie is then used to provide us with usage data, which helps us to improve our users' experience. This means we can count how many people visit this Web Site and analyse which pages are the most popular. In return for the service it provides, Google can access the cookie's stored analytical data. Google does not get access to specific user-identifiable data, such as your name, e-mail address or log in-details, via this Web Site.

You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies; go to the Help menu on the menu bar of your browser, which should provide you with a range of options in respect of cookies. However, if you select this setting you may be unable to access certain parts of the Web Site. Unless you have adjusted your browser setting so that it will refuse cookies, Welsh Government’s system will issue cookies when you log on to the Web Site.

To learn more about cookies you can visit http://cookiecentral.com.

10. Changes to this privacy notice

This privacy notice may be updated from time to time. The latest version will appear here on this page. We will notify you if we make any significant changes to this privacy notice or to the way will collect, hold and use your personal information.

11. Seren Network

Welsh Government is the data controller for the Seren Network.

Information about all members of the Seren Network will be included on a database, which will be made available to all of the hubs within the Seren Network. Each hub is made up of schools, local authorities, further education colleges and regional education consortia.

The Seren Network database is managed by our contractors, CDSM Interactive Solutions Limited. Your information will also be accessible by Future First Alumni Limited, which provides expert support to Welsh Government and the hubs. More information about Future First can be found at http://futurefirst.org.uk/.

We will not disclose your information to any other third party unless we are required to do so in accordance with the 'Disclosure' section of this privacy policy.

Your information will be used for the purpose of inviting you to events, sending you details of how you can get involved, and keeping you up to date with the activities of the Seren Network.

12. Events booking service

Our Web Site provides a booking service for events created and managed by either Welsh Government or another organisation (for example South Wales Grid for Learning, Regional Arts Networks or IntoFilm Cymru). This booking service is operated on our behalf by CDSM Interactive Solutions Limited and SmartSurvey Limited.

If you wish to register for an event, you will need to provide your personal details. If you are an authorised user, this can be done automatically if you are logged in. If you are not an authorised user, you will need to manually enter your details (including your name, email address, the name of your organisation and your location).

Your personal details will be shared with the event organiser in order for them to manage your registration. The event organiser will be responsible for handling your information in accordance with data protection requirements.

13. Contacting us

Should you wish to contact us with regard to this privacy policy, you may do so by:

  • e-mailing us at hwb@gov.wales; or
  • writing to us at Digital Learning Unit, Education and Public Services, Cathays Park, Cardiff CF10 3NQ

Personalised Assessments

As part of our commitment to improving educational standards in Wales, the Welsh Government is phasing in the use of personalised assessments for all learners in maintained schools in Wales.

The Welsh Government has a legal obligation to provide assessment arrangements for reading and numeracy for learners. Personalised assessments provide information on reading and numeracy skills and will be taken by learners via the Hwb website from 2018/19 academic year. School staff will be required to administer the personalised assessments via the Hwb website.

The personalised assessments have been developed by a consortium of partners, lead by AlphaPlus Consultancy Ltd, on behalf of Welsh Government. We will collect the assessment feedback and share with your school.

Trial of Personalised Assessments

Welsh Government will be carrying out a number of trials in which schools will be asked to participate. The purpose of these trials is to support the development of the online personalised assessments. These trials will occur at least twice during a school year and schools will be contacted in advance to request participation.

From the 2018/19 school year, online personalised assessments will be phased in to replace the current paper-based National Reading and Numeracy Tests, starting with Numeracy (Procedural). All pupils in Years 2 to 9 attending maintained schools in Wales will be required to take the online personalised assessments.

Personalised or ‘adaptive’ online assessments are different from traditional tests because the questions are generated based on the learner’s response to the previous question. This provides an individual assessment experience and tailors the level of challenge for each learner. Online personalised assessments, including those in the trials, will be accessed by each learner via their secure log-in to the Hwb platform.

Proposed timelines for the trials:

School year Name of personalised assessment
2018/2019 Reading (English and Welsh)
2019/2020 Numeracy (Reasoning)

The purpose of the trials is to check whether the online assessments are working as intended, and to gain feedback from learners and teachers, before the personalised assessments are rolled out to all schools. The assessments are being developed by a consortium of partners, lead by AlphaPlus Consultancy Ltd, on behalf of Welsh Government.

If your school is taking part in the trial, you will be asked to take an assessment online, using your Hwb log-in details at school. Your teacher will explain how to access the assessment and give you any specific instructions.

Your responses to the trial assessment will be kept confidential and will be used to evaluate the functioning of the online assessments. Your responses will be retained by Welsh Government for 18 months after completion of each trial, after which time the information will be destroyed. For more information on personalised assessments, please see http://learning.gov.wales/resources/collections/national-reading-and-numeracy-tests?lang=en#collection-2.

Last Updated:10/12/2018