Disability Sport Wales Privacy Notice

Updated June 2025

Introduction
1. Your Information: Where does it come from?
2. Your information: What do we ask for, what will we use it for, and why are we can ask for it?
3. Who do we share your information with?
4. International Transfer of Your Information
5. How Long Do We Keep Your Information For?
6. Individual rights

Introduction

This Privacy Policy applies to all DSW employees, trustees, tutors, volunteers, consultants, work experience/ placement students, and coaches within Disability Sport Wales programmes.

Your privacy is extremely important to us, so we want you to know exactly what kind of information we obtain about you and how we use it.

Everything included within this Privacy Notification was written so as to be compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (2018). See Appendix at the end of this page for further detail.

Disability Sport Wales commits to:

respect and look after all the personal data you share with us or is shared with us by other organisations.
always keep personal data as safe as possible.
be clear when we collect your data about what we’ll use it for, and not do anything you wouldn’t reasonably expect us to do with it
never sell your personal data to other organisations, and will only ever share it in appropriate, legal or exceptional circumstance

We have set out all the details below.

Please take the time to read and understand this policy, if you would like us to provide this information in an alternative, more accessible format, please contact us on 0300 300 3115 or email office@disabilitysportwales.com

1. Your information: Where does it come from?

As an employee, trustee, tutor, volunteer, consultant, work experience/placement student, or coach within Disability Sport Wales we will ask you to provide certain personal information relating to you either just before you start working for us, or whilst you are working with us.

By ‘working’ we mean something you either get paid for, or do as a valued volunteer, on our behalf. We will normally get information from:

You
Examples:
- a registration form, or an application form which might be on our website (and you fill in or download), or
- something that you ask us to send to you when you call, email or text us
- information you give us when you volunteer or are paid to be part of an event we support (insport series event, conference, etc)
- responding to a survey we send out and you respond to
Another person or organisation
Examples:
- your last employer in a reference (if you have applied to work for us),
- from a background check agency (like the Disclosure and Barring Service (DBS)), or
- from an independent event organiser (who you have given your permission to share your data with us. Make sure you check their Privacy Policy, so you understand how they will share your data)
- another NGB or partner who you have given permission to share your information with us
Our website or Apps (‘Sites’)
Examples
- Cookies on our website (these are small text files that Sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier, but also tells us what type of device you’re using, and depending on the settings it may provide us with information including what type of device it is, the operating system, your device settings, and why a crash has happened. This information helps us understand how people are using our website and how to make it better.
Public information
Examples:
- Company’s House or the Charities Commission websites
- information which has been published in a newspaper or article

2. Your information: What do we ask for, what will we use it for, and why are we can ask for it?

We will only ever ask for information that we need to provide the service, information or administration you have requested.

If we collect or use information from children, we will always seek to do it in a way which is appropriate to the age of the child. If a child is under 16 we will ask for consent from a parent or guardian before collecting their information.

If we are collect or use information from an adult at risk, and that individual has capacity, we will ensure that information about why we need the information and how it will be used is provided in Easy Read format. If the individual does not have capacity we will engage with their advocate and/or personal assistant.

Under data protection law we need to have a valid legal basis for using your personal information, so we have set out what we will use your information for, and the legal bases that we will be relying upon in the following tables:

Table 2.1: Providing Basic Information

If we ask for:
your name, address, contact telephone number(s) and email address your education and qualifications information about what sport you are involved with, how, where and how often your skills, experience and membership of professional bodies your emergency contact details
We will use it:
to comply with and enforce our contract with you and inform you of any changes to deal with any disciplinary and grievance issues which may arise relating to you, or about which you might be able to provide relevant information for general deployment administration purposes The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for the performance of the contract between us.
to comply with and demonstrate compliance with our legal obligations and best practice as an organisation (employer or charity) to comply with and demonstrate compliance with any regulatory requirements The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for us to do so to comply with our legal obligations
to monitor compliance with any of our policies and procedures In this case the legal basis that we will be relying upon to process your personal information will be because it is in our legitimate interests. Our specific legitimate interests are: to be a fair and reasonable employer in relation to your employment/engagement and our employment/engagement of others and be able to demonstrate this, and/or to comply with and demonstrate compliance with our obligations as an employer and/or our policies and procedures relating to employee, trustee, volunteer, consultant, work experience/placement student, or coach. to understand what the profile of people involved with disability and para sport is across Wales so that we can make inclusive change happen.

Table 2.2: Providing Recruitment Information

If we ask for:
information provided from your previous employer(s) and other referees your employment history your working terms and conditions (e.g. pay, hours of work, holidays, benefits) details of any other offices or appointments or business interests you hold any accidents connected with work any training undertaken any disciplinary, grievance or other issues relating to your employment any other personal information you share with us, including lifestyle and social circumstances
We will use it:
to comply with and demonstrate compliance with our legal obligations and best practice as an organisation (employer or charity) to comply with and demonstrate compliance with any regulatory requirements The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for us to do so to comply with our legal obligations
to monitor compliance with any of our policies and procedures to provide references In this case the legal basis that we will be relying upon to process your personal information will be because it is in our legitimate interests. Our specific legitimate interests are: to be a fair and reasonable employer in relation to your employment/engagement and our employment/engagement of others and be able to demonstrate this, and/or to comply with and demonstrate compliance with our obligations as an employer and/or our policies and procedures relating to employee, trustee, volunteer, consultant, work experience/placement student, or coach. to understand what the profile of people involved with disability and para sport is across Wales so that we can make inclusive change happen.

Table 2.3: Providing information for Paid Work

If we ask for:
your date of birth your National Insurance number and tax code your bank details your pension details evidence of ability to work in the UK
We will use it:
to pay you and provide you with any benefits you are entitled to to deal with any disciplinary and grievance issues which may arise relating to you, or about which you might be able to provide relevant information to record your absences and leave from work to review and manage your performance and development The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for the performance of the contract between us.
to comply with and demonstrate compliance with our legal obligations and best practice as an organisation (employer and/or Charity) to comply with and demonstrate compliance with any regulatory requirements The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for us to do so to comply with our legal obligations.
to monitor compliance with any of our policies and procedures to provide references In this case the legal basis that we will be relying upon to process your personal information will be because it is in our legitimate interests. Our specific legitimate interests are: to be a fair and reasonable employer in relation to your employment/engagement and our employment/engagement of others and be able to demonstrate this, and/or to comply with and demonstrate compliance with our obligations as an employer and/or our policies and procedures relating to employee, Director, volunteer, consultant, work experience/placement student, or coach. to enable us to respond to reference requests.

Table 2.4: Providing information for Voluntary Work (unpaid)

If we ask for:
your name the club you volunteer, or company you work at your experience as a coach/ volunteer/official the sport you deliver
We will use it:
to comply with and enforce our contract with you and inform you of any changes The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for the performance of the contract between us.
to comply with and demonstrate compliance with our legal obligations and best practice as an organisation (employer and/or Charity) to ensure we undertake our duty of care to individuals you may be coaching/working with, and ensure compliance with our insurance schedule The legal basis that we will be relying on to process this type of personal information in these cases will be because it is necessary for us to do so to comply with our legal obligations.
to monitor compliance with any of our policies and procedures to provide references (if requested) In this case the legal basis that we will be relying upon to process your personal information will be because it is in our legitimate interests. Our specific legitimate interests are: to be a fair and reasonable employer in relation to your employment/engagement and our employment/engagement of others and be able to demonstrate this, and/or to comply with and demonstrate compliance with our obligations as an employer and/or our policies and procedures relating to employee, Director, volunteer, consultant, work experience/placement student, or coach. to understand what the profile of people involved with disability and para sport is across Wales so that we can make inclusive change happen. to enable us to respond to reference requests.

Table 2.5: Providing Special Category Personal Data

We use the special category personal data we hold about you for a number of different purposes, which we list below. Data protection law prohibits us from processing any special category personal data unless we can satisfy at least one of the conditions laid down by data protection law. We also set out below the specific conditions we rely upon when processing special category data.

We will not otherwise process your sensitive or special category information unless you have given us explicit consent to do so. We do not carry out any automated decision-making or profiling in relation to you.

If we ask for:
racial or ethnic origins religious or philosophical beliefs physical or mental health sexual orientation details of disability/impairment any reasonable adjustment(s) made (or which could be made) to your role or your work under the Equality Act 2010 commission or alleged commission of any offence
We will use it:
to monitor equality and diversity. In this case the condition we rely on for processing the information is to monitor equality and diversity which is necessary for reasons of substantial public interest. DSW are a diverse employer and seek to deliver to all disabled people across Wales. We therefore review the diversity data so as to ensure equity in employment practices and to ensure we take the right action to widen delivery in areas where this is needed. This data is always anonymised and separated from any other information you may send to us.
to comply with and demonstrate compliance with employment law and best practice (or any other applicable laws) to comply and demonstrate compliance with any regulatory requirements to deal with any disciplinary and grievance issues which may arise relating to you or in respect of which you may be able to provide relevant information In these cases, the condition we rely on for processing the information is because it is necessary for the purposes of carrying out our legal obligations (e.g. complying with employment law). Processing may also be necessary for the establishment, exercise or defence of legal claims or to ensure your working capacity is maximised.

3. Who do we share your information with?

Your personal data will be held by the most appropraite officer or manager within Disability Sport Wales (Record holders are detailed in the DSW Data Retention Schedule). Your personal data will be shared internally with other individuals and/or departments where this is reasonably necessary for the processing purposes set out in section 2 above. For example, it will be necessary to share some of your personal information with our payroll processors in order to pay you expenses or for work you have done on our behalf.

From time to time we will need to share your information with external people and organisations. We will only do so where we have a legitimate or legal basis for doing so and in compliance with our obligations under data protection laws.

Your information may be disclosed to:

Her Majesty’s Revenue and Customs (HMRC) in connection with your pay and benefits
Banks and other financial institutions (Barclays) in connection with your pay and benefits
Pensions providers (Scottish Widows or your private pension provider) for providing and administering your pension
Payroll provider (Accountability Accountants) to enable us to pay you
Other people who help us provide our website, in-house WIFI network, they include information technology experts who design and host our website (Krystal, Kew Consulting, Pinnacle TeleCommunications, Sport Wales Technology Solutions)
Our insurers and insurance brokers (Howdens) who provide us with comprehensive cover against the risks of running a business
Professional bodies and regulators such as The Charity Commission or Companies House
Our professional advisors including our accountants (H1 Financial Management), Auditors (Azets), Solicitors (Dolmans), HR Company (Ashton People Solutions) or PR Company (LloydBell Productions) when they need it to give us their professional advice
Occupational Health and other medical professionals including social and welfare organisations to provide us with medical opinions in relation to any medical condition, illness or disability you may have or develop during the course of your employment/engagement (Department for Work and Pensions)
The Police, local authorities, the courts and any other government authority if they ask us to do so (but only if us doing so is lawful).
Disclosure and Barring Service (DBS) in the case of employment or volunteering where direct contact with children or adults and risk may occur.
Other people who make a subject access request (where we are allowed to do so by law).
Complainants (where this is necessary to respond to any complaints received)
Where we are legally obliged to do so, e.g. to comply with a court order
Prospective employers in response to reference requests
Educational establishments, examination bodies, course providers in relation to any training you undertake or have undertaken
Your family or representatives
Other Sports Governing Bodies in Wales and perhaps the UK in relation to coaching, participating, competing or volunteering

Specific Programmes and Events

There may be occasions where we need to share your information with third party organisations who are directly involved in a specific programme or event.

For example:

Personal information shared with Disability Sport Wales via the Health Disability Activity Pathway is shared with NHS Wales and Welsh Local Authorities, for the purposes of being able to support a service user's access to and discovery of local, appropriate sport and physical activity opportunities, and for following up with service users about their experience with the Health Disability Activity Pathway.
Personal information shared with Disability Sport Wales for attendance at live events, including insport Series and Para Sport Festival events, may be shared with event venues and delivery partners including national governing bodies (NGBs) representing attending sports, and event sponsors.

4. International Transfer of Your Information

We do not knowingly transfer any of your personal data outside the European Economic Area. There may be occasions where it is necessary to share your information with international organisations (e.g. when you are travelling to an international competition or event) on these such occasions we will only do this with your involvement.

5. How Long Do We Keep Your Information For?

To make sure we meet our legal data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it in the first place.

Please refer to the DSW Data Retention Schedule for further detailed information.

6. Individual rights

Data protection legislation provides individuals with several different rights in relation to their data. For example, you have the right to ask us whether we hold information about you and if so, for us to give you certain details about that information and/or the information itself. This right is commonly known as a “subject access request”. Certain exemptions and conditions apply to this right.

There are other rights which you also may be able to exercise, such as the right to have inaccurate personal data rectified, to object to the processing of personal data, to object to direct marketing, to the erasure of personal data or to have the processing of your personal data restricted as well as the right to have electronic data made portable. All these rights are subject to certain conditions and exemptions.

If you wish to exercise any of these rights or obtain further information about these rights please contact Charlene Stephens:

temail charlene.stephens@disabilitysportwales.com

7. Automated Decision Making

We do not carry out any automated decision making in providing Disability Sport Wales services.

Appendix: The GDPR and Data Protection Act (2018)

Any personal data, special category data and criminal offence data that we process about individuals is done so in accordance with one or more of the following of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (DPA 2018):