How Do We Use Your Data?
South West Wales Reaching Wider Partnership
The South West Wales Reaching Wider Partnership is funded by the Medr Reaching Wider Programme. Our partners are Swansea University, University of Wales Trinity Saint David, The Open University in Wales, Coleg Sir Gâr, Gower College Swansea, Neath Port Talbot College Group, Pembrokeshire College, local authorities and schools in South West Wales.
Swansea University is the lead partner and is responsible for the collection and processing of personal data, including data defined as special category data. As such, Swansea University is the data controller and is committed to protecting the rights of participants in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation. Other partnership members may also act as data controllers where appropriate.
Swansea University has a Data Protection Officer who can be contacted at dataprotection@swansea.ac.uk.
We take the collection, storage and use of personal data very seriously. This notice explains why we collect information about individuals participating in the Reaching Wider programme, how we use and process that information, how it may be shared, and the steps we take to keep it secure.
All personal data collected through Reaching Wider is processed and stored in accordance with applicable data protection legislation.
Use of the Higher Education Access Tracker (HEAT)
Swansea University, on behalf of the South West Wales Reaching Wider Partnership, uses the Higher Education Access Tracker (HEAT), a secure UK-wide database used by universities and partners to record, monitor and evaluate outreach and widening participation activities.
Information about participants may be entered into HEAT for the purposes of:
• monitoring participation in outreach activities;
• evaluating the effectiveness of widening participation programmes;
• supporting research into access to higher education and student success; and
• contributing to sector-wide evidence on equality of opportunity.
This processing is carried out as part of Swansea University's public task and is not used for marketing purposes.
Further information about how participant data is processed within HEAT can be found in the HEAT privacy notice: https://heat.ac.uk/privacy-notice/
Information about how student data is used by the Higher Education Statistics Agency (HESA) can be found at: https://www.hesa.ac.uk/about/regulation/data-protection
What kind of information do we collect?
We collect the following information about participants in our activities to help us confirm that our activities are reaching people from backgrounds that are currently under-represented in higher education:
• name;
• school or college attended;
• date of birth;
• gender;
• home postcode;
• ethnicity;
• disability;
• whether the participant is living in care or has done so in the past;
• whether the participant is a carer for a family member or dependant; and
• where explicit consent is provided, photographs and films that may be used for marketing purposes, such as on our website or in case studies.
For adult participants, we also collect:
• prior education level; and
• email address.
For residential and out-of-school-hours activities, we also collect information about medical and other requirements where this is necessary to provide appropriate support and ensure the health and safety of participants and staff. This may include:
• dietary requirements;
• cultural requirements;
• emergency contact details;
• allergies;
• medical arrangements; and
• medication taken.
What is the legal basis for processing the data?
The work we carry out to promote wider engagement and participation in higher education is undertaken in the public interest. We need to ensure that the funding we receive from government funding agencies is spent appropriately and has a positive impact. In order to measure that impact and conduct our activities, we need to collect and process participant data.
The South West Wales Reaching Wider Partnership processes personal data where this is necessary for the performance of a task carried out in the public interest and for the exercise of its official functions.
The legal basis for processing special category data collected for equal opportunities monitoring is that the processing is necessary for reasons of substantial public interest and for statistical purposes in monitoring equality of opportunity in accordance with the Equality Act 2010. This processing is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between specified groups of people, with a view to enabling such equality to be promoted or maintained.
The legal basis for processing special category data collected for residential and out-of-hours activities is explicit consent.
The legal basis for processing photographs and other material used for marketing communications is explicit consent.
Why we collect individual data and how we use it
We collect and use data about individuals for four main reasons:
1. Monitoring and reporting. This enables us to fulfil compulsory external reporting requirements to regulatory and funding bodies such as Medr, the Commission for Tertiary Education and Research. It also gives us a clear picture of the activities we deliver and the people we work with, helping us to ensure that we are reaching those who could benefit most from outreach activities.
2. Evaluation. This helps us assess the effectiveness of different initiatives designed to widen participation in higher education. This includes the long-term tracking of participants' educational journeys, including through systems such as the Higher Education Access Tracker (HEAT), which enables us to understand how many participants in our activities subsequently enter higher education.
3. Targeting our activities. Information helps us identify people belonging to groups that are under-represented in higher education and, where appropriate, ensure that people from these groups are given priority access to our activities.
4. Health, safety and welfare. Information is used where necessary to ensure the health and safety of participants in our programmes and to assist with pastoral and welfare needs, for example by ensuring that we are aware of relevant medical conditions.
How data is collected and processed
Participant data may be collected in a number of ways, depending upon how an activity is organised and delivered.
Activities involving schools and other organisations
Where Reaching Wider works directly with a school, a form and explanatory information may be sent to parents or carers of participating children via the school, asking for the information required about the participant. The completed information is returned to Reaching Wider via the school and entered into a secure electronic record.
Participants applying directly to Reaching Wider
For activities where participants apply directly to Reaching Wider, such as residential schemes, information may be supplied through a secure online application form or on a paper form returned directly to the Reaching Wider team. Access to this information is restricted to authorised members of the team.
Data collected by our educational partners
Some Reaching Wider activities are delivered by, or in partnership with, our named educational partners. Where this is the case, the educational partner may collect participant information and provide it to the South West Wales Reaching Wider Partnership. This is necessary because Swansea University, as the lead partner, is responsible for monitoring participation across the Partnership and reporting Reaching Wider activity to Medr.
We specify the participant information that our educational partners are required to collect for these purposes. Partners may use a Reaching Wider participant data collection form provided by us or, where appropriate, their own data collection systems or forms, provided that these collect the information required for Reaching Wider monitoring and reporting.
Educational partners are responsible for ensuring that personal data is collected and handled appropriately while it is in their possession, in accordance with applicable data protection legislation and their own data protection policies and procedures. Participant data required for Reaching Wider monitoring, evaluation and reporting is then shared securely with Swansea University as the lead partner and processed for the purposes described in this privacy notice.
Depending on the circumstances and the nature of the activity, a partner may act as a data controller in its own right in relation to information it collects, as well as sharing specified information with Swansea University for the purposes of the Reaching Wider programme.
Storage and access
Password-protected electronic records containing individual participant information are stored within secure Swansea University systems. Access is restricted to members of the Widening Participation team and other authorised users where required.
Information held within relevant databases and systems can only be accessed by designated members of the Widening Participation team and authorised system administrators.
For monitoring, evaluation and research purposes, data may be shared with specified external bodies, such as the Universities and Colleges Admissions Service (UCAS), and may also be processed within HEAT to support the tracking of participants' educational outcomes.
Personal participant data may also be shared securely between Swansea University and educational partners involved in delivering Reaching Wider activities where this is necessary for the delivery, monitoring and evaluation of the programme and for Swansea University, as lead partner, to meet its reporting obligations to Medr.
Internal and external reporting using participant data will normally be undertaken on an aggregate basis, meaning that totals or other summary information are reported rather than information that identifies individual participants.
How long will your information be held?
We recognise that personal information should only be retained where there is a legitimate need to do so and for no longer than is necessary.
Paper-based information will be stored securely and destroyed within one year of the relevant event.
Where participant data is included within the Higher Education Access Tracker (HEAT), it may be retained for periods of up to 15 years to enable long-term tracking and evaluation of educational outcomes.
Data shared or linked with third parties for research purposes will remain within the relevant third-party databases for the lifetime of those projects where individuals are no longer identifiable.
Security of your information
Data protection legislation requires us to keep personal information secure. This means that participants' confidentiality will be respected and appropriate technical and organisational measures will be taken to prevent unauthorised access, loss or disclosure.
Only members of staff who require access to relevant parts or all of an individual's information will be authorised to access it. Information held electronically will be subject to password protection and other appropriate security restrictions, while paper records will be stored securely with controlled access.
Some processing may be undertaken on Swansea University's behalf by an organisation contracted for that purpose. Organisations processing personal data on the University's behalf will be required to process that information in accordance with applicable data protection legislation and the University's requirements.
Where information is collected by an educational partner before being shared with Swansea University, that partner is responsible for maintaining appropriate safeguards for the information while it is in its possession and for transferring the information securely.
What are your rights?
Under data protection legislation, individuals have a number of rights in relation to their personal information. Depending upon the circumstances, these include rights to:
• access personal information held about them, including information held within systems such as HEAT;
• request correction of inaccurate information;
• object to certain processing;
• request restriction of processing;
• request erasure of information; and
• data portability where this right applies.
If you have concerns about the use of your information for these purposes or would like to request a copy of the personal data held about you, requests should be made to the University's Data Protection Officer:
University Compliance Officer (FOI/DP)
Vice-Chancellor's Office
Swansea University
Singleton Park
Swansea
SA2 8PP
Email: dataprotection@swansea.ac.uk
Further questions
If you have further questions about how we collect, use or process participant monitoring data, please contact the Reaching Wider team:
Email: reachingwider@swansea.ac.uk
Telephone: 01792 602 128
How to make a complaint
If you are unhappy with the way in which your personal information has been processed, you may in the first instance contact the University's Data Protection Officer using the contact details above.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Reviewed and Updated: September 2026
Step Up to Swansea University Privacy Notice – Step Up Day/School Visits
Step Up to Swansea University is a widening participation programme funded by Swansea University’s fee and access plan commitments and monitored by Medr.
Swansea University is responsible for the collection and processing of personal data including data defined as special category. As such, Swansea University is the data controller and is committed to protecting the rights of participants in line with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, Swansea University has a Data Protection Officer who can be contacted through dataprotection@swansea.ac.uk
We take the collection, storage and use of personal data very seriously. In this document, you will find an explanation of why we collect individual data as part of the Step Up to Swansea University programme, how we process it and the steps we take to ensure data security at all stages.
All data collected through the Step Up to Swansea University programme is processed and stored in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
What data do we collect?
We will collect the following information:
- School / College attending
- Disability, learning differences and/or mental health conditions
- Whether the young person is a carer
- Whether the young person has a child or child dependent on them
- Whether the young person is estranged (has no contact with their parents)
- Parent/carer experience of Higher Education
- Asylum seeker/refugee status
- Whether the young person has a person dependent upon them
What is the legal basis for processing the data?
The work we carry out to promote wider engagement and participation in higher education is carried out in the public interest. We need to ensure that the money we invest through the fee and access plan is spent appropriately and has a positive impact. To measure impact and to conduct our activities, we need to gather participant data.
The Step Up to Swansea University programme processes personal data as it is necessary for it to perform a task in the public interest and for its official functions.
The basis for processing special category data is public interest. This processing helps to ensure if there is fair treatment and equal chances for different groups of people, so that we can promote or maintain equality. The legal basis for the processing of special category data collected for residential and out of hours activities, is explicit consent.
The legal basis for processing the use of photographs and marketing communications is Consent.
Why we collect individual data and how we use it
We collect data on individuals for the following four reasons.
- For the purposes of monitoring which allows us to fulfil compulsory external reporting requirements to regulatory bodies such as Medr, as well as giving us a clear picture of the activities we deliver and the people we work with to help us make sure we’re reaching those could benefit most from outreach activities.
- For the purposes of evaluation which helps us to assess the effectiveness of different initiatives on widening participation to HE. This includes the long-term tracking of participants’ education journeys, which lets us see how many of those who participate in our activities go on to university.
- To help us identify people who belong to groups that are under-represented in Higher Education and to and ensure that people from these groups are given priority access to our activities.
- To ensure the health and safety of all participants in our programmes and assist with pastoral and welfare needs e.g. ensuring that we are aware of medical conditions.
How data is processed
- Any personal data that is collected by the Step Up to Swansea University team is stored within secured databases, which only the Step Up to Swansea University team have access to. In the case of data collected via paper forms, this is stored in a locked storage and inputted into secure spreadsheets as soon as possible. The paper forms are then securely disposed of. Participant information is visually checked and inputted to our secure online database,
- Information in the database can only be accessed by designated members of Swansea University staff and the central team that manages the online database. For the purposes of monitoring and research only, data may be shared with specific external bodies such as the University and College Admissions Service (UCAS). This allows us to see the Higher Education destination of participants who have taken part in our activities.
- For the purposes of monitoring and research, anonymous data may also be shared with third parties.
- Any internal or external reporting that utilises collected data does so in an aggregate fashion, meaning that only totals are shown so data on individuals is never disclosed.
How long will your information be held?
Information from students will be held 10 years from the date of the event.
Data shared / linked with third parties for research purposes will remain within the third-party databases for the lifetime of the third parties’ projects, as individuals are no longer identifiable.
Security of your information
Data Protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to attempt to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts or all of your information will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.
Some processing may be undertaken on the University’s behalf by an organisation contracted for that purpose. Organisations processing personal data on the University’s behalf will be bound by an obligation to process personal data in accordance with Data Protection legislation.
What are your rights?
You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. If you have any concerns about the use of data for these purposes or would like a copy of the data we hold about you, requests should be made in writing to the University Data Protection Officer:
Email: dataprotection@swansea.ac.uk
Further questions?
If you have further questions about how we process individual monitoring data, please feel free to get in touch stepup@swansea.ac.uk
How to make a complaint
If you are unhappy with the way in which your personal information has been processed, you may in the first instance contact the University Data Protection Officer using the contact details above.
If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted here
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Step Up to Swansea University Privacy Notice – Residential Programme
Step Up to Swansea University is a widening participation programme funded by Swansea University’s fee and access plan commitments and monitored by Medr.
Swansea University is responsible for the collection and processing of personal data including data defined as special category. As such, Swansea University is the data controller and is committed to protecting the rights of participants in line with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, Swansea University has a Data Protection Officer who can be contacted through dataprotection@swansea.ac.uk
We take the collection, storage and use of personal data very seriously. In this document, you will find an explanation of why we collect individual data as part of the Step Up to Swansea University programme, how we process it and the steps we take to ensure data security at all stages.
All data collected through the Step Up to Swansea University programme is processed and stored in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
What data do we collect?
On application for the programme, we will collect the following information:
- Contact details (including address, email and phone number)
- Disability, learning differences and/or mental health conditions
- Receipt of EMA/ Free School Meals/ Welsh Government Learning Grant
- Whether the young person has been in care or is currently in care
- Whether the young person is a carer
- Family experience of Higher Education in the UK
- Parental level of education and employment status
- Asylum seeker/refugee status
- Welsh language proficiency
- Photographs and Film – Which we use for marketing purposes
- Whether the young person has a child or child dependent on them
- Whether the young person is estranged from their parents.
If successful in gaining a place on the programme we will also collect the following:
- Details of medical conditions and medication
- Details of criminal convictions or current investigations
- Consent to contact parents/guardians about attendance
What is the legal basis for processing the data?
The work we carry out to promote wider engagement and participation in higher education is carried out in the public interest. We need to ensure that the money we invest through the fee and access plan is spent appropriately and has a positive impact. To measure impact and to conduct our activities, we need to gather participant data.
The Step Up to Swansea University programme processes personal data as it is necessary for it to perform a task in the public interest and for its official functions.
The basis for processing special category data is public interest. This processing helps to ensure if there is fair treatment and equal chances for different groups of people, so that we can promote or maintain equality. The legal basis for the processing of special category data collected for residential and out of hours activities, is explicit consent.
The legal basis for processing the use of photographs and marketing communications is Consent.
Why we collect individual data and how we use it
We collect data on individuals for the following four reasons.
- For the purposes of monitoring which allows us to fulfil compulsory external reporting requirements to regulatory bodies such as Medr, as well as giving us a clear picture of the activities we deliver and the people we work with to help us make sure we’re reaching those could benefit most from outreach activities.
- For the purposes of evaluation which helps us to assess the effectiveness of different initiatives on widening participation to HE. This includes the long-term tracking of participants’ education journeys, which lets us see how many of those who participate in our activities go on to university.
- To help us identify people who belong to groups that are under-represented in Higher Education and to and ensure that people from these groups are given priority access to our activities.
- To ensure the health and safety of all participants in our programmes and assist with pastoral and welfare needs e.g. ensuring that we are aware of medical conditions.
How data is processed
- Any personal data that is collected by the Step Up to Swansea University team is stored within secured databases. In the case of data collected via paper forms, this is stored in a locked storage and inputted into secure spreadsheets as soon as possible. The paper forms are then securely disposed of . Participant information is visually checked and inputted to our secure online database, Information in the database can only be accessed by designated members of Swansea University staff and the central team. For the purposes of monitoring and research only, data may be shared with specific external bodies such as the University and College Admissions Service (UCAS). This allows us to see the Higher Education destination of participants who have taken part in our activities.
- For the purposes of monitoring and research, anonymous data may also be shared with third parties.
- Any internal or external reporting that utilises collected data does so in an aggregate fashion, meaning that only totals are shown so data on individuals is never disclosed.
How long will your information be held?
Information from students who apply but are unsuccessful will be held for 3 months. Information supplied by students who do gain a place on the programme will be held for 15 years from the commencement of the programme.
Data shared / linked with third parties for research purposes will remain within the third-party databases for the lifetime of the third parties’ projects, as individuals are no longer identifiable.
Security of your information
Data Protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts or all your information will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.
Some processing may be undertaken on the University’s behalf by an organisation contracted for that purpose. Organisations processing personal data on the University’s behalf will be bound by an obligation to process personal data in accordance with Data Protection legislation.
What are your rights?
You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. If you have any concerns about the use of data for these purposes or would like a copy of the data we hold about you, requests should be made in writing to the University Data Protection Officer:
Email: dataprotection@swansea.ac.uk
Further questions?
If you have further questions about how we process individual monitoring data, please feel free to get in touch stepup@swansea.ac.uk
How to make a complaint
If you are unhappy with the way in which your personal information has been processed, you may in the first instance contact the University Data Protection Officer using the contact details above.
If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted here
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
