Estyn and Dysgu Joint Reading Conference Privacy Notice

This privacy notice explains how Estyn and Dysgu, each a public body, (collectively referred to as the “Controllers”), will collect and use your personal data when you register for, attend, or otherwise take part in the joint reading conference taking place on 17 February 2027 (the “Event”).

This notice is provided in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (“Data Protection Law”).

This privacy notice was last updated in June 2026.

Who is responsible for your personal data?

The Controllers are joint data controllers for the personal data collected for the purposes of organising and delivering the joint reading conference.

This means that the Controllers jointly decide why and how your personal data is used for the Event, and will only use it for that joint purpose. The Controllers have agreed with each other their respective responsibilities to comply with Data Protection Law, including how personal data is collected, and how individuals can exercise their data protection rights. You may contact either of the Controllers with any questions or complaints about the collection or use of your personal data, or exercise your rights under Data Protection Law. The contact details for you to do so are provided below.

The Controllers will use a third party event management company called Cazbah Ltd (“Cazbah”) to help support the Event registration. Cazbah may contact you directly in relation to the Event, and is acting as a data processor on behalf of the Controllers. Cazbah will process personal data only as directed by the Controllers – which is limited to being as necessary to support the Event.

What personal data do we collect?

We collect personal data from you when you sign up for the Event (such as through the conference registration form), and through certain related Event administration processes. We may also collect personal data from you when you attend the Event.

The personal data we may collect from you includes:

  • Identity information:
    • title;
    • first name and surname;
    • job title or organisation, where provided;
  • Contact information:
    • email address;
    • contact telephone number;
  • Event requirements:
    • language preference;
    • dietary requirements, including allergies;
    • accessibility requirements or other support needs;
  • Event attendance information
    • attendance and registration information;
    • any other information you choose to provide in connection with your attendance.
  • Event images
    • Photographs and videos of you at the Event.

Some information you provide, such as accessibility requirements, allergies or dietary requirements, may reveal or contain special category data about you, including information about your health or disability, or where you provide this information, your religion or beliefs. As set out below, we will collect and process this special category data with your consent.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. 

Members of our communication teams will be taking photographs and videoing elements of the Event (“Event Images”). The Event Images may incidentally capture your image, or you may intentionally be captured within an Event Image (for example, if you pose for a photograph, or choose to participate in a video). We will ensure that there is clear signage at the Event that indicates that photographs and videos may be taken. These Event Images may be used by the Controllers to promote the Event during and after the Event, and to share key messages consistent with the purposes of the Controllers. Individuals who do not wish to appear in Event Images can inform a member of staff onsite.

How is your personal data collected?

We, or a third party on our behalf (such as Cazbah) may collect personal data from or about you through the following:

  • From you directly: for example, when you register or attend the Event, or provide us (or Cazbah) information directly.
  • Through your organisation: including through individuals on behalf of your organisation, for example, when your organisation provides your personal data to us so that we can contact you about the Event.

Where we collect your personal data through your use of the conference's website, this privacy policy will apply. 

Why do we use your personal data?

The Controllers will use your personal data for the following purposes:

Before the Event:

  • to manage your Event registration;
  • to communicate with you about the Event;
  • to make arrangements for attendance, access, language preference, dietary requirements and accessibility needs when you attend the Event;

During the Event:

  • to manage attendance on the day of the Event;
  • to support the safe and effective running of the Event;
  • to respond to enquiries about the Event;

Following the Event:

  • to evaluate and improve the Event, once it has completed;
  • to promote the Event and the key purposes of each of the Controllers; and
  • where you have chosen to receive them, to send you future updates about relevant Estyn or Dysgu programmes, events or developments.

What is our lawful basis for using your personal data?

Before the Event and During the Event

  • Article 6(1)(e) of UK GDPR: Necessary to perform the task of an official authority.
    • For information we collect before and during the Event, for registration and administration or management purposes (both before and during the Event), the Controllers rely on Article 6(1)(e) of UK GDPR: that the processing is necessary for the performance of a task carried out in the public interest and/or in the exercise of official authority vested in each of the Controllers.
    • This purpose includes processing personal data where necessary to organise and deliver events connected with our public functions.
  • Article 9(2)(a) of UK GDPR: consent for special category data
    • Where the Controllers collect information that may reveal special category data (such as accessibility requirements), we rely on Article 9(2)(a) of UK GDPR, as you have given explicit consent for us to collect and process this information for the purpose of making appropriate arrangements to support your attendance at the Event.

Following the Event:

  • Article 6(1)(e) of the UKGDPR: consent
    • Where you choose and consent to receive future updates from Estyn and Dysgu, we rely on Article 6(1)(a) of the UKGDPR: that you have given your consent for the processing of your personal data for a specific purpose.
    • In such circumstances we will use your contact details for that purpose only where this is permitted by data protection and electronic communications rules.
    • You can withdraw your consent or opt out of receiving future updates at any time.
  • Article 6(1)(f) of the UKGDPR: legitimate interest
    • For Event Images that include your personal data that we use during and following the Event, we rely on Article 6(1)(f) of the UKGDPR: that the use of such personal data is necessary for the purpose of the legitimate interests that are pursued by the Controllers, and that these legitimate interests are not overridden by the interests or fundamental right and freedoms of the data subject.

Who will we share your personal data with?

We may also share relevant personal data with:

  • Cazbah to support event registration and event management on behalf of the Controllers;
  • the event venue and other third parties who help facilitate or provide services as the event, where necessary for attendance, catering, accessibility, health and safety, or other logistical arrangements (the “Event Partners”); and
  • other certain third parties that we engage to help process the personal data for the purposes we have set out above.

Where we share your personal data, we will only share the minimum personal data necessary for these purposes. We do not allow any third party to use your personal data for their own purposes, and require all third parties to respect the security of your personal data and treat it in accordance with law.

How do we keep your personal data secure?

The Controllers any other third party processor that the Controllers engage will use appropriate technical and organisational measures to protect your personal data.

If we, or any processor that we engage suffers a data breach that impacts your personal data and which we are required by Data Protection Law to notify you of, Estyn and/or Dysgu will notify you, and the Information Commissioner’s Office directly.

Where is your personal data stored?

Your personal data will be stored securely in approved information syste cams used by Estyn, Dysgu or their authorised processors. Your personal data will only be transferred outside of the UK or EU if there are appropriate protections in place to ensure that it is protected in line with Data Protection Law.

How long will we keep your personal data?

Personal data that is collected for Event registration and administration will be kept for 6 months after the Event, unless a longer period of retention is required for legal, audit or complaint-handling purposes. Photographs and videos captured at the event will be retained in line with Estyn and Dysgu's respective retention period.

If you opt in to receive future updates from Estyn and Dysgu, your contact details will be kept for that purpose until you unsubscribe, ask us to remove you, or the mailing list is reviewed and your details are no longer required.

Your data protection rights

Under Data Protection Law, you have rights in relation to your personal data. These include the right to:

  • be informed about how your personal data is used;
  • request access to your personal data;
  • ask for inaccurate personal data to be corrected;
  • ask for your personal data to be erased in certain circumstances;
  • object to or restrict processing in certain circumstances;
  • withdraw consent, where we rely on consent;
  • request data portability in certain circumstances; and
  • complain to us about our collection or use of your personal data, or to the Information Commissioner’s Office.

Your rights may depend on the lawful basis for processing and the circumstances of the request.

How to contact us

For further information about how your personal data is used, make any complaint to us, or to exercise your rights, please contact:

Estyn:

Data Protection Officer
Estyn
Anchor Court
Keen Road
Cardiff
CF24 5JW
Enquiries@estyn.gov.wales
029 2044 6446

Dysgu:

Dysgu
Fourth Floor North
Crown Building
Cathays Park
Cardiff
CF10 3NQ
posy@dysgu.llyw.cymru

How to contact the Information Commissioner’s Office

While we and the Information Commissioner’s Office would prefer that you contact us directly with any complaints or questions about how we collect or process your personal data, you can also contact the Information Commissioner’s Office, the UK’s independent regulator for data protection directly:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 029 2067 8400 (Wales helpline)/ 0303 123 1113 (UK helpline)
Website: ico.org.uk