Thank you for using Cyfateb, a service provided by Ateb Cyntaf Cyf (Ateb) 

This privacy policy explains what personal data Ateb collects, how we use this data and what rights you have in relation to your personal data as a Cyfateb user. 

You can find information about data processing in connection with Cookies and other tracking technologies when using the Cyfateb website in our Cookie and Tracking policy. 

Contact / Data Controller 

Unless otherwise stated in this privacy policy or in our Cookie and Tracking policy, the controller of your personal data is Ateb Cyntaf Cyf, M-SParc, Menai Science Park, Gaerwen, Ynys Môn , LL60 6AG (hereafter “Ateb”, “us”, “our”, “we”). 

If you have any questions or suggestions about how we use your personal data, please contact us or our data protection officer. 

Our contact details are as follows: 

Ateb Cyntaf Cyf, M-SParc, Menai Science Park, Gaerwen, Ynys Môn , LL60 6AG post@atebcymru.wales  

You can reach our Data Protection Officer on post@atebcymru.wales 

We are registered with the Information Commissioner’s Office (Registration ref: ZB720809) 

Collection, processing and use of personal data 

Personal data is any information relating to an identified or identifiable natural person (e.g., name, address, phone number, date of birth or e-mail address). When we say that we process personal data, this means that we collect, store, use, transfer to others or delete such data. 

Ateb collects and processes your personal data exclusively in the following cases: 

• If you create a Cyfateb profile 

• If you visit us on our website without being a member 

• If you contact us 

• If you subscribe to a service provided by Ateb (paid or free) 

Once you created a Cyfateb profile, a contract is formed and we will provide you with access to your profile. In order to provide you with the Cyfateb service as described in the General Terms and Conditions, we need to use your personal data. 

If you do not want us to use your personal data or parts thereof, we will not be able to provide you with the Service. We will not ask you to provide us with special categories of personal data (i.e. sensitive personal data, such as information about gender or your sexual orientation). Please see below for further information about the types of personal data Ateb collects when you use our Service. 

What personal data do we collect to fulfil the contractual relationship? 

In order to register and create a profile, you will need to provide us with the personal data described below. In addition, in order to provide you with our Services (as fully described in the General Terms and Conditions), we need to process this personal data. 

Registration process 

In order to register for Cyfateb’s free Service (i.e. creating a profile), you will need to provide us with personal data, without which the registration cannot be completed. The data required is: 

• Name 

• Email address  

• Password 

Data required in connection with a Basic Membership 

Our Service works by providing your profile information (“profile”) and your compatibility scores to organisations and companies when your, and, potentially, profiles of others to organisations or companies where profiles are considered to be compatible with posts advertised through Cyfateb. 

In order to get the full benefit of our Service and to set up your Cyfateb profile, we will ask you to provide us with data about yourself for us to establish your profile and to recommend your profile to potential employers (“profile suggestions”).  

Your profile is not publicly visible to other Cyfateb profile holders or to Cyfateb service users. Instead, Cyfateb service users will only have access to extracts of your profile information for the purpose of matching. We will not be able to effectively use or share your profile information if you do not provide us with the requested information, if you do not want to provide us with this information, you will not be able to use our Service. 

The types of data that we will collect during the registration to create a profile are as follows: 

• Residence / postal code 

•  Full name 

• Job seeking status 

• Sector interest 

• Experience 

• Welsh language skills 

• Writing  

• Reading 

• Speaking 

• Listening 

• Preferred working pattern 

• Location 

In addition, you may choose to provide us with additional, non sensitive information such as: 

• CV 

• Professional qualifications 

• Membership of professional bodies 

By giving us this information, you agree that we can store and use this information for matching purposes.  

You may also upload your CV, professional qualifications and membership of relevant professional bodies. You may upload this information to your profile at any time, even after you completed your registration or already used the Service for a period of time. Please note that you do not have to upload this optional information in order to use Cyfateb.  

Communication with us  

Please note that communications between you and us will generally only be conducted via the email address associated with your profile.  

Promotional emails – Messages 

When you create a profile, you must enter your email address, we will use this email address to send you promotional emails relating to relevant opportunities and other free and for-purchase services we provide. 

You can object to our use of your email address for promotional purposes at any time, by:  

(i) clicking on the link in our emails to adjust your email notification settings,  

or (ii) contacting us using the information in the contact section above  

You may re-subscribe to receive such emails in your profile by contacting us using the same information as noted in (ii) above at any time. 

What information do we collect when using our website? 

Every time you access the website, we will collect your usage data. This means that, even if you have created a profile, we will collect and use this information about you. We do this to understand how individuals interact with the website and how we might improve our services. This data is sent to us by your Internet browser and is stored in log files. Please note that each data point listed does not necessarily provide information that would identify you or any natural person. This data includes: 

• Information about your browser type and your internet service provider, as well as your operating system (for example Windows 7, macOS, etc.) 

• The IP address (Internet Protocol address) of the device you use to access our website or Service (for example, your computer, tablet or smartphone). 

• Information about the page that you have accessed 

• The date and time that you used the website 

• The referrer URL (origin URL) from which you came to the page that you have accessed 

• Statistics about the amount of data transmitted during your use of the website 

• Status message as to whether you were successfully able to access the website 

• Session identifier 

• Session participant’s pseudonym 

• Screen resolution used on your device 

Each time a Cyfateb profile holder logs in to our network, we also collect their Cyfateb user identifier. While using the website, and in addition to the data mentioned above, cookies or pseudonym IDs (such as user-ID, ad-ID) may also be stored on your device, when you visit, or after you visited, our online content. You will find specific information about this in our Cookie and Tracking policy. 

Login data 

We also collect the following usage data each time an Cyfateb profile owner logs in to our network (“login records”): 

• Date and time of login 

• User identifier on the Cyfateb platform (your e-mail address) 

• IP address (Internet Protocol Address) 

• Device ID (e.g. UDID) to identify your device for a secured authentication  

What information do we process when you use the Cyfateb platform? 

Part of our Service is matching your profile with job opportunities advertised on our platform (“matches”). These matches are presented to service users via email, with the following limited information: Job seeking status, Sector interest, Experience, Welsh language skills, preferred working pattern, location. 

When your profile matches a job opportunity, you will receive a notification from us by email to alert you, this will include details of the role and information on how to apply. 

Case studies 

We may from time to time, for the purpose of marketing our services, publish success stories in the form of case studies on our website or on other media. 

Your personal data in connection with your success story is processed on the platform or in other media subject to your prior written consent. 

Processing purposes 

We processes the personal data of its users for the following purposes, the legal bases we rely upon are also stated. If data processing is based on the legal basis of a legitimate interest, we have also explained our legitimate interest: 

• To provide the Cyfateb platform and thereby perform our Services as described in our General Terms and Conditions. In particular, this includes: 

• Provision of our website for non-registered users; 

• Ability to contact other users and respond to requests via the platform; 

• Facilitation of the contract, incl. invoicing and contract termination processes; 

• Sending emails regarding matching suggestions or other contractually relevant information. 

(The legal basis of processing is contractual necessity, i.e. to provide you with the services you have asked for from Cyfateb. In some cases, the legal basis is your consent.). 

• For user experience testing  

(The legal basis is our legitimate interest in improving the user-friendliness and enhancing the attractiveness of our website.) 

• To provide a login via the Cyfateb platform 

(The legal basis of processing is contractual necessity.) 

• For purposes of data security (in particular, in accordance with our obligations under the UK GDPR). (We rely on the legal bases of our and our members’ legitimate interest (to ensure data is securely held and used and the Cyfateb service is not misused for contractual and / or illegal actions) and our legal obligation (to ensure system security and the detection and tracking of unauthorised access attempts or accesses)). 

• For the protection and defence of our rights (for example, intellectual property and in the context of legal or regulatory proceedings) and the fulfilment of legal obligations (for example, compliance with finance and tax legislation). 

(The legal basis for these activities is the fulfilment of our legal obligations and our legitimate interest in asserting and defending our rights.) 

• To provide you with services requested via our website, the provision of messaging, and the operation of our website/app.  

(The legal basis here is consent of the individual and PECR Reg 6(4)(b)). 

• For the purposes of sending advertising relating to our own products through promotional emails and/or push messages, newsletters, surveys and personalised guidance.  

(The legal basis is our legitimate interests in relation to sending direct marketing about our own products, and/or your consent; also Art. 22 Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) applies here.) 

• To comply with statutory data retention obligations and other statutory or legal obligations and provisions (e.g. in connection with tax audits, official or judicial orders for information or other purposes).  

(The legal basis is the fulfilment of our legal obligations). 

• For the purpose of considering the advertising objection.  

(Legal basis is the fulfilment of our legal obligations; also Art. 22 PECR applies here.). 

• To answer communications or questions from you.  

(The legal bases are contractual necessity, complying with our legal obligations, and our and our users’ legitimate interests in offering/receiving customer service and improving the customer experience.) 

• To publish case studies on our website and other online and offline channels.  

(The legal basis is your consent.) 

• If applicable, for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1)  

(the legal basis in these cases is UK GDPR Article 9(2)(j) or Article 6(1)(e) in conjunction with Article 6(2)). 

• Sending you service-related emails/messages, including invitations to review our services. For this purpose, we may also contract with and send limited personal information (email, name, and profile reference) to third parties to facilitate sending such emails/messages on our behalf.  

(The legal basis is our contractual relationship and our legitimate interests in managing our relationship and improving our services, which may include sending service communications including asking you, directly or via a service provider, to leave a review or take a survey.) 

You will find the processing purposes and legal basis for the processing of personal data regarding the use of “cookies” and other tracking technologies when using Cyfateb in our Cookie and Tracking policy.  

Legal basis for the processing of personal data 

• Where we obtain your consent as our lawful basis of processing, our legal basis is point (a) of Article 6(1) of the UK General Data Protection Regulation (UK GDPR). 

• Where the processing of special categories of data according to Article 9(1) UK GDPR is required, our legal basis is point (a) of Article 9(2) UK GDPR – your consent. 

• When the processing of your personal data is required to fulfil our contractual relationship (either in relation to Basic Membership or Premium Membership), our legal basis is point (b) of Article 6(1) UK GDPR. This also applies to any processing that is required to carry out any pre-contractual actions. 

• When the processing of your personal data is required to fulfil a legal obligation, our legal basis is point (c) of Article 6(1) UK GDPR. 

• If we store information in your terminal equipment or access such information that is already stored in your terminal equipment, PECR Reg. 6(4)(b) serves as the legal basis. 

• If the processing is necessary to safeguard the legitimate interests of us or a third party, such as our members, and the interests, fundamental rights and freedoms of the data subject do not override those legitimate interests, our legal basis for the processing is point (f) of Article 6(1) UK GDPR. 

• When the processing of personal data is required for our own marketing, the legal basis for the processing is point (f) of Article 6(1) UK GDPR. 

• If applicable, for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) (the legal basis in these cases is Article 9(2)(j) GDPR or Article 6(1)(e) GDPR in conjunction with Article 6(2) GDPR; Art. 6 para. 2 GDPR). 

• If, in exceptional cases, specific personal data are processed for reasons of substantial public interest, Art. 9 (2) (g) GDPR serves as the legal basis. 

When the legal basis for processing is your consent, you are entitled to withdraw your consent at any time. However, this withdrawal will not affect the lawfulness of any processing carried out on the basis of your consent before your withdrawal. If the legal basis is a legitimate interest, you are also entitled, in general, to object to the processing of your personal data, at any time, for reasons arising from your specific situation.  

Transfer of data to third parties; service provider 

We generally only discloses your personal data to third parties: 

• for the provision of the Services to you, 

• if we or the third party have a legitimate interest for disclosing, 

• if we have your consent or, 

• if this is required in order to fulfil a legal obligation. 

If we disclose your personal data to third parties on the basis of a legitimate interest, we will explain the legitimate interest in this privacy policy. 

We may share your personal information within our group of companies, and other entities within our group may also store and/or process your information in accordance with this privacy policy. 

In the following cases, personal data may also be transferred to third parties: 

• to service providers, if the data is required for the fulfilment of their data processing agreement with us; 

• any providers of marketing tracking technologies and analysis tools (you can find out more about this in our Cookie and Tracking policy. 

• where we are obliged to do so by law, including at the request of a regulator or an enforceable official order (e.g., a court order); 

• in connection with legal disputes, debt collections or audits. In these cases, we would share information with the courts and our advisers (e.g., lawyers, chartered accountants or tax auditors); 

• relevant investigating authorities in connection with possible criminal offences (e.g., the police); 

• in the event of the sale of the business, we would transfer personal data to the.  

• If we have your consent, we will share success stories with media outlets and on social media (such as Instagram, Facebook, Twitter and YouTube). 

Insofar as data is regularly transferred to other third parties, this is explained in this privacy policy and/or our Cookie and Tracking policy.. If the transfer takes place on the basis of consent, the explanation may also be provided when obtaining consent. 

Transfers to service providers 

We may use service providers when collecting or processing your personal data. We will ensure that the service provider only receive that portion of your personal data they need for their specific activity. 

We may engage service providers to: 

• send promotional emails and push messages to members. 

• send service-related messages and receive customer review management services (e.g., with Trustpilot) 

• store your information (e.g., cloud-based server providers) 

Unless otherwise stated, the service providers that we appoint are engaged as our processor and they may only use the personal data of our members in accordance with our instructions. 

How do we protect your personal data? 

We use a variety of security measures to protect the security, integrity and availability of our customers’ and users’ personal data. In particular, these measures include the following: 

• Strict criteria for the authorization to access your data 

• The data will be held on a secure webserver in a secure UK based Data Centre managed by HostingUK 

• Firewall protection of IT systems to prevent unauthorised access, 

• Permanent monitoring of access to IT systems to detect and prevent the misuse of personal data. 

Duration of storage; retention obligations 

We store your data for as long as is necessary for the provision of our Service and any associated services or where we have a legitimate interest which permits the further storage of that information. In all other cases, we will erase your personal information once it is no longer necessary, except for any information we need to retain in order to comply with any contractual or statutory (e.g. tax or commercial) retention periods (e.g. invoices). 

Data that is subject to a mandatory retention period is blocked from deletion until the end of that period. 

You can choose to remove the data in your profile at any time. You can also erase your profile data yourself (when you have completed the compatibility quiz) by starting the deletion process in the “Profile Settings” area of your profile. 

If you ask us to do so, we will delete your data, provided there is no legal obligation to retain this data. Please note that if the deletion of your data is prevented due to a mandatory retention period, your data will be blocked and stored for no other purposes, until we can delete it. 

We will also store any personal data which is required to demonstrate that we have lawfully complied with a valid data subject’s rights request within the required period. 

Are you obliged to provide us with personal data? 

In principle, you are not obliged to provide your personal data to us. However, the use of certain services may require the provision of personal data (e.g. registration). If this is the case, we will let you know by marking mandatory data fields with an asterisk (*). If you do not wish to provide the required data, you may be limited in terms of the service provided by Cyfateb. 

Rights of the data subject at a glance 

Under the UK GDPR and data protection laws, you have rights. Whether and to what extent the rights apply may depend upon the circumstances. The rights are: 

Your right to be informed – You have a right to receive concise, transparent, intelligible, and easily accessible information about your personal data and our use of it. 

Your right of access – You have the right to ask us for copies of your personal data. This right always applies but there are some exemptions to its application, which means you may not always receive all the information you have requested. When you request data, this is known as making a data subject access request (DSAR). 

Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances. We have the right to refuse to comply with a request for erasure if we are processing the personal data for one of the following reasons: 

• To exercise the right of freedom of expression and information. 

• To comply with a legal obligation. 

• To perform a task in the public interest or exercise official authority. 

• For archiving purposes in the public interest, scientific research, historical research or statistical purposes. 

• For the exercise or defence of legal claims. 

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances. In such case, we will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing: 

• The accuracy of the personal data is contested. 

• Processing of the personal data is unlawful. 

• We no longer need the personal data for processing, but the personal data is required for part of a legal process. 

• The right to object has been exercised and processing is restricted pending a decision on the status of the processing. 

Your right to object to processing – You have the right to object to processing in certain circumstances. You can also object if the processing is for a task carried out in the public interest, the exercise of official authority vested in you, or our legitimate interests (or those of a third party). 

Your right to data portability – This right only applies if we are processing information based on your consent or for the performance of a contract and the processing is automated. 

If you would like to exercise any of your rights, please contact us at Ateb Cyntaf Cyf, M-SParc, Menai Science Park, Gaerwen, Ynys Môn , LL60 6AG post@atebcymru.wales 

Please also ensure that when you do so, you provide sufficient information to enable us to clearly identify you. 

Right to lodge a complaint with a supervisory authority 

You have the right to file a complaint with a data protection authority, you can contact the UK’s data protection authority, the Information Commissioner’s Office, at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Telephone Number: 0303 123 1113, Email: casework@ico.org.uk. 

Social Media 

In general, if social media plugins are used, the providers of such plugins will store cookies. However, the social media buttons that we use on our website contain only text links to the respective social media pages, they are not properly a social media plugin. Therefore, we will not transfer any data to the respective social media providers. The operator of the social media page is responsible for compliance with data protection law. You can get more information about their data protection practices in their respective privacy policies. 

Cookies & other tracking technologies 

You will find information on cookies and other tracking technologies that are used on our website and in our app in our Cookie and Tracking policy. If personal data is processed in connection with tracking-based processes, you will also find detailed information on the reasons for doing so in that policy, which includes information on how to object to this type of data processing.