Data Protection Policy
This page outlines how the Lord Edmund-Davies Legal Education Trust (the Trust)processes and manages personal data. It:
identifies our data controller/s;
provides our lawful basis for processing personal data;
outlines the scope of personal data we hold and process;
outlines the scope of the special category personal data we hold and process;
describes and justifies our data retention policy;
shows how we intend to respond to Subject Access Requests; and
contains a copy of our privacy notice.
The policies outlined within this document come into full effect on Friday 25th May 2018.
1. Data Controller
The Data Controller/s are the trustees of the Lord Edmund-Davies Legal Education Trust (“the Trustees”).
2. Lawful basis for processing
Personal data of applicants, parents/guardians and teachers, contained in applications to our Summer Schemes, are processed primarily under the lawful bases of legitimate interest and consent. Our legitimate interests are to provide applicants with the opportunity to gain a place on the Schemes and to make selection decisions. Any personal data maintained once a student is accepted on any of the Trust's schemes is processed under the lawful basis of consent and/or legitimate interest. It does not fall within the definition of direct marketing. Our legitimate interests are to ensure that the Schemes run smoothly; that we provide adequate support for participants; that we can offer support and opportunities to Scheme alumni and encourage alumni to help future Scheme participants
Any personal data maintained regarding persons who help with our schemes is processed under the lawful basis of consent and/or legitimate interest. Our legitimate interest is to ensure that the schemes run smoothly and that helpers have any information and support they need.
Personal data maintained regarding persons who donate to the Trust is processed under the lawful basis of consent. It does not fall within the definition of direct marketing
We undertake to always act within the reasonable expectations of our students, alumni, helpers, donors and any other individual about whom we hold personal data.
3. Data we hold
As of 25th May 2018, the Trust holds information on applicants to our schemes, alumni, parents/guardians and teachers of applicants, donors and helpers; and from January 2019, school contacts, where they have opted-in to our information dissemination.
All the information has been supplied by the data subject, or, in the case of applicants to Schemes, by their parents/guardians and teachers. Personal data is stored either electronically and/or in paper form.
This information predominantly consists of, but is not limited to:
Names, addresses and email addresses.
Date of birth (applicants to Summer Schemes only).
Bank details (donors only)
Special category data, outlined in point 4.
The Trust uses databases of the persons on whom it holds information to send out ad hoc newsletters to keep them informed on matters about the Trust, and to send out information on upcoming events or opportunities related to the Trust. Personal data we hold in this regard includes:
Names, addresses and email addresses.
This information is not products or services for sale and therefore it is not categorised as direct marketing.
4. Special category data we hold
The Trust also holds special category data for a smaller number of data subjects, the applicants to the Summer Scheme* and donors**. This data will be processed under the lawful basis of legitimate interests and/or explicit consent. The relevant condition under Article 9 of the General Data Protection Regulation (EU) 2016/679 is that the Trust is a not-for-profit body. The special category data we hold relates to:
Race and ethnic origin: this optional information is used to monitor the numbers of applications and successful candidates from different ethnic groups. This information is not taken into account in the selection process.
Physical and mental health* (only successful applicants to the Summer Schemes - and only retained until the end of the month in which the Summer Schemes fall); this is collected and held in order to enable us to provide any necessary support for students selected for Summer Schemes.
Bank details** (donors only).
5. Data retention policy
Our office will hold personal data from applications for no longer than 18 months.
Personal data from donors will be held during the period of the donation, if it is annually; and during the relevant accounting period in the case of one-off donations.
Personal data from successful applicants (but not the physical and mental health data) who become alumni on completion of the summer scheme will be held as part of our ‘alumni scheme’ as a continuing on-going interest in the Trust. Thus, from 25th June 2018, we will only hold data on successful alumni as a continuing ongoing interest in the trust.
6. Subject Access Requests
The Trust will comply with Subject Access Requests in line with the guidance given by the Information Commissioner’s Office (ICO).
You have the right to request a copy of the information that we hold about you. You also have a number of other rights in relation to this information. These are listed below, in the Privacy Notice.
The Trust will respond to any request as quickly as possible, within 30 calendar days.
The Trust will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
7. Privacy Notice
The Trust will ensure that all persons sharing their personal data have the opportunity to read our privacy notice. The Trust will:
Publish our privacy notice on our website,
Add a link to our privacy notice to our LEDLET application forms, emails and letters.
Direct persons who contact us via letter and telephone to our privacy notice online, or supply them with a paper copy if needed.
This privacy notice relates to the personal data processed by the Lord Edmund-Davies Legal Education Trust (the Trust), a charity registered with the Charity Commission: Registered Charity Number: 1168785, in relation to applications to our schemes, students, alumni, donors, helpers, and school contacts.
Who is the Data Controller?
The Data Controller/s is/are the Trustees.
What does the Trust do?
The Trust aims to ensure that all young people in Wales have an opportunity to at least consider the possibility of a career in the law, whether as a solicitor, barrister or legal executive; it proposes to provide educational experiences that will encourage and support those drawn to such careers in their efforts to pursue them; in furtherance of these aims the Trust runs a Summer Schemes, in London and Cardiff, Judicial Mentoring in Wales, bursary competitions, assistance with further work experience, and events, to bring our alumni together, inter alia.
In doing so, the Trust processes personal information, sends out newsletters, updates and invitations, as well as encouraging donations from individuals, for the fulfilment of the aforesaid aims.
How do we process data?
The Trust processes personal data of applicants to the Summer Schemes, and their parents/guardians and teachers, as well as of donors to the Trust and Scheme helpers, under the lawful basis of legitimate interest. In instances where this lawful basis is not sufficient and explicit consent is required, it is requested on the application forms, or, in other instances, you will be contacted to establish your consent.
We are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.
Will we share your data with anyone else?
We only share the personal data of applicants to the Summer Schemes with official representatives of Legal Wales for the purposes of administering the Schemes. We do not share your data with anyone else without your consent. Legal Wales, and any third parties that we share your data with (with your consent) are obliged to keep your details securely, and to use them only for the basis for which they were originally intended. When they no longer need your data to fulfil this purpose, they will dispose of the details in line with our procedures.
In any case, we will not use your personal data in a way that goes beyond your reasonable expectations in contacting us.
For how long will you keep my personal data?
Scheme applicants, or parents/guardians/teachers of applicants: no longer than 18 months from the end of the relevant Scheme (but applicants can request longer retention of their own data).
Alumni: on a continuing on-going basis
Donors: for the duration of annual donations; and for the relevant accounting period for one-off donations
Helpers: whilst you continue to be a helper of the Trust.
What rights do I have to my personal data?
At any point while the Trust is in possession of or processing your personal data, you, the data subject, have the following rights:
Right to be informed – you have the right to be informed about the collection and use of your personal data, the details of which are outlined in this privacy notice.
Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – you have a right to have the data we hold about you erased from our records, unless there are legal reasons why we cannot do this.
Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing, such as direct marketing.
Right to judicial remedy: if the Trust refuses your request to exercise any of your personal data rights , we will provide you with a reason why. You have the right to complain to a supervisory body (in this case, the Information Commissioner (ICO) and , if necessary, the Information Tribunal and higher courts.
How can I contact somebody about my privacy or complain about the way my information has been dealt with?
You can get in touch with the Trust by email or using the details at the foot of page one of this document.
Please note that the Trust will ask for identification should you choose to exercise any of the above rights in relation to personal data the Trust holds.
You can complain to the Trust if you feel that any of your rights, in relation to your personal data, have been breached. If you are not satisfied with the response, you can complain further to the Information Commissioner's Office Information Commissioner (ICO).