Naturfa Data Privacy Notice

Personal Data

• Name and primary email address - to ensure we have a point of contact for correspondence.

Other data we collect

• Site name: to ensure the recognised site is identifiable in assessment and potential recognition.
• Site details: including site name, boundary, size, and any supporting information (e.g. a management plan) to check if it meets the criteria.

The personal data is gathered directly from you during one or more of the methods below:

• You submit the information via the Naturfa site assessment tool.
• You submit the information as supporting evidence as part of the nomination process.

• Your personal details will never be made public.
• We may share personal data with individuals only for the purpose of assisting us in assessment such as assessment panel members (e.g. the Biodiversity Strategic Implementation Group).

• In Wales: For officially recognised sites, site details (site name, boundary, biodiversity value, governance type, summary management plan, management effectiveness scores) will appear on a public-facing Welsh Government/Natural Resources Wales-hosted database of protected and conserved areas.
• UK and International Reporting: The UK is a party to the Convention on Biological Diversity. For recognised sites, site name, boundary, governance type, management effectiveness score, and year of recognition will be shared with the Joint Nature Conservation Committee. Sites will be submitted to the World Database for Protected and Conserved Areas and, where possible, the IUCN Contributions for Nature Platform.
• Details on recognised sites will be shared with other sites to help build a community of practice, for knowledge building, and promotion.

We process your personal data to carry out our duties to maintain and enhance biodiversity and ecosystem resilience, and to meet Wales’ commitment to the 30by30 target. This is a task carried out in the public interest.

This means you have the right to:

• Ask for copies of information about you and be told why we’re using it.
• Have incorrect information about you corrected.
• Object to your information being used by the Welsh Government because of your specific situation.
• Restrict our use of information about you where:
  • we are using incorrect information
  • our use of your information is unlawful, and you want us to restrict its use rather than delete it
  • the Welsh Government doesn’t need your information any more but you need it for legal action
  • you have the right to object to information, and you are using that right

• Ask for copies of information about you and be told why we are using it;
• Have incorrect information about you corrected;
• Object to your information being used by the Welsh Government because of your specific situation;
• Restrict our use of information about you where:
  • we are using incorrect information;
  • our use of your information is unlawful and you want us to restrict its use rather than delete it;
  • the Welsh Government doesn’t need your information any more but you need it for legal action;
  • you have the right to object to information, and you are using that right.

More information on your rights is available on the Welsh Government privacy notice page.

The UK Information Commissioner also has more information about your rights on their website.

To make a request please write to: the Data Protection Officer, Welsh Government, Cathays Park, Cardiff CF10 3NQ, or email DataProtectionOfficer@gov.wales giving us your name and contact details and a description of the data you want to see. We will respond as soon as we can and by 30 days after your request at the latest. We might ask you to provide some form of identification, so we don't give data about you to the wrong person by mistake.

We will keep your data for the duration of the assessment process until a decision has been made on recognition.

If the site is successful in recognition, we will keep your data for the duration the site is recognised. Recognition may be ended on the request of the Welsh Government or the site owner.

If the site is not successful in recognition, we will keep the data until the applicant makes it clear they are no longer interested in being recognised.

If the Welsh Government is unsure on the landowner’s intention (e.g. We have not received communications for six months). We will delete data after two years from the last saved communication.

The Welsh Government aims to protect your personal information through a system of organisational and technical security measures. The Welsh Government will ensure that:

• All personal individual contact data is only used for the purposes specified.
• Data is stored securely within the platform which has been penetration tested.
• Data is stored in a secure manner with the required safety tests carried out and is processed and stored in an accurate and reliable manner. This means that data will be recorded as provided by users. Once entered into the system, safeguards will be in place to prevent loss, corruption, or unauthorised modification of data.
• Regular backups will be maintained to ensure data can be restored in the event of system failure or data loss. Data accuracy is maintained through secure storage practices, periodic system reviews, and compliance with relevant data protection and environmental monitoring standards.
• All laptops used by the Welsh Government are managed and encrypted.
• Users require a Corporate account, which includes a valid username, password and biometrics to access the laptop and network resources.
• User-based access controls are implemented to ensure staff have the correct levels of access to the data.
• The database that houses the results of assessments, user data and user authentication is hosted in the UK.