1.   Introduction

This privacy notice explains the way in which we (the Public Services Ombudsman for Wales) will handle your personal information when you visit our office.  It explains:

• What information we collect and why
• How long we keep your information
• Your data protection rights

2.   What information we collect and why

When you arrive at our office for a planned visit, you will be asked to add your name, the organisation you are from and the date and time of your visit into our visitors’ book.  We ask that you provide a contact number in case we need to contact you whilst you are on site.   You will be asked to sign out when you leave.

We currently have a temperature monitor for anyone coming into our office.  This was put in place as a measure to protect anyone using our office during the COVID-19 pandemic.  We ask that you check your temperature when you enter the building.  The temperature monitor only records your temperature and collects no other data about you.

Closed-circuit television (CCTV) is in operation around our building for security purposes, so an image of you may be recorded.

We collect this information as it is necessary for security and safety reasons.  We rely on Article 6(1)(f) of the UK GDPR, which allows us to do this when it is necessary for the purposes of our legitimate interests.

You can use our Guest Wi-Fi during your visit.  We will provide you with the address and password.  Your device address will be recorded and allocated an IP address whilst you are at our office.  We log traffic information about the sites visited, duration and date sent/received.  ICO also says: “We don’t ask you to agree to terms, just to the fact that we have no responsibility or control over your use of the internet while you are on site, and we don’t ask you to provide any of your information to get this service.”

The purpose for processing this information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.

3.   How long we keep your information

We only keep visitor information until the page of the visitors of the book is complete and then securely dispose of the page 3 months later.

CCTV recordings are held for 30 days and then automatically deleted.

We keep mobile device information for Guest Wi-Fi usage for 90 days.

We will keep the information only for as long as we need it and will depend on what it is being used for.  Find out more about how long we keep different records for in our record retention schedule.

4.   Your data protection rights

You can read about your data protection rights in the General Information section of our privacy notice.