Learner consultation to inform Medr’s investment policy statement – Privacy Notice 

Background 

Medr, the Commission for Tertiary Education and Research in Wales, has asked OB3 Research to consult with learners across Wales to help inform the development of its investment policy statement. This will involve capturing the views of learners based at further education, higher education, apprenticeship provision, adult community learning and local authority school sixth forms. 

This privacy notice explains how your personal information will be used if you take part in the consultation. Any findings from the research may be included in reports or other outputs for Medr, but your name and contact details will not be published. Comments will not be attributed to named individuals without your explicit agreement. 

Taking part is completely your choice, but your views and experiences are very important and will help ensure that Medr’s future work is informed by learner perspectives.  

What data is collected and how is it used? 

Personal data means any information that could be used to identify a person, either directly or indirectly. 

On behalf of Medr, OB3 Research is conducting focus groups to capture the views of learners in Wales about their experiences of post 16 education and training, including what is important to learners and their views about what provision Medr should prioritise in the future. 

During the research, learners may be asked to share their views, experiences, and opinions. Any personal details will be kept to a minimum and handled safely, following data protection rules. OB3 Research is registered with the Information Commissioner’s Office (ICO) and follows strict guidelines to keep information secure. 

During this research, OB3 Research may collect and analyse the following categories of personal data: 

  • Contact details (name, email, phone number) 

  • Demographic details (gender, age) 

  • Education and training details (course, qualification level, education or training provider)  

  • Programme related information (your opinions, experiences and views relating to your learner experience)  

  • Financial support received whilst in education or training (such as the Education Maintenance Allowance [EMA] or free school meals [FSM]) 

All information will be used only for research purposes and handled carefully and respectfully. 

Interviewees will not be asked to provide special category personal data such as racial or ethnic origin, health information, religious beliefs, political opinions or trade union membership as personal information about themselves. If any such information is volunteered during an interview, OB3 Research will only use it where it is relevant to the research, will minimise it where possible, and will protect it carefully in line with UK GDPR requirements. 

Data you provide will only be used for research purposes: to manage participation, analyse findings, and produce a report to be published by Medr. Your data will never be used for marketing or automated decisions. Reports will be anonymised and checked to remove any risk of identifying individuals. Any registration data provided by learners is collected via Snap survey software, a secure platform that meets international security standards (SOC 2 Type II and ISO 27001). 

OB3 Research will not share your personal data with Medr.  

What is the lawful basis for collecting this data? 

The primary lawful basis for processing information provided during the research is Medr’s ‘public task’, as set out under Article 6(1)(e) of the UK GDPR, whereby processing personal data is ‘necessary for the performance of a task carried out in the public interest.’  This lawful basis is further supported by Medr's statutory functions under the Tertiary Education and Research (Wales) Act 2022 in relation to the planning, funding, improvement and coordination of tertiary education in Wales. The Act stipulates that Medr is required to consult on the development of its investment policy statement and the information collected will be used to help inform the development of Medr’s investment policy statement.  

In addition, the research also relies on the lawful basis of ‘consent’, as set out under Articles 6(1)(a) of the UK GDPR, in accordance with which, participation in the research is entirely voluntary. This means that there is no requirement for you to participate, and you can choose to withdraw from the research at any time. If you do not wish to take part in the research or be sent reminders, then please reply to the invitation email expressing your wish, and OB3 Research will remove your details from the research records.  

How secure is your personal data? 

OB3 Research stores your data on cloud servers based in the UK and uses encryption and restricted access. OB3 Research holds Cyber Essentials Plus certification. 

How long is your personal data kept for? 

OB3 Research will keep your data during the contract period. After that, it will be securely deleted, and Medr will receive confirmation of deletion. 

Individual rights 

Under data protection legislation, you have rights over your data. You can: 

  • Ask for a copy of your data; 

  • Ask for mistakes to be corrected; 

  • Ask for data use to stop or be limited (in some cases); 

  • Ask for data to be deleted (in some cases); 

There are some limitations in some cases which depend on your request and on the purpose of the processing. Medr welcome any queries in relation to your rights. Further information about your rights is available on the ICO website. 

To exercise your rights, please get in touch with Medr’s Data Protection Officer using the contact details below.  

Complaints about the use of your personal data 

Medr is fully committed to the processing of your personal information in line with data protection legislation but do welcome any queries relating to the processing of your data and will listen to any concerns you may have.  

If you are unhappy with the way in which your personal information has been handled, please contact dataprotectionofficer@medr.cymru or complete the online complaints form and Medr will try to resolve your issue informally. 

If Medr is unable to resolve the issue to your satisfaction, you can also make a complaint to the Information Commissioner’s Office (ICO), who are the UK’s data protection regulator. 

The contact details for the Information Commissioner’s Office are: 
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 
Phone: 0303 123 1113 
Website: www.ico.gov.uk 

The contact email for Medr as Data Controller is dataprotectionofficer@Medr.cymru 

The contact email for OB3 Research as Data Processor is nia.bryer@ob3research.co.uk  

Medr’s data protection registration reference is ZB552558. 

This privacy notice was last updated on 03/09/26.