GDPR Privacy Policy

Aberystwyth University and specifically the GEOM Operation complies with the General Data
Protection Regulation (GDPR) (Regulation (EU) 2016/679) and with other related UK data protection

The GEOM operation collects, processes, records and shares internally the personal information of
persons associate with organisations having completed the GEOM eligibility paperwork to
administer your project and to provide the products and services you have requested from us,
including for the following purposes:

1) To provide the information required by our funder the Welsh European Funding Office (where
Welsh government are the data controller and the GEOM operation is the data processor). For
further information please see:-

2) To confirm eligibility of participants, activities or expenditure, monitoring, research or evaluation

3) To retain correspondence related to your project;

Please Note: The GEOM operation may share the monitoring data (including the individual
participant records) with commissioned evaluation organisations interviewing participants so they
can talk to them about their experiences. Not everyone who takes part in the programmes will be
contacted. If a participant is contacted by researchers, the purpose of the research will be
explained to the individual and will be given the option to not take part in the research. The
research organisations will delete the participants’ contact details once the research is complete.

What is the lawful basis for controlling or processing personal data under ESF and ERDF?

The relevant section of the GDPR for collecting personal data in relation to the Structural Funds is
Article 6(1)(e)where:
“processing is necessary for the performance of a task carried out in the exercise of official
authority vested in the controller”

The European Regulations governing Structural Funds give the Welsh Government official
authority to process the personal data referred to above. Article 54(2) of Regulation (EU) No
1303/2013 common provisions on the European Structural and Investment Funds (CPR
Regulation) states that “Member States shall provide the resources necessary for carrying out
evaluations, and shall ensure that procedures are in place to produce and collect the data
necessary for evaluations, including data related to common and where appropriate programme specific indicators.”

Furthermore, the EC ESF Monitoring and Evaluation Guidance states that “a complete data set in
respect of the personal variables of the common output indicators is required in order to be able to
report on the common indicators based on representative samples as set out in Annex I and
Annex II ESF” (page 17). Annex I of Regulation (EU) No 1304/2013 on the European Social Fund
(ESF Regulation) lists a range of data to be collected. These are outlined in ESF Annex A –
Participants database, available at:

The EC ESF Monitoring and Evaluation Guidance also states that “the individual participants’ data
for all person-related indicators must be recorded and stored in a way that allows a Member State
to perform the tasks it is legally required to perform. Therefore all records should include, as a
minimum: an identifier for the operation/project; a personal identifier that allows an individual to be
traced and re- contacted; dates of starting and leaving an operation; and access to values for all
variables needed for indicators” (page 18).

In addition, data is collected relating to Welsh Language to ensure we can demonstrate the
programmes are being delivered in line with the Welsh Language (Wales) Measure 2011.

The Data retention will be specified by the Welsh European Funding Office / Welsh
Government. The data retention period could be as long as 31st December 2026.
Under the data protection legislation, you have the right:
• to access the personal data the GEOM Operation holds on you;
• require us to rectify inaccuracies in that data
• to (in certain circumstances) object to or restrict processing
• for (in certain circumstances) your data to be ‘erased’
• to lodge a complaint with the Information Commissioner’s Office (ICO) who is the
independent regulator for data protection

The Welsh Government Grants Privacy Notice can be found here:
Further information from the ICO can be found here: gdpr/

You can email the University’s Data Protection Officer on

Glabal Site Tag: