The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 (the Act). In order to deliver our services North Wales Fire and Rescue Service (NWFRS) may need to process your personal data.

NWFRS is committed to treating your personal data lawfully and this privacy notice explains how we do this. We update this notice from time to time to reflect any changes to our service.

The Chief Fire Officer of North Wales Fire and Rescue Service is registered as a ‘data controller’ with the Information Commissioners Office (ICO) and is responsible for ensuring the service handles all personal data in accordance with law.

As an employee / ex-employee / retiree the service processes a large amount of personal data across a number of different departments. For this reason, this privacy notice should be read in conjunction with other notices available along with our policies and procedures.

This privacy notice explains:

• how we collect, store, use, disclose, retain and destroy personal data, including through our website.
• the steps we take to ensure personal data we process is protected.
• the rights individuals have when we process their personal data.
• The types of data we process

Our Contact Details and Data Protection Officer

You can contact our Data Protection Officer if you have any questions or concerns about how we process your personal data.

Post:

Data Protection Officer
North Wales Fire and Rescue Service HQ
Ffordd Salesbury
St Asaph Business Park
St Asaph
Denbighshire
LL 17 0JJ

Email: dpo@northwalesfire.gov.wales

What is personal data?

Personal data is any information that relates to an identified or identifiable natural person. An 'identifiable natural person' is anyone who can be identified, directly or indirectly from information, including by reference to a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Why do we process your personal data?

We need to use your data to allow us to meet our contractual obligations with you as an employee.  Examples of this use can include:

• Administering recruitment and promotion processes and for the collection or distribution of employment references.
• Delivering and administering relevant training.
• Managing employee performance and disciplinary processes.
• Maintaining employment records including details of who to contact in an emergency.
• Manage employment absence due to sickness.
• to conduct investigations whereby there have been allegations which meet our disciplinary processes.
• To maintain health and safety records regarding near misses and injuries.
• Maintaining accurate and up to date pension records.
• To allow for the delivery of our core services.
• Maintaining appropriate payroll systems.
• To ensure we are promoting equality, diversity and inclusivity within the workplace and recruitment and promotion processes.
• Maintain employee performance records.
• Respond to and/or defend against legal claims.

We may also process your data to allow for us to meet our legitimate interests or where to do so would be in the public interest.  Such reasons may include:

• Supporting projects that improve our operational effectiveness (i.e. publishing stories in the press or online).
• Allowing individuals to register their interest on any event held or supported by the service.
• Facilitating internal communications via forums, web chats, workplace social media or other media.
• Effective workplace security – use of CCTV in or around our buildings.

What types of personal data do we process?

We may process personal in following categories dependent upon the service being provided:

• personal details (such as name, address and biographical details)
• contact details
• family, lifestyle and social circumstances
• Employment, education and training details
• sound and visual images (eg from body worn cameras, live streaming or CCTV)
• location data
• When responding to emergencies or other incidents we may also process information relating to the incident including car or property details, or whether there are any hazardous chemicals present.
• financial details
• goods or services provided
• information identifying user vulnerability, persistent targeting,
• references to manual records or files
• information relating to health and safety
• complaint, incident, and accident details
• opinions and assessments of officers and staff in relation to individuals dealt with.

We may process some special category or criminal data which may include:

• Physical and mental health information, both declared and suspected.
• Racial or ethnic origin
• Trade Union membership
• Religious or other beliefs
• Sexual orientation

We may also process some criminal data including:

• criminal proceedings, outcomes and sentences.

The types of personal data we process will vary depending on the purpose. We aim to process the minimum amount of personal data necessary. You should not assume that we hold personal data in all of the categories identified for every person.  The categories identified may not be complete as occasionally we may gather personal data in other categories for the purposes described.

Special Category and Criminal Data may be processed for purposes such as:

• Running an effective recruitment / promotion campaign
• Supporting health and wellbeing and to prevent or manage sickness and injury within the service.
• Where necessary with regards to grievance or employee disciplinary matters.
• Substance misuse testing.
• Criminal data would be used to ensure the integrity of our service and when investigating complaints and conducting vetting.

Where do we get the personal data we process?

We collect personal data from a variety of sources, including:

• individuals may provide their details on application forms, resumes or by providing copies of official documentation such as passport, driving licence etc.
• Third Parties – In some cases we may receive data from former employers, employment background check providers, credit reference agencies and criminal record checks permitted by law.

What is our lawful basis for processing personal data?

Our legal basis for processing will vary depending on the circumstances. Ordinarily, the relevant legal basis is that the processing is:

• necessary to comply with a legal obligation (including employment law)
• in the public interest or for official purposes
• in our legitimate interests or the interests of a third party

and on occasion

• with your explicit consent which you can withdraw at any time

What security measures do we use when processing your personal data?

We take the security of all personal data under our control seriously. We comply with our legal obligations regarding security and have put in place physical, electronic and managerial procedures to safeguard and secure any data we hold about you.

We ensure that appropriate policy and training measures are in place, including audit and inspection to protect our manual and electronic information systems from data loss and misuse. We continuously manage and enhance our compliance with relevant standards and guidance to achieve adequate and up-to-date personal data security.

What disclosures do we make of your personal data?

We only disclose your information to others when it is necessary to do so.  When we do, we only share the minimal amount of data to meet that purpose.

We may share your data internally between different departments and could be for a variety of reasons. Your data may also be shared with employee representatives such as union representatives.

Externally, we may share data with your previous employer, providers of payroll, pensions or occupational health services.  We may also share data with third parties such as legal representatives, the courts, HMRC, Home Office, Health and Safety Executive and Department for Work and Pensions where a legal requirement exists to do so.

We decide on disclosure case-by-case, disclosing only the personal information that is necessary and proportionate to a specific purpose and with appropriate controls and safeguards in place.

If we make disclosures outside of the United Kingdom and the European Economic Area to locations which do not have as extensive data protection laws we ensure that there are appropriate safeguards in place to certify that the personal data disclosed is adequately protected.

How long do we retain your personal data?

We keep your personal data for as long as necessary for the particular purpose or purposes for which we hold it.

What are your rights over your personal data we process, and how can you exercise them?

Under the Act you have a number of rights that you can exercise in relation to personal data we process about you. You do not have to pay to exercise your rights

We sometimes need to request specific information from you to help us confirm your identity and ensure your authority to exercise the rights. However, we do not share with you confidential information of third parties or information which is in the interests of public safety and security to withhold.

Right of Access: You can request access to the personal data we hold about you free of charge. Normally we will provide it within one month of receipt of your request unless an exemption applies. You can request access to the personal data we hold about you using the contact details in this privacy notice.

Right to be Informed: Subject to restrictions you are entitled to be told how we obtain your personal information and how we use, retain, and store it, and who we share it with. This privacy notice gives you that information, as well as telling you what your rights are under the relevant laws.

Right to Rectification: If we hold personal data about you that is inaccurate or incomplete you have the right to ask us to correct it. You can ask us to correct your personal data using the contact details in this privacy notice. We will reply to you within one month unless the request is complex.

Right to Request Erasure: Under certain circumstances you have the right to ask us to delete your personal data to prevent its continued processing where there is no justification for us to retain it. The circumstances most likely to apply are:

• where holding your personal data is no longer necessary in relation to the purpose for which we originally collected and processed it;
• where there is a legal obligation to erase the data;
• where you withdraw your consent to us holding your personal data if we are relying on your consent to hold it.

The right of erasure does not apply if we are processing your personal data:

• to comply with a legal obligation
• to avoid obstructing an official or legal inquiry, investigation or procedure
• to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
• for the performance of a task carried out in the public interest or in the exercise of official authority
• for the establishment, exercise or defence of legal claims
• to exercise the right of freedom of expression and information
• for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to make it impossible to carry out or seriously impair that processing.

If you want to ask us to delete your personal data you can do so using the contact details in this privacy notice. We will respond to you within one month unless the request is complex.

Right to Restrict Processing: Under certain circumstances you have the right to ask us to restrict the processing of your personal data. This may be in cases where:

• you are contesting the accuracy of your personal data
• while we are verifying the accuracy
• your information has been unlawfully processed and you oppose its erasure and have requested a restriction instead
• where we no longer require your personal data but you need it to establish, exercise or defend a legal claim and do not want us to delete it

Right to Data Portability: You have the right to obtain and reuse your personal information for your own purposes, transferring it from one environment to another. This right only applies to personal data provided by an individual and where the processing is based on their consent or for the performance of a contract and when that processing is carried out by automated means. If you wish to discuss this right, you can do so using the contact details in this privacy notice.

Right to Object: You have the right to object to:

• processing based on legitimate interests or performance of a task in the public interest.
• processing of your information for scientific and historical research and statistics
• direct marketing.

Any objection must be on grounds relating to your particular situation. If you want to exercise your right to object you can do so using the contact details in this privacy notice.

Rights related to automated decision making and profiling: You have the right not to be subject to a decision when it is based on solely automated processing (including profiling) and which produces a legal effect or similar significant effect on you. This right does not apply if the decision is authorised by law, is necessary for entering into or performance of a contract, or is based on your consent.

Right to withdraw consent: You have the right to withdraw your conset where we have relied on consent as a lawful basis to use or share your data.  We will explain this to you at the time we collect it.

Right to complaint to the regulator (the ICO): You are entitled to lodge a complaint with the Information Commissioner’s Office if the Constabulary has not resolved a data protection concern in line with good practice. The ICO can be contacted via their website: ico.org.uk or telephone: 0303 123 1113.

Information Commissioner

The Information Commissioner is responsible for ensuring we meet our obligations and can be contacted in the following ways:

By post:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Online at: Information Commissioner's Office

Date of last update

We last updated this privacy notice on the 13th February 2025. We keep this privacy policy under regular review and update it if any of the information in it changes.