Wifi Portal/Community WiFi Privacy Policy

Introduction

Menter Mon is a not for profit company providing solutions to the challenges facing rural Wales. A variety of projects work with businesses, communities and individuals, to deliver meaningful projects that harness their strengths and contribute to a sustainable future. The project will provide towns in rural communities of Anglesey and Gwynedd with public wi-fi and access to Patrwm.io website, which reveals useful data e.g. footfall.

This Policy

This Privacy Policy (“Policy”) applies to the Patrwm Wifi Portal (“the Portal”). It does not apply to any other projects of Menter Mon, or to any external websites that you may access through the Portal.

Data controllers

The Data Controller for data processed under this Policy is Menter Mon, registered in the United Kingdom with company number 03160233 and address Neuadd Y Dref, Bulkley Square, Llangefni, Anglesey, LL77 7LR.

Contact

Any inquiries regarding this Policy or any other data protection issue regarding the Portal can be submitted to:

Postal Address: Neuadd Y Dref, Bulkley Square, Llangefni, Anglesey, LL77 7LR

Email: datacontroller@mentermon.com

What we process, why and the legal basis for this

Menter Mon launched the Portal in order to provide free wifi throughout public spaces in Wales. Providing free wifi in public spaces ensures an opportunity for communities to connect to the internet. When visitors connect to the public wifi via the portal additional data can be captured to support the location analytics on PATRWM. Collectively this data can be used by partnering local authorities to help inform decisions.

We collect and process some personal data in order to provide a secure wifi service, to understand demographic information about who is using the Portal and the public spaces it is offered in and to send emails and updates about the Portal and community news.

When you first log in to the Portal and at six monthly intervals of use, we collect your email address to validate login to the Portal. Optionally, you can also respond to a short survey and provide information about your gender, age, preferred language and purpose of visit to the public space – this information helps us understand some demographic information about who is present in a particular place at a particular time.

You may also choose to subscribe to our promotional email from local businesses about the latest promotions and marketing content. We process this data on the basis of your consent. You can unsubscribe from the marketing mailing list at any time through the link in any of the emails we send you.

We do not collect any user browsing history, but we do maintain a unique Session ID, which controls the period of time that the user is connected to our network after logging in. This Session ID allows us to be able to provide a consistent and secure service across the whole town centre as indicated on the map. Session ID’s are not stored for longer than 24 hours.

No information is used to track or monitor any individual and we aggregate data at the end of each day in such a way that it cannot be associated with any individual. We process this data on the basis of our legitimate interest in understanding how the Portal is used and improving the service we provide.

Sensitive data

Certain types of data are classed as “special category” under data protection laws including the GDPR. A higher threshold of data protection standards is in place in relation to this data as it concerns information deemed to be potentially sensitive. Special category data includes information about a person’s race, ethnicity, sexuality, health status and political or philosophical beliefs. We do not process any special category data under this Policy.

Data sharing and processors

Menter Mon works with certain carefully selected third-party processors who perform certain tasks in order to facilitate the Project. These include Kodergarten Ltd which provides data collection, processing and administration services, and Listmonk, our email service provider. For a full list of processors, their locations and the functions they perform, you can contact: datacontroller@mentermon.com.

Other data sharing relationships

Local authorities and other organisations

We share aggregated demographic data and optional survey data with local authorities and other organisations involved in tourism to Wales, so that they may better understand how many people and what broad demographic groups are spending time in particular areas. We do not share any personal data for this purpose. The information we share is drawn from the number of unique logons and any information shared through the optional survey. So, for example, the information a local authority or other organisation may receive may look something like “287 unique visitors in June 2021 to Beddgelert, over the age of 35, who came for the purpose of outdoor activities”. The information shared will not allow for the identification of any individual.

This information is also used by local authorities and other organisations to send marketing material to individuals who have consented to receiving this. Menter Mon does not share individuals’ email addresses for this purpose, rather the organisation is able to send emails to a particular group of individuals based on demographic information and via the email list that Menter Mon retains.

We will possess the right to share data for communities to carry out marketing campaigns but only to users that have connected to their network. Those communities will need to be ICO registered to do so.

Kodergarten Ltd

Kodergarten Ltd are subcontracted by Menter Mon to design and deliver the network across town centres and other locations across Anglesey and Gwynedd. All locations are selected in conjunction with our partners such as Local authorities, Town Councils and business owners. All data received from Porth and Patrwm will be processed in the UK by Kodergarten Ltd under the terms of this policy on behalf of Menter Môn and its partners.

Data retention

In general, we retain personal data for as long as is required to fulfil the purpose it was collected for. The email address you provide at login to the Portal is retained for 3 years. Usage data is retained for 3 years. Any provided responses to the survey are fully and irreversibly anonymised and therefore no longer constitute personal data and are retained indefinitely. Mailing list data is retained for as long as you choose to remain subscribed to the mailing list.

Information security

We take all reasonable steps to ensure that personal data is processed securely and treated in accordance with applicable data protection laws and with this Policy. We institute technical and organisational measures to prevent unauthorised access to personal data, including limiting staff and contractor access in line with specific job responsibilities and the encryption of data where possible. While we do our best to protect personal data, information shared over the internet remains vulnerable to interception – for this reason, the transmission of any personal data to our websites or via email to us is therefore at the data subjects’ own risk.

International transfers of data

Any transfers of personal data to a country outside the EU, or a country without an adequacy decision in place will be supported by an appropriate international transfer safeguard as required by data protection laws, for example the European Commission’s Standard Contractual Clauses will be in place with international recipients of data.

Your rights

Where your data is processed under this Policy, you may have the right to:

  • be informed as to whether Menter Mon holds data about you;
  • access that data;
  • have inaccurate data corrected;
  • have your data deleted;
  • opt-out of particular data processing operations;
  • receive your data in a form that makes it “portable”;
  • object to data processing;
  • to receive an explanation about any automated decision making and/or profiling, and to challenge those decisions where appropriate.

You can seek to exercise these rights by contacting

Postal Address: Neuadd Y Dref, Bulkley Square, Llangefni, Anglesey, LL77 7LR

Email: datacontroller@mentermon.com

Data subjects covered by UK and EU data protection laws, including the GDPR, may also be entitled to lodge complaints with the ICO if in the UK, or in the EU, the data protection authority in their country of residence.

Updates to this Policy

We may change this Policy from time to time. If we make material changes, we will notify you as required by law.