1. Who we are
The Multilingual Mentoring project (previously known as MFL Mentoring) is delivered by Cardiff University on behalf of the Welsh Government. Cardiff University is the main body that will be collecting, storing, processing, maintaining, cleansing, and retaining personal data including data defined as sensitive. Cardiff University will be the data controller for your personal data.
Our university partners include Aberystwyth University, Bangor University, Cardiff University, Cardiff Metropolitan University, Chester University, Swansea University, University of South Wales, the Royal Welsh College of Music and Drama, University of Oxford, University of Wales Trinity St. David, and Wrexham University. The project works in maintained schools across Wales.
The programmes delivered by Multilingual Mentoring aim to increase the number of pre-GCSE learners opting to choose an International Language for GCSE through mentoring.
References to ‘the programmes’ in this notice refer to Multilingual Mentoring’s programmes, including but not limited to, Year 8/9 Mentoring and Multilingual Workshops, Multilingual Mentoring in Primary Schools and the Love Reading Mentoring Project.
The following document explains why we (Multilingual Mentoring) collect data, how this data is processed and the steps we take to ensure data security at all stages.
2. How we will use your data
We use your personal data to facilitate your involvement in the Multilingual Mentoring project. Any data that is collated about you is needed to deliver the programme effectively. As part of the project’s remit, this might also include research conducted into the language learning sector. Your data is collated in a variety of different ways, which could include online surveys (on platforms such as Qualtrics), and/or paper surveys. Our analysis is not about any specific person and so you will not be identified as an individual. All data will be anonymised in any report or research outputs.
3. The nature of the personal data we will be using
Personal data, as defined by UK GDPR is “any information relating to an identified or identifiable natural person (‘data subject’)”, in other words – any data that can reveal a person’s identity. The categories of your personal data that we will be using for this project may include the below, depending on the nature of your involvement in the project.
Participants in the project agree they have read and understood this privacy notice before sharing any data with Multilingual Mentoring. They must ‘opt-in’ by selecting that they agree, before being able to proceed. Learners in primary and secondary schools are also given an easy-read version of the privacy notice to understand what they are giving consent to. Learners who participate in the programme are also required to have parental consent – a process managed by their school.
University Students:
Any student from our partner universities who wants to apply to participate with the project will be asked to share the following during their engagement with the project:
- Full name
- Gender
- Date of birth
- Nationality
- Disability (if you choose to share this with us)
- University and personal email address
- Phone number
- Postal address
- University
- Degree programme
- Year of study
- Bank details
- Document information for a DBS check (e.g. passport, driving licence, eVisa, etc.) and a copy of the DBS Certificate
Teachers and other education practitioners:
Any teacher or education practitioner based in a Welsh primary or secondary school that wants to apply to participate with the project will be asked to share the following during their engagement with the project.
- Full name
- Gender
- Email address
- Phone number (school and personal)
- School
- Job title
Parents/Care givers:
Parents or care givers are asked to share their full name whilst consenting to allow their child to participate with the project.
- Full name
Secondary School Learners:
Learners will be asked to share the following when engaging with the project and can choose to provide an anonymous name at any point of the survey.
- Full name
- Gender
- Ethnicity
- School/Hwb email address
- School
- Year group
Primary School Learners:
- Full name
- Gender
- School
- Year group
4. Why Multilingual Mentoring collects this information and why our use of your personal data is lawful
Multilingual Mentoring collects data on individuals for the following main purposes. Multilingual Mentoring’s use of your personal data will be lawful and will meet the conditions outlined in the current data protection legislation: the UK GDPR (General Data Protection Regulation) and Data Protection Act 2018, as well as the Data Use and Access Act 2025. For the purposes of this project Multilingual Mentoring and the programmes it delivers, will process your personal information in accordance with the following legal basis.
| Type of personal data | Purpose | Legal basis |
| Any personal data shared with the project via surveys or applications collated online through Qualtrics or via paper surveys. | For the purposes of monitoring which allows Multilingual Mentoring to: Fulfil compulsory external reporting requirements to regulatory bodies such as Welsh Government. Monitor and evaluate the effectiveness of the programmes. Provide a clear picture of the activities we deliver and the people we work with. Produce statistics, including event application and participation numbers, and participant outcomes. Produce research that is relevant to the field of literacy and language learning and can inform future educational practice, policy and academic research. | Cardiff University is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities. As such, personal data is processed on the basis that doing so is necessary for our public task, is for scientific and historical research purposes which are in the public interest and is subject to necessary safeguards UK GDPR Art.6.1(e) and Art. 9.2(j). |
| Personal data such as information about disabilities. | To ensure the health and safety and well-being of all participants who engage with the project and to assist with pastoral and welfare needs, for example ensuring that we are aware of medical conditions and disabilities. | Processing is necessary for compliance with a legal obligation to which the Data Controller is subject.Processing of Special Categories data is necessary for reasons of substantial public interest based on the duties in the Equalities Act 2010 (UK GDPR Article 9(2)(g)) Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 10 “Preventing or detecting unlawful acts” and Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 16 “Support for individuals with a particular disability or mental condition” |
| Personal data such as information about ethnicity. | To understand if ethnicity has an impact on attitudes towards language learning, this supports the project to better understand barriers towards language learning. | Cardiff University is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities. As such, personal data is processed on the basis that doing so is necessary for our public task, is for scientific and historical research purposes which are in the public interest and is subject to necessary safeguards UK GDPR Art.6.1(e) and Art. 9.2(j). |
| Bank details shared by students via a Payee Capture Form. Collated by the project team. | For administering payments to university students who participate with the project, for example, bursaries and travel reimbursements. | Art.6 1 (b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the requests of the data subject prior to entering into a contract”. |
| Personal data such as name and email address via Qualtrics survey or paper copy of survey. | To send relevant and necessary information regarding forthcoming activities as well as marketing communications. | Art.6 1 (a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. |
| Criminal Offence Data of students via Enhanced DBS checks. | For safeguarding children and individuals at risk due to the nature of the work that will be undertaken by students participating with the project. Please see below for further information. | Art.6 1 (e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Safeguarding of Children and Individuals at Risk (Condition 18 DPA Schedule 1). Data Protection Act 2018, c.12 Schedule 1, Part 2, Paragraph 10 “Preventing or detecting unlawful acts” and Data Protection Act 2018, c.12 Schedule 1, Part 2 Paragraph 11 “protecting the public against dishonesty” |
5. Sharing your personal data
We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes). Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. Cardiff University is the main body which will be processing your data.
Our partners include:
- Welsh Government (htps://gov.wales/). Welsh Government fund the project.
- Reaching Wider (reachingwider.org). Reaching Wider fund some partner schools to engage with the project. A school will be made fully aware of this if it applies to them.
- Research and Evaluation organisations such as Ondata Research Ltd (http://ondata.org.uk/) and Miller Research (https://www.miller-research.co.uk/ ). To support evaluation components of the project. When data is shared, a data sharing agreement is in place.
- Data Management organisations such as Butterfly Data (https://www.butterflydata.co.uk/). For the purposes of producing data visualisations of key trends and statistics.
- A university and/or school. To support mentors and learners who are engaging in the project.
- Consortia or Local Authority Leads. To support teachers and schools who are engaging in the project.
Enhanced DBS Checks
All students must complete an Enhanced DBS check as part of the project processes prior to visiting partner secondary or primary schools. Any individual who does not want to complete an Enhanced DBS check has the right to refuse to complete this check. However, this does mean that the individual in question will be unable to participate with Multilingual Mentoring and the programmes it delivers.
The project will confirm to participating schools that a student has completed an Enhanced DBS check and would be suitable to deliver sessions in that school. Detailed DBS certificate information may be shared with a school where there is a lawful basis and a safeguarding necessity to do so.
Accreditation
If you are a student completing/who has completed an Agored Cymru accreditation with Multilingual Mentoring, the details you provide will also be shared with the following partners in order to process and award your units:
- Creo Skills Ltd (https://creo-skills.co.uk/)
- Agored Cymru (https://agored.cymru/)
6. How long we will keep your personal data
Cardiff University will keep your personal data for no longer than is necessary for the purposes of the Multilingual Mentoring project. Please see the table below for any personal data that is used for research purposes.
| Description | Retention Period | Notes |
| Research records and data from non-clinical and non-public health research projects | Data to be retained for a minimum period of 5 years after the end of the project* or after publication of any findings based on the data (whichever is later). *End of project is defined as completion of project closure report or publishing of final articles. | If any patents emerge from the research, the records and data may need to be retained for a longer period. |
| Bank details of students | Payment records will be retained in accordance with Cardiff University’s financial records retention requirements. Bank account details will be deleted or securely removed when no longer required for payment processing and audit purposes. | Subject to Cardiff University records management policy and retention schedules. |
| DBS Information data (DBS Certificate & Criminal Offence Data and documents related to identify verification) | Copies of students’ DBS certificate (and the associated criminal offence information) will be retained for the duration of their participation with the project (max. 18 months). This is to comply with schools’ safeguarding policies (should the school policy require to see a copy of the certificate for their own records). Data relating to documents used for identity verification for a DBS check will be retained for up to 2-years. | Retention period is in accordance with the Disclosure and Barring Service ID checking guidelines for Standard/Enhanced DBS checks (22 April 2025). |
7. Security of data
Data protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure.
Only members of staff who need access to relevant parts of your information will be authorised to do so. All staff with access to any personal data which is stored electronically will have multi-factor authentication installed on their accounts, while paper files will be stored in secure areas with controlled access.
When any identifiable data is shared with Multilingual Mentoring’s partners, any documents will be password protected and the password will be shared in a separate email to the document containing the data. Schools will receive data that includes personally identifiable information only for their own learners and this data is shared with the contact teacher in order to determine which learners should engage with the programmes offered. All other data shared is fully anonymised and no personally identifiable information is shared with partners.
8. Your data protection rights
Under data protection legislation you have some rights relating to your personal data. Some of these may be limited depending on the circumstances. Information about your rights, including the rights of access, objection and erasure, can be found on Cardiff University’s website: Your data protection rights – Public information – Cardiff University.
In the first instance please contact Lucy Jenkins (jenkinsl27@cardiff.ac.uk) with your request:
- to have your personal data rectified, if it is inaccurate or incomplete
- to restrict how we process your personal data
- to withdraw consent for direct marketing purposes
9. Withdrawal of consent and the right to lodge a complaint
Where we are processing your personal data with your consent, you have the right to withdraw that consent. You can do this by contacting Lucy Jenkins (jenkinsl27@cardiff.ac.uk).
If you are unhappy with our use of your personal data, please let us know by contacting Lucy Jenkins (jenkinsl27@cardiff.ac.uk) in the first instance. If you remain dissatisfied you can contact Cardiff University’s Data Protection Officer Gail Thomas at inforequest@cardiff.ac.uk or by post at Data Protection Officer, Compliance and Risk, University Secretary’s Office, Cardiff University, 42 Park Place, Cathays, Cardiff, CF10 3BB and state the name of this project.
You also have the right to raise any concerns with the Information Commissioner’s Office (ICO) via their website at https://ico.org.uk/concerns/.
10. Last updated
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 15 July 2026.
11. Contact info
If you have any questions about how your personal information will be used, please contact Lucy Jenkins, Project Director, at jenkinsl27@cardiff.ac.uk.