Individual HAABase Wales Data Access Agreement

(online agreement)

1. About this agreement

HAABase Wales is a secure web application providing access to Listed Building Condition Survey data for Wales. It is operated by The Handley Partnership on behalf of Cadw (Welsh Ministers), who are the data owner and data controller for the information held within the system.

This agreement governs your personal use of HAABase Wales. By accepting it, you confirm that you have read, understood, and agree to comply with its terms, with your organisation’s obligations under the relevant Cadw data sharing and use agreement, and with any applicable policies or guidance issued by Cadw.

Access will not be granted until you have accepted this agreement. Continued access is conditional on ongoing compliance. You may be required to re-accept this agreement if it is updated.

2. Who may use the system

You may use HAABase Wales only if:

1. you are a named individual working within Welsh Government, a Welsh local authority, RCAHMW, or another organisation approved by Cadw;
2. your organisation is party to, or otherwise covered by, the relevant Cadw group-level data sharing and use agreement;
3. you are authorised by that organisation to use the system for approved purposes;
4. you use your official organisational email address; and
5. your account is individually assigned to you and not shared with any other person.

If you are unsure whether you are eligible, do not proceed and seek advice from your organisation’s point of contact or Cadw.

3. What you may use the system for

You may use HAABase Wales only for approved public-interest purposes connected with:

1. official duties relating to the protection, management or monitoring of listed buildings in Wales;
2. strategic planning, conservation management, heritage monitoring, funding prioritisation and related public interest functions;
3. support for the exercise of statutory powers under the Historic Environment (Wales) Act 2023; and
4. analysis consistent with the Well-being of Future Generations (Wales) Act 2015.

You must not use the system for commercial resale, private gain, unauthorised redistribution, or research unrelated to those purposes unless Cadw has given prior written permission.

4. Your personal responsibilities

By accepting this agreement, you confirm that you will:

1. keep your login credentials confidential and not share your account;
2. ensure your account is used only by you;
3. use the system only in the course of your authorised role and for approved purposes;
4. comply with this agreement, your organisation’s obligations under the Cadw group-level agreement, your organisation’s own information governance requirements, and all applicable law including the Data Protection Act 2018 and UK GDPR;
5. not attempt to circumvent access restrictions, technical controls, export limits, or any other security features;
6. not use scripts, bots, scrapers, automated tools or other methods to harvest, copy or extract data from the system;
7. not reverse engineer, probe, or misuse the application or its underlying data structures; and
8. stop using the system immediately if you cease to be authorised by your organisation or no longer require access.

5. Restrictions on data use and disclosure

Data accessed through HAABase Wales must not be:

1. released to any third party without prior written permission from Cadw, except where information relating solely to a listed building owner’s or trustee’s own property is disclosed through proper organisational procedures and identity has been verified;
2. moved, copied, published, or otherwise shared outside your organisation without Cadw’s permission;
3. written to removable media;
4. used for any purpose other than the approved purposes set out in section 3.

Any request to disclose, share, publish or re-use information more widely must be referred to Cadw through the appropriate organisational route.

6. About the information

HAABase Wales contains survey-based condition information collected through a rolling programme of rapid external visual assessments of listed buildings in Wales.

You acknowledge that:

1. the information reflects the condition of a building at the time of survey and may not represent its current state;
2. some records may be several years old;
3. the information should be interpreted and used with appropriate professional judgement;
4. the information may include photographs, condition and occupancy information, risk scores, historic records and related assessments; and
5. some information may constitute personal data, or may become personal data when combined with other information.

7. Monitoring and audit

Your use of HAABase Wales is subject to monitoring and logging for security, governance, audit, contractual compliance and misuse detection purposes.

This may include records of:

1. login activity and session information;
2. search queries and filters used;
3. records viewed, accessed, and any permitted exports or downloads;
4. IP address and other technical access data.

Excessive, unusual, unauthorised or suspicious activity may result in your access being suspended or revoked and may be referred to your organisation and Cadw.

8. Data protection, incidents and accuracy

Cadw (Welsh Ministers) is the data controller for the information held within HAABase Wales. The Handley Partnership acts as data processor and system operator on Cadw’s behalf.

The sharing of personal data through this system is carried out under the lawful basis of public task under Article 6(1)(e) UK GDPR.

If you become aware of:

1. a breach or suspected breach of this agreement;
2. a personal data breach or security incident;
3. misuse of your account or another account; or
4. information that appears inaccurate,

you must report it immediately through your organisation’s incident or governance procedures and notify Cadw without delay. Where relevant to access, security or technical compromise, you should also notify The Handley Partnership through the published support route or system process.

9. Suspension, revocation and ending access

The Handley Partnership may administer access controls and, with Cadw approval where required, may suspend or revoke your access where misuse is suspected, technical risk is identified, eligibility is in doubt, or this agreement has been breached.

Your organisation’s point of contact must notify Cadw or The Handley Partnership immediately when you no longer require access or cease to be eligible.

Termination or suspension of your access does not remove any continuing confidentiality, data protection, or restricted-use obligations that apply to information already accessed or retained lawfully.

10. Changes to this agreement

This agreement may be updated from time to time. Where this occurs, you will be required to review and re-accept the updated terms before continuing to use HAABase Wales. Access may be suspended until such acceptance has been recorded.

11. Contact

For technical support or account workflow queries:
The Handley Partnership — support@t-hp.com

For data governance, access approval, disclosure, or data controller matters:
Cadw (Welsh Ministers)

---

The online acceptance declaration is presented separately when users accept access terms before entering HAABase Wales.