HAAbase Wales

HAABase Wales – Listed Building Condition Database

Privacy Notice

Mae copi o'r ddogfen hon ar gael yn y Gymraeg ar gais.

Document status: Version 2025-10 | Last updated: 2025-10-01

Related document: HAABase Wales Data Access Agreement

This privacy notice should be read alongside the HAABase Wales Data Access Agreement. The agreement governs the permitted use of HAABase Wales, while this notice explains how personal information is collected, used, stored and shared.

Overview

The condition of the historic environment is one of the indicators used to measure progress towards the achievement of the well-being goals established under the Well-being of Future Generations Act (Wales) 2015.

HAABase Wales contains data from a survey of the condition and use of all listed buildings in Wales which allows for the early identification of trends that can assist in the development of strategies and the prioritisation of action to ensure the protection of listed buildings.

This data collection is part of a continuous data gathering exercise on the condition of listed buildings across Wales, first commissioned by Cadw in 2012. This is done on a five-year rolling period and the current process is for the period October 2024 to October 2029.

All data held on the HAABase Wales website is collected on behalf of Cadw (Welsh Ministers), who are the data owners, data controllers and who approve all requests for access to it.

This privacy notice tells you what to expect in relation to your personal information in relation to the HAABase Wales website. All data is held and used subject to all privacy policies issued by Cadw. Full details of the Cadw privacy policy can be found at Cadw Privacy Policy.

Data Controller: Cadw (Welsh Ministers)
System Operator and Data Processor: The Handley Partnership
Technical Support: support@t-hp.com

Subject matter of the data / processing

A survey of the condition of all listed buildings in Wales to allow for the early identification of trends that can assist in the development of strategies and the prioritisation of action to ensure the protection of listed buildings. Data is collected via publicly available sources and via surveys/photography of buildings/structures to gather and record information in relation to the condition and use of listed buildings in Wales.

The data we collect

Personal data, or personal information, means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

Identity Data for account holders: first name, last name, username or similar identifier, and email address.
Contact Data for account holders: email address.
Technical Data for account holders: internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices used to access HAABase Wales.
Usage Data for account holders: information about how you use HAABase Wales.
Technical data relating to listed buildings: photographs/images of buildings, and information about the condition and occupancy status of listed buildings.

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below:

Your right of access: you have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification: you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure: you have the right to ask us to delete your personal information.
Your right to restriction of processing: you have the right to ask us to limit how we can use your personal information.
Your right to object to processing: you have the right to object to the processing of your personal data.
Your right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent: when we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

We (The Handley Partnership) are collecting data on behalf of Cadw (Welsh Ministers). Cadw (Welsh Ministers) are the data controller.

We (The Handley Partnership) are collecting or using your information because it forms part of a contract to carry out a data gathering exercise relating to the condition and use of listed buildings in Wales as required by a contract issued by Cadw (Welsh Ministers). Our legitimate interests are:

We collect personal data to allow us to operate access accounts for users and to fulfil the data collection requirements of our contract.

Our lawful bases for collecting or using personal information for research or archiving purposes

We (The Handley Partnership) are collecting data on behalf of Cadw (Welsh Ministers). Cadw (Welsh Ministers) are the data controller.

We collect personal data to allow us to operate access accounts for users and to fulfil the data collection requirements of our contract.

Where we get personal information from

Account holders: directly from you.
Listed building related data: Cadw, publicly available sources, surveys.

Location of processing

Data will be uploaded and stored on a secure, online web application. Local authorities will have access to data for their respective local authority areas. Other bodies such as funding agencies will also have restricted access.

How long we keep the information for

This is part of a continuous data gathering exercise on the condition of listed buildings across Wales, first commissioned by Cadw in 2012. This is done on a five-year rolling period and this contract is for the period October 2024 to October 2029.

After being uploaded to the web application and/or its backup system, any information stored outside of the web application will be stored securely and destroyed no longer than 12 months after its creation date.

Who we share information with

As required by our contract we (The Handley Partnership) will share data with Cadw (Welsh Ministers). Cadw (Welsh Ministers) are the data controller and all data on this website is collected on behalf of them, is owned by them and is subject to any applicable privacy policy put in place by them.

Data is also shared with approved users of the system as approved by Cadw (Welsh Ministers). The Handley Partnership is not permitted to share data with any person or body without prior approval from Cadw (Welsh Ministers). Any request for access to data will be passed to Cadw (Welsh Ministers), who will respond to such queries. The criteria to define an approved user is set by Cadw (Welsh Ministers). Access to the data is only permissible by approved registered users.

All access to data will be subject to the conditions of any end user data agreement, or any other applicable agreement, put in place between the data user and Cadw (Welsh Ministers).

October 2025