privacy policy

Welsh Youth Parliament: Summary Privacy Notice

What is the Welsh Youth Parliament?

The Welsh Youth Parliament was set up in 2018 to give young people in Wales a voice.  It is made up of sixty individual members, who have been either elected by young people on a regional basis or elected by young people from partner organisations. 

The Welsh Youth Parliament is run and managed by an organisation called the National Assembly for Wales Commission, which we call the Commission.


What is the purpose of this summary privacy notice?

If you contact the Welsh Youth Parliament, or individual members of the Welsh Youth Parliament, then personal information about you may be collected.  This summary notice tells you what personal information may be collected about you, how it will be used and what your rights are.

In this notice, when we say personal information, we mean any information that is about you.  This could be anything from your name, your address or your telephone number to more detailed information about your health, your interests or your opinions.


Why does the Welsh Youth Parliament collect and use my personal information?

The Welsh Youth Parliament is a chance for young people in Wales to make their voices heard.  So we want to hear from you about the issues that matter to you.

We encourage you to talk to your Welsh Youth Parliament Members (called WYPMs for short) and tell them what you think.  This can be done directly at events we arrange, by email or social media, or by completing surveys which we have set up.  You can also stay up to date about the work of the Welsh Youth Parliament by signing up to receive our newsletter


What information does the Welsh Youth Parliament collect and use?

If you want to, you can raise issues anonymously.  However, we will usually ask you to provide some personal information, such as your name, your school or the area you live in.  You can choose whether or not to give us this information.

If you want to stay in touch with us, you will also need to provide your contact details (such as an email address).


Who is responsible?


All organisations which collect and use information about individuals must obey certain rules.  The Commission runs the Welsh Youth Parliament and so is mainly responsible for obeying these rules.  In some circumstances, the Commission and individual WYPMs will both be responsible.  Our 'Responsibilities' statement explains this in more detail


What are my rights?

If you have given any of your personal information to the Commission or to individual WYPMs then you have certain rights.  These include the right to be told about what the Commission and the individual WYPMs are doing with your information, the right to ask for us to correct any information which is wrong and the right to request copies of your information.  More information about your rights can be found in the full notice.


Who do I contact?

If you have any questions about this notice or wish to take advantage of your rights, please contact the Commission's Data Protection Officer at

Welsh Youth Parliament: Full Privacy Notice

This notice sets out how the personal information is collected and used by the Welsh Youth Parliament.

In this notice, we or us refers to the Welsh Youth Parliament.  However, the Welsh Youth Parliament is not a legal entity in its own right.  It is made up of sixty individual members (WYPMs), who have been either elected by young people on a regional basis or elected by young people from partner organisations, and is run and managed by the National Assembly for Wales Commission (the Commission).

Generally, it is the Commission which is responsible for your personal information.  In some circumstances, both the Commission and individual WYPMs are responsible. 

Please read this notice carefully to understand how we will use your personal information.  If you have any questions or queries in relation to this notice, please contact the Commission's Data Protection Officer at:

Data Protection Office, Tŷ Hywel, National Assembly for Wales, Cardiff Bay, Cardiff, CF99 1NA.


This notice explains:

  1. Personal information we may collect about you

  2. Our legal basis for collecting, holding and using your personal information

  3. Your rights

  4. Security and sharing of personal information

Please note that this notice only applies to the collection and use of personal information by the Welsh Youth Parliament.  Our website contains links to the websites of other organisations for which we are not responsible.  We encourage you to read the privacy policies of other websites you visit.


1. Personal information we may collect about you


As part of our work, we may collect personal information about you in a variety of different scenarios.  These are set out in more detail below:


A.   Participating in elections to the Welsh Youth Parliament

If you are interested in registering to vote in elections to the Welsh Youth Parliament, you will be taken to a registration page  We will ask for your name, e-mail address, post code and date of birth.  

Your information will be retained until you are no longer eligible to vote at WYP elections, or if you contact us to tell us you no longer want to be registered to vote.  At the end of each WYP term, we will review the list of young people registered, and remove those who will be too old to vote at the next WYP election.  In the event of a by-election during a WYP term, we will remove the details of those young people who have now become too old to vote.

If you wish to stand for election to become a WYPM you must provide your name and address, e-mail address, date of birth, and complete an equality form.  You will also need to provide a short biography about yourself. 

Your details will be kept until the end of the WYP term which you are standing for election.  If a WYPM decides they no longer want to be involved, or if they have been dismissed, we will contact the second place candidate to offer them the role. Candidates who no longer wish to be considered as a candidate after the election can contact us to inform us and we will remove your information

The election process is managed on our behalf by a company called Mi-Voice.  Details of how Mi-Voice will use and protect your information are available at  A full copy of the registration privacy notice is available on the registration site.


B.   Participating in WYP events

If you book to attend events arranged by us, we will collect your contact information and any information regarding your accessibility requirements.  We will keep this information until the event administration has finished.  We often capture digital content at these events – please see the section below for further information on how this is information will be used.

Sometimes we manage event bookings by using a company called EventBrite. Details about how EventBrite will use your information are available on their website.


C.   Subscribing to our newsletters

You are able to subscribe to our newsletter online or in person by attending various activities which we arrange.  We use a company called MailChimp to do this.  If you subscribe in person leaving your contact details on post cards, the Commission will add your details to the relevant mailing list for the newsletter, and a confirmation e-mail will be sent to you.

This information is retained until you unsubscribe, and you can contact us at any time to remove yourself from these distribution lists, and newsletter mailing lists.


D.   Completing our surveys

We produce online surveys using a company called SurveyMonkey.  We do this to get feedback on our activities, or because we want to collect your opinions on different issues.

Your responses will be seen by Commission staff and used to create a summary report which may be shared with others such as WYPMs, Assembly Members and relevant external partner organisations.  Although we may publish the report on our website and promote it on social media, we will ensure that the report does not contain anything which will reveal your identity.  This information will remain public indefinitely.

When you complete one of our surveys via the SurveyMonkey platform, you will be given the choice of opting in to receive updates on the project you have contributed to.


Survey responses: Survey responses will be removed from SurveyMonkey twelve months after the closing date of the survey.  However, it may be necessary to retain survey responses for a longer period on our own systems until any subsequent reporting process has been completed. 

Contact details: We will keep your contact details in order to send you further updates on the specific project until that project has finished.

If you have requested further updates on opportunities to engage with us, your contact details will be kept until you contact us to remove your details and no longer wish to receive updates from us.

Details about how SurveyMonkey will use your information are available on their website.

E.   Online forums

We may use third party platforms Loomio and Dialogue (which is owned by a company called Delib) to facilitate conversation online on different issues we are looking into so that you can provide feedback on certain matters.

Depending on the nature of the project and who we are seeking responses from, these forums may be run privately or publicly, and we may choose to moderate responses before they appear on the site.  We will tell you if an online forum is run openly, and if moderation is in operation for each project.

If you respond to online forums which are run openly, responses will appear publicly.  Anyone is able to participate in open online forums (once they have registered by creating a user name and provided their email address).  Anyone will be able to see your contributions in open online forums, regardless of whether they have registered to the site or not.

When responding to closed forum, only other people who have been invited to participate can see your contribution and are able to participate.

We may use the information you provide to produce a summary report outlining the main themes, which is shared with WYPMs, Assembly Members and Commission staff, and published on our website, promoted across social media channels, and appear in relevant reports.  We may also respond to and communicate with you about your ideas, questions and comments.  This information will remain public indefinitely.

The information collated will be removed from these sites six months after the closing date for responses.  We will keep the contact details of those who have registered on the site on Assembly ICT infrastructure to provide updates on the project you have participated in, and to draw your attention to other opportunities to engage with the Commission on the subject matter which you had engaged with us on this occasion.  You can unsubscribe at any time.

Details about how Loomio and Delib will use your information is available on their websites.


F.   Engaging with us on social media

As well as using social media to put out information for awareness raising purposes, we encourage interactions, particularly those that can be fed into inquiries and consultations run by us.  When this is the case, we will ensure it is made clear that your comments will be used to feed into these inquiries and consultations.  In those instances, your responses to our social media posts (including your name/handle) could be passed on to WYPMs, Commission staff and Assembly Members, and could appear in reports and other materials published on the WYP website, the Assembly’s website and social media accounts.

Content may include images, videos (live and archive), infographics and animations.  The platforms we currently use include Facebook, Twitter, Instagram, YouTube, SnapChat, Wordpress and LinkedIn.  Each of these individual platforms has a privacy notice which tells you about how they use your personal information.

If you share our content through social media, for example by liking us on Facebook, following or tweeting about us on Twitter, those social networks will record that you have done so and may set a cookie for this purpose.  By using those platforms you are agreeing to their terms of service.  You may also engage directly with WYPMs on social media.

In order to manage our social media interactions we use the following third party providers:

Hootsuite: If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations.  For more information, please see Hootsuite's Privacy Policy on how they process your data.

SocialSignIn: If you send us a private or direct message via social media the message will be stored by SocialSignIn.  It will not be shared with any other organisations.


G.   Using our website

If you contact us via our website for the purposes of registration, email subscriptions, and other engagement activities, your information will only be used for those purposes.

Our website also uses cookies.  Cookies are pieces of data that are often created when you visit a website and are stored in the cookie directory of your own computer.  See for more information about how and why we use cookies on our website.

Log files allow us to record visitors' use of the site.  Log files do not contain any personal information or information about which other sites you have visited.


H.   Photos, filming and digital content

We capture pictures and videos during events we may put on, during other activity designed to gather people’s views on different issues, and to demonstrate the work that we do to engage the public.

Images and video footage may be used to promote the work of the Welsh Youth Parliament and/or the National Assembly for Wales and to engage with the people of Wales.

The Commission publishes images and video content on the Welsh Youth Parliament website, and on social media channels, it appears in print materials, it may get shown to WYPMs, Assembly Members and Commission staff, and it gets shared with media outlets.

Some images and videos captured (particularly those of historic and ongoing business value) may be retained indefinitely and content that we publish into the public domain will remain there.  The Commission regularly reviews the digital content captured, and will not retain pictures and videos which are unlikely to be of any operational value going forward.

If you attend an event arranged by the Commission and you do not want to appear in any pictures or videos, or you want to ask a question about how your information will be used, please speak to a member of Commission staff before, or during the activity, or e-mail us at

WYPMs may also capture pictures and videos during their official activities, and outside of those events. WYPMs may post those images on their social media channels in order to promote their activities and better engage with young people in Wales.  If you do not want to appear in any pictures or videos, please speak to the WYPM or email us at

As part of their work, individual WYPMs may ask to record you talking about sensitive issues, such as your sexuality, your religious beliefs or your experience of health conditions, or take pictures of you which may include sensitive information (for example pictures taken of you holding banners or slogans showing your beliefs).  You should only agree to this if you are content for your information to be used in accordance with this notice.

Images captured by WYPMs will be kept on password protected devices and will usually be kept for no longer than eight weeks.   


I.   Contacting your WYPM individually

In addition to contacting us via our website, online forums and surveys, or at our events, you may contact an individual WYPM to raise a particular issue, to give your opinion or simply to find out more about their activities.  We want to hear your views, and encourage you to contact us by using either our email address at or our dedicated social media channels.

Please note that, unlike individual Assembly Members or MPs, WYPMs are not expected to routinely undertake 'casework' on behalf of individuals.

If you do contact an individual WYPM directly, you will be sharing with them your personal information (such as your name and your opinion about an issue).  The individual WYPM, supported by the Commission, will be responsible for ensuring that your personal information is only used for the purpose of their role as a WYPM and in accordance with this privacy notice. 

The Commission will give detailed guidance and support to each WYPM to ensure that your personal information is collected and used appropriately.  Please ensure that you have read and understood how your personal information may be used before sharing your personal information with individual WYPMs.  If you would prefer, you can contact us via our website or our surveys.  If you have any questions or concerns about this notice, please contact us at


2.     Our legal basis for collecting, holding and using your personal information


Data protection law sets out various lawful legal bases (or ‘conditions’) which allow us to collect, hold and use your personal information.  These are:

  • We will sometimes collect and use your personal information based upon your agreement.  This is known as 'consent'.  We will always tell you where this is the case and ask you to agree before we collect your information.  For example, if you sign up for our newsletter, we will ask you if you agree to receiving updates and marketing about the Welsh Youth Parliament and our activities

  • Where we are under a legal obligation which requires us to process your personal information.  An example of this is where we need to collect information about you when you attend an event, in order to ensure your safety.

  • Where we use your personal information to carry out our public functions.  Although the Welsh Youth Parliament is not a legal entity itself, it has been set up to allow young people in Wales to make themselves heard and to give young people first-hand experience of how politics works.  This is part of the Commission's public function to support and promote democratic engagement in Wales.  We will need to collect and use personal information in order to carry out this function.  An example of this is when we collect and use personal information in order to organise events to promote the Welsh Youth Parliament.

  •  Sometimes it will be necessary for us to collect and use your personal information for the purposes of our own legitimate interests.  In order to fully engage with young people in Wales, we need to hear from young people about the issues that interest them, and to collect some personal information about individuals.  We will only collect and use your information where our interests are not overridden by your interests or your fundamental rights or freedoms.  An example of collecting and using personal information in our legitimate interests where an individual WYPM collects opinions from their friends in order to raise a particular issue or concern.

Data protection law recognises certain "special categories" of personal information.  These are defined as information revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning an individual's sex life or sexual orientation. 

These special categories are considered particularly sensitive and so we do not routinely collect personal information falling within these categories.  We will only collect and use these categories of information where you have given us your explicit consent or where we consider it is necessary and in the public interest to do so.  An example of using this kind of information is where we have collected information about any disability you may have, in order for us to help you access our events.


3.     Your rights


You have a number of rights in relation to the personal information that we hold about you.  The rights which apply depend on the legal bases we are relying on to use your personal data.  Those rights will not apply in all instances, and we will confirm whether or not that is the case when you make a request.

In summary the rights are:

  • The right to be informed about how your personal information is used

  • The right of access to copies of your personal information

  • The right to rectification if your information is inaccurate

  • The right to erasure of your personal information

  • The right to restrict our use of your personal information

  • The right to data portability

  • The right to object to the use of your personal information

Further details about these rights are available on the Information Commissioner's Office (ICO) website found here:

If you would like to make a request to us to exercise any of these rights, please email  We will aim to respond to you within one month and we will not charge a fee for dealing with your request.

If you are dissatisfied with how we are using your personal information or if you wish to complain about how we have handled a request, please contact our Data Protection Officer and we will try to resolve any issues you may have.

You also have the right to complain to the Information Commissioner's Office, which is the statutory regulator for data protection law.  Details of how to complain to the ICO can be found at

4.     Security and sharing of personal information


We take the security of personal information very seriously and have put in place measures to ensure that your information is kept secure.

As set out in this notice, we may share your information with others, including:

  • WYPMs

  • Assembly Members

  • External partner organisations

  • Service providers (such as SurveyMonkey and Hootsuite)

  • Our own professional advisers, auditors and insurers

We may also need to share your personal information with other people for legal reasons, such as courts and law enforcement agencies.

Our service providers may store your personal information outside of the UK or outside of the European Economic Area (which means countries in the European Union as well as Iceland, Norway and Liechtenstein).  For each provider that we appoint, we have put in place measures to ensure that your personal information is treated securely if it is transferred outside of the European Economic Area.  We will assess any third party applications that we use to ensure that they meet these requirements.

In order to engage with members of the public, we will also make use of social media platforms and other communications services, some of which are based outside of the European Economic Area.  If you share personal information with us, we may use these services to store or use your personal information.

Finally, the Commission is subject to access to information legislation, including the Freedom of Information Act.  If we receive a request under this legislation, we may need to disclose some or all of your personal information.  This may include information which has previously been removed by the Commission for publication purposes.  We will only do this if we are required to do so by law.