Full Privacy Notice

Welsh Youth Parliament: Full Privacy Notice

This notice sets out how the personal information is collected and used by the Welsh Youth Parliament.

In this notice, we or us refers to the Welsh Youth Parliament. However, the Welsh Youth Parliament is not a legal entity in its own right. It is made up of sixty individual members (WYPMs), who have been either elected by young people on a regional basis or elected by young people from partner organisations, and is run and managed by the Welsh Parliament.

Generally, it is the Welsh Parliament which is responsible for your personal information. In some circumstances, both the Welsh Parliament and individual WYPMs are responsible.

Please read this notice carefully to understand how we will use your personal information. If you have any questions or queries in relation to this notice, please contact the Welsh Parliament’s Data Protection Officer at: Data Protection Office, Welsh Parliament, Tŷ Hywel, Cardiff Bay, Cardiff, CF99 1SN.

data.protection@senedd.wales

This notice explains:

1. Personal information we may collect about you
2. Our legal basis for collecting, holding and using your personal information
3. Your rights
4. Security and sharing of personal information

Please note that this notice only applies to the collection and use of personal information by the Welsh Youth Parliament. Our website contains links to the websites of other organisations for which we are not responsible. We encourage you to read the privacy policies of other websites you visit.

 

1. Personal information we may collect about you

As part of our work, we may collect personal information about you in a variety of different scenarios. These are set out in more detail below:

 

A. Participating in WYP events

If you book to attend events arranged by us, we will collect your contact information and any information regarding your accessibility requirements. We will keep this information until the event administration has finished. We often capture digital content at these events – please see the section below for further information on how this is information will be used.

Sometimes we manage event bookings by using a company called EventBrite. Details about how EventBrite will use your information are available on their website:

• For details about EventBrite's security: https://www.eventbrite.co.uk/security/
• For details about EventBrite's privacy: https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_GB
• For details about EventBrite's EU – US Privacy Shield notice: https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eu-us-privacy-shield-notice?lg=en_GB

 

B. Subscribing to our newsletters

You are able to subscribe to our newsletter online or in person by attending various activities which we arrange. We use a company called MailChimp to do this. If you subscribe in person leaving your contact details on post cards, the Commission will add your details to the relevant mailing list for the newsletter, and a confirmation e-mail will be sent to you.

This information is retained until you unsubscribe, and you can contact us at any time to remove yourself from these distribution lists, and newsletter mailing lists.

• For details about MailChimp's security: https://mailchimp.com/about/security/
• For details about MailChimp's privacy: https://mailchimp.com/legal/privacy/
• For details about MailChimp's EU – US Privacy Shield notice: https://kb.mailchimp.com/accounts/management/about-mailchimp-the-eu-swiss-privacy-shield-and-the-gdpr

C. Completing our surveys

We produce online surveys using Microsoft Forms. We do this to get feedback on our activities, or because we want to collect your opinions on different issues.

Responses to surveys will be seen by Welsh Parliament staff, and used to create a summary report which may be shared with others such as WYPMs, Members of the Senedd and relevant external partner organisations.

The results of our surveys may be used to form reports and recommendations that will be discussed by Welsh Youth Parliament Members, and shared with relevant Members of the Senedd, Senedd Committees, and Welsh Government Ministers.

Extracts from contributions to this survey may also appear in materials available publicly on the Welsh Parliament websites (including the Welsh Youth Parliament website), in print, and promoted across the Welsh Parliament’s social media channels (including the Welsh Youth Parliament’s channels). This information will remain public indefinitely.

We will ensure that any materials that are shared with WYPMs, Members of the Senedd or other 3rd parties, or materials which are available publicly (including the report) will not contain anything which will
reveal your identity.

Survey responses will be deleted twelve months after the closing date of the survey. However, it may be necessary to retain survey responses for a longer period on secure Senedd ICT infrastructure until any subsequent reporting process has been completed.  We will not retain any survey responses beyond the end of this WYP Term (which is due to come to an end in March 2024).

If you complete a hard copy version please note that your answers will be entered into our survey via Forms.

Details on how Microsoft will use your information is available on their website:

• Details about Microsoft's privacy: https://privacy.microsoft.com/en-gb/privacystatement

D. Online forums

We may use third party platforms Loomio and Dialogue (which is owned by a company called Delib) to facilitate conversation online on different issues we are looking into so that you can provide feedback on certain matters.

Depending on the nature of the project and who we are seeking responses from, these forums may be run privately or publicly, and we may choose to moderate responses before they appear on the site. We will tell you if an online forum is run openly, and if moderation is in operation for each project.

If you respond to online forums which are run openly, responses will appear publicly. Anyone is able to participate in open online forums (once they have registered by creating a user name and provided their email address). Anyone will be able to see your contributions in open online forums, regardless of whether they have registered to the site or not.

When responding to closed forum, only other people who have been invited to participate can see your contribution and are able to participate.

We may use the information you provide to produce a summary report outlining the main themes, which is shared with WYPMs, Members of the Senedd and Welsh Parliament staff, and published on our website, promoted across social media channels, and appear in relevant reports. We may also respond to and communicate with you about your ideas, questions and comments. This information will remain public indefinitely.

The information collated will be removed from these sites six months after the closing date for responses. We will keep the contact details of those who have registered on the site on Welsh Parliament ICT infrastructure to provide updates on the project you have participated in, and to draw your attention to other opportunities to engage with the Commission on the subject matter which you had engaged with us on this occasion. You can unsubscribe at any time.

Details about how Loomio and Delib will use your information is available on their websites.

• For details about Loomio's security: https://loomio.gitbooks.io/manual/content/en/security_privacy.html
• For details about Loomio's privacy: https://loomio.gitbooks.io/manual/content/en/privacy_policy.html
• For details about Delib's privacy and security: https://www.delib.net/privacy?policy_version=v2

 

E. Engaging with us on social media

As well as using social media to put out information for awareness raising purposes, we encourage interactions, particularly those that can be fed into inquiries and consultations run by us. When this is the case, we will ensure it is made clear that your comments will be used to feed into these inquiries and consultations. In those instances, your responses to our social media posts (including your name/handle) could be passed on to WYPMs, Welsh Parliament staff and Members of the Senedd, and could appear in reports and other materials published on the WYP website, the Welsh Parliament’s website and social media accounts.

Content may include images, videos (live and archive), infographics and animations. The platforms we currently use include Facebook, Twitter, Instagram, YouTube, SnapChat, Wordpress and LinkedIn. Each of these individual platforms has a privacy notice which tells you about how they use your personal information.

If you share our content through social media, for example by liking us on Facebook, following or tweeting about us on Twitter, those social networks will record that you have done so and may set a cookie for this
purpose. By using those platforms you are agreeing to their terms of service. You may also engage directly with WYPMs on social media.

In order to manage our social media interactions we use the following third party providers:

Hootsuite: If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations. For more information, please see Hootsuite's Privacy Policy on how they process your data.

Orlo: If you send us a private or direct message via social media the message will be stored by Orlo. It will not be shared with any other organisations.

F. Using our website

If you contact us via our website for the purposes of registration, email subscriptions, and other engagement activities, your information will only be used for those purposes.

Our website also uses cookies. Cookies are pieces of data that are often created when you visit a website and are stored in the cookie directory of your own computer. See https://senedd.wales/en/help/Pages/cookies.aspx for more information about how and why we use cookies on our website.

Log files allow us to record visitors' use of the site. Log files do not contain any personal information or information about which other sites you have visited.

G. Focus groups

Sometimes we arrange focus groups with members of the public to gather people’s views and opinions on work that the Welsh Parliament Commission, or Welsh Parliament Committees are undertaking. At these focus groups, staff may make a written note to capture participants views, on occasion this can involve using audio or recording equipment to assist the facilitator in making accurate notes. The audio file will be deleted securely 12 months after the focus group took place.

We sometimes deliver focus groups virtually, by using Microsoft Teams. At these virtual focus groups, a member of Welsh Parliament staff will facilitate a discussion with participants who have been specifically
invited to take part in a closed group. We may record the virtual focus group to help compile a note from the session. If a recording is made, we will not share it publicly, and the recording will be deleted 12 months after the session took place.

A general summary of the themes and issues raised during focus groups, and quotes from participants, will be presented to Welsh Parliament staff and Members of the Senedd. These may also appear in reports published on the Welsh Parliament website, and appear in promotional content. These materials may reference specific groups who have taken part, but will not list the names of individuals who contributed, and will not be made attributable to individual respondents. Quotes which may identify individuals will not be used.

If you choose to provide your contact details in order to receive updates about the project you have taken part in, we will contact you to tell you what has happened afterwards, and to share reports and other relevant documentation relating to the project. We will retain your contact details until the project has finished (stored on Welsh Parliament ICT infrastructure).

We may also take pictures during virtual focus groups, please see the ‘Photos, filming and digital content’ section below for details on how this information is used and retained.

 

H. Photos, filming and digital content

We capture pictures and videos during events we may put on, during other activity designed to gather people’s views on different issues, and to demonstrate the work that we do to engage the public.

Images and video footage may be used to promote the work of the Welsh Youth Parliament and/or the Senedd and to engage with the people of Wales.

We publish images and video content on the Welsh Youth Parliament website, and on social media channels, it appears in print materials, it may get shown to WYPMs, Members of the Senedd and Welsh Parliament staff, and it gets shared with media outlets.

Some images and videos captured (particularly those of historic and ongoing business value) may be retained indefinitely and content that we publish into the public domain will remain there. The Welsh Parliament regularly reviews the digital content captured, and will not retain pictures and videos which are unlikely to be of any operational value going forward.

When we capture content from smaller groups or individuals we will seek people’s permission to ensure that those individuals are happy to have their picture taken, or be filmed.

If you do not want to appear in any pictures or videos, or want to ask a question about how your information will be used, please inform a member of Welsh Parliament staff before, or during the activity, or e-mail contact@senedd.wales.

WYPMs may also capture pictures and videos during their official activities, and outside of those events. WYPMs may post those images on their social media channels in order to promote their activities and better
engage with young people in Wales. If you do not want to appear in any pictures or videos, please speak to the WYPM or email us at contact@senedd.wales.

As part of their work, individual WYPMs may ask to record you talking about sensitive issues, such as your sexuality, your religious beliefs or your experience of health conditions, or take pictures of you which may include sensitive information (for example pictures taken of you holding banners or slogans showing your beliefs). You should only agree to this if you are content for your information to be used in accordance with this notice.

Images captured by WYPMs will be kept on password protected devices and will usually be kept for no longer than eight weeks.

 

I. Contacting your WYPM individually

In addition to contacting us via our website, online forums and surveys, or at our events, you may contact an individual WYPM to raise a particular issue, to give your opinion or simply to find out more about their activities. We want to hear your views, and encourage you to contact us by using either our email address at hello@youthparliament.wales or our dedicated social media channels.

Please note that, unlike individual Members of the Senedd or MPs, WYPMs are not expected to routinely undertake 'casework' on behalf of individuals.

If you do contact an individual WYPM directly, you will be sharing with them your personal information (such as your name and your opinion about an issue). The individual WYPM, supported by Welsh Parliament staff, will be responsible for ensuring that your personal information is only used for the purpose of their role as a WYPM and in accordance with this privacy notice.

The Welsh Parliament will give detailed guidance and support to each WYPM to ensure that your personal information is collected and used appropriately. Please ensure that you have read and understood how your personal information may be used before sharing your personal information with individual WYPMs. If you would prefer, you can contact us via our website or our surveys. If you have any questions or concerns about this notice, please contact us at data.protection@senedd.wales.

 

J. Complaints Against WYPMs

Our Conduct Concern and Complaints Policy sets out how the Commission deals with conduct concerns relating to, and complaints made against, WYPMs. Should you wish to make a complaint regarding a WYPM, you can contact the Senedd Commission by email at hello@youthparliament.wales, or over the phone at 0300 200 6565.

In order to progress the conduct concern or complaint, we will need to process some of your personal information. This will include your name, contact details, and any materials you provide that relates to the complaint itself. We will also process any written or electronic notes from meetings, and any other correspondence relating to the complaint and any communication detailing the outcome of any investigation (known as an “outcome report”). These have the potential to contain your personal data and will be retained dependent on the outcome of a relevant investigation, as detailed below.

If the conduct concern or complaint is dismissed, the outcome report (which, along with detailing the outcome of any investigation, will outline the details of the process undertaken and summarise key information) will be retained until the end of the following WYP election. All other material collected for the purpose of considering the conduct concern or complaint will be deleted after the investigation has been concluded and the outcome report issued.

Where the investigation determines that developmental actions and/or formal sanctions are required (such as a written warning or suspension), the outcome report will be retained until the end of the following WYP election (unless the WYPM complained of is re-elected, see below). All other material collected for the purpose of considering the conduct concern or complaint will be deleted at the end of the WYP Term during which the conduct concern or complaint was received.

Where a WYPM that has been subject to a conduct concern or complaint which results in developmental action and/or formal sanctions, and that individual is re-elected as a WYPM following the subsequent WYP Election, the outcome report from the current WYP term will be kept until the end of the next WYP Term. As above, all other material collected for the purpose of considering the conduct concern or complaint will be deleted at the end of the WYP Term during which the conduct concern or complaint was received.

Where the investigation determines that the WYPM should be dismissed, the outcome report will be retained until the WYPM is of an age which means they are no longer eligible to stand at another WYP Election. All other material collected for the purpose of considering the conduct concern or complaint will be processed as follows:

• If the WYPM does not exercise their right of appeal, other material will be deleted following the expiry of the 14 day period within which the WYPM is able to exercise this right;
• If the WYPM does exercise their right of appeal and the dismissal is upheld, other material will be deleted following the conclusion of the appeals process;
• If the WYPM does exercise their right of appeal and the dismissal is overturned, whether by dismissing the conduct concern or complaint in its entirety or by substituting a lesser sanction, the retention or deletion of other material will be dependent on the outcome of the appeal. Please see above for the appropriate retention period.

Access to information relating to a conduct concern or complaint, including personal data, within the Commission will be restricted to those Commission staff necessary to progress the complaint. Depending on the nature of the conduct concern or complaint, this may involve the Commission’s Human Resources Operations team or the Health, Safety and Safeguarding Manager.

Ordinarily, complaints will be treated confidentially unless it becomes necessary for us to share personal data with a third party (see below). Outcomes will not be put into the public domain by the Commission. Outcomes will be used internally within the Commission to consider any action that may be required following our investigation.

There may be occasions where it becomes necessary to share relevant information, including personal data, with third parties. This may include the police or child protection agencies, for example, particularly where we need to involve those third parties in order to assist us with any investigation carried out by us, or we are required to share information with them so that they can carry out their own investigation, for example in the case of a criminal investigation. We may sometimes be required by law to share certain information.

There may also be welfare, safeguarding or procedural reasons that mean we need to share personal data with a third party, for example where there is a danger to safety or a need to keep relevant parties informed during the process. Relevant parties may include partner organisations whom support a specific WYPM(s), as well as the relevant parent(s) / guardian(s) where a WYPM is under the age of 18 and any third party advocate support the WYPM through the process. We will only share personal information that is necessary and where we have a lawful basis for doing so.

 

2. Our legal basis for collecting, holding and using your personal information

Data protection law sets out various lawful legal bases (or ‘conditions’) which allow us to collect, hold and use your personal information. These are:

• We will sometimes collect and use your personal information based upon your agreement. This is known as 'consent'. We will always tell you where this is the case and ask you to agree before we collect your information. For example, if you sign up for our newsletter, we will ask you if you agree to receiving updates and marketing about the Welsh Youth Parliament and our activities.
• Where we are under a legal obligation which requires us to process your personal information. An example of this is where we need to collect information about you when you attend an event, in order to ensure your safety.
• Where we use your personal information to carry out our public functions. Although the Welsh Youth Parliament is not a legal entity itself, it has been set up to allow young people in Wales to make themselves heard and to give young people first-hand experience of how politics works. This is part of the Welsh Parliament's public function to support and promote democratic engagement in Wales. We will need to collect and use personal information in order to carry out this function. An example of this is when we collect and use personal information in order to organise events to promote the Welsh Youth Parliament.
• Sometimes it will be necessary for us to collect and use your personal information for the purposes of our own legitimate interests. In order to fully engage with young people in Wales, we need to hear from young people about the issues that interest them, and to collect some personal information about individuals. We will only collect and use your information where our interests are not overridden by your interests or your fundamental rights or freedoms. An example of collecting and using personal information in our legitimate interests where an individual WYPM collects opinions from their friends in order to raise a particular issue or concern.

Data protection law recognises certain "special categories" of personal information. These are defined as information revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning an individual's sex life or sexual orientation.

These special categories are considered particularly sensitive and so we do not routinely collect personal information falling within these categories. We will only collect and use these categories of information where you have given us your explicit consent or where we consider it is necessary and in the public interest to do so. An example of using this kind of information is where we have collected information about any disability you may have, in order for us to help you access our events.

 

3. Your rights

You have a number of rights in relation to the personal information that we hold about you. The rights which apply depend on the legal bases we are relying on to use your personal data. Those rights will not apply in all instances, and we will confirm whether or not that is the case when you make a request.

In summary the rights are:

• The right to be informed about how your personal information is used.
• The right of access to copies of your personal information.
• The right to rectification if your information is inaccurate.
• The right to erasure of your personal information.
• The right to restrict our use of your personal information.
• The right to data portability.
• The right to object to the use of your personal information.

Further details about these rights are available on the Information Commissioner's Office (ICO) website found here: https://ico.org.uk/

If you would like to make a request to us to exercise any of these rights, please email Information-request@senedd.wales. We will aim to respond to you within one month and we will not charge a fee for dealing with your request.

If you are dissatisfied with how we are using your personal information or if you wish to complain about how we have handled a request, please contact our Data Protection Officer and we will try to resolve any issues you may have.

You also have the right to complain to the Information Commissioner's Office, which is the statutory regulator for data protection law. Details of how to complain to the ICO can be found at https://ico.org.uk/concerns/.

 

4. Security and sharing of personal information

We take the security of personal information very seriously and have put in place measures to ensure that your information is kept secure.

As set out in this notice, we may share your information with others, including:

• WYPMs
• Members of the Senedd
• External partner organisations
• Third party requests e.g. media organisations, interest groups, charities, etc.
• Service providers (such as SurveyMonkey and Hootsuite)
• Our own professional advisers, auditors and insurers

We may also need to share your personal information with other people for legal reasons, such as courts and law enforcement agencies.

Third Party Requests

From time to time we get requests from third parties such as media organisations, interest groups, charities, etc. to contact people participating in the WYP’s work. We will not share your details with any third parties unless you have given your permission for us to do so. In those instances we will contact you, provide you with information about the nature of the third parties request, and ask if you are happy for us to share your contact details with them.

Our service providers may store your personal information outside of the UK or outside of the European Economic Area (which means countries in the European Union as well as Iceland, Norway and Liechtenstein). For each provider that we appoint, we have put in place measures to ensure that your personal information is treated securely if it is transferred outside of the European Economic Area. We will assess any third party applications that we use to ensure that they meet these requirements.

In order to engage with members of the public, we will also make use of social media platforms and other communications services, some of which are based outside of the European Economic Area. If you share
personal information with us, we may use these services to store or use your personal information.

Finally, the Commission is subject to access to information legislation, including the Freedom of Information Act. If we receive a request under this legislation, we may need to disclose some or all of your personal information. This may include information which has previously been removed by the Commission for publication purposes. We will only do this if we are required to do so by law.