Privacy notice
The privacy notice for vote.wales / bwrwpleidlais.cymru
This privacy notice explains how the Electoral Management Board and the Democracy and Boundary Commission Cymru collects and uses personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are committed to being transparent about how we process your information and ensuring it is handled securely.
Introduction | vote.wales / bwrwpleidlais.cymru has been created by the Electoral Management Board to provide impartial, accurate and trustworthy information to voters. For more information about the website, please visit Why can I trust this website? The requirements for a Welsh Elections Information Platform are set out in legislation. For Senedd Cymru elections and Principal Council elections, the website must publish: ● official election notices issued by Returning Officers ● the location of polling stations and information on who is entitled to vote there ● accessibility arrangements at polling stations ● information about candidates and registered political parties standing at the elections ● election leaflets of political parties and individual candidates ● election results The website may also publish other information that supports participation in elections and democratic processes. We are committed to being transparent about how we process your information and ensuring it is handled securely. | |
Who are we | The Electoral Management Board (EMB) Responsible for the coordination of elections and referendums across Wales, and for the design, launch and hosting of the Welsh Elections Information Platform. The Democracy and Boundary Commission Cymru (DBCC) Appointed the data controller on behalf of the EMB. The DBCC is an independent arms length body of the Welsh Government. Contact details: Democracy and Boundary Commission Cymru, 4th Floor, Welsh Government Building, Cathays Park, Cardiff, CF10 3NQ Email: enquiries@dbcc.gov.wales | |
Voters | Candidates | |
The personal data we collect | We collect information about how you use the site, including: ● your IP address and browser version ● pages visited and time spent on each page ● how you arrived at the site ● what you click on while using the site Where you provide consent we use: ● Google Analytics cookies ● a Real User Monitoring (RUM) cookie from SpeedCurve If you have a Google account with ad personalisation enabled, anonymised demographic and interest data may appear in aggregated analytics reports. This helps us understand the general types of users visiting the site. We take steps to ensure you cannot be directly identified from analytics data by: ● removing or reducing personal information in event parameters for example, URLs, page titles, or link click data. ● not storing or logging IP addresses in Google Analytics ● not combining analytics data with other datasets in a way that could identify you | We collect the following personal data when you submit your election address: ● name of submitter ● email address of submitter We also store personal data on you that is provided by the Returning Officer. This includes: ● candidate and election agent names ● email address of candidates and election agent ● political party (where applicable) ● home address or relevant area Technical data: technical and security logs including IP addresses, browser information and access timestamp |
How we collect your data | Analytics data is collected automatically when you use the site, subject to your cookie preferences. | Returning Officers collect candidate and agent information during the nomination process for their own statutory purposes. They then securely share this data with us to support the online election address submission process. Analytics data is collected automatically when you use the site, subject to your cookie preferences.
|
Our legal basis for processing | Under the UK GDPR, we rely on Article 6(1)(a) – Consent. Used only where we specifically request your consent (e.g analytics cookies) | Under the UK GDPR, we rely the following legal bases: Article 6(1)(e) – Public task. Processing is necessary for us to carry out our official functions under the Welsh Elections Information Platform Regulations 2025. We do not: ● make decisions using automated means ● use your personal data for profiling |
How we will use your information | We collect your personal data in order to: ● improve our services through feedback ● respond to enquiries where requested ● monitor site security ● identify performance issues and errors ● analyse usage to ensure the site meets user needs | We collect and use your personal data to: ● verify that only authorised individuals can submit an election address ● ensure the submission process is secure and protected against cyber threats ● publish information required by law on vote.wales / bwrwpleidlais.cymru |
Sharing your information | Our software supplier may access some data as a data processor, acting strictly on our instructions. We may provide aggregated, non‑identifiable data to the relevant Welsh Minister for statutory reporting on the operation of vote.wales / bwrwpleidlais.cymru. | Our software supplier may access some data as a data processor, acting strictly on our instructions. We may provide aggregated, non‑identifiable data to the relevant Welsh Minister for statutory reporting on the operation of vote.wales / bwrwpleidlais.cymru. We publish certain information on vote.wales as required by law, including: ● candidate name ● political party (where applicable) ● home address or relevant area Email addresses of candidates, agents and submitters are never published. |
Children’s privacy protection | Our services are designed for voters. As the voting age for devolved elections in Wales is 16, our services are not designed for, or intentionally targeted at, children 16 years of age or younger. We do not intentionally collect or maintain data about anyone under the age of 16. | A candidate or election agent must be aged 18 or older. No children should be able to access the online election address submission system. |
International data transfers | No international data transfers are used in this platform. All data stays within the UK. | |
Data retention | Personal data will be kept for the length of time that is necessary to fulfil the purposes under which it was collected. | |
Your rights | You have the right to request: ● information about how your personal data is processed ● a copy of that personal data ● correction of inaccurate personal data ● where DBCC is not the creator of the data, we will forward your request to the relevant party You may also: ● raise an objection about how your personal data is processed ● request that your personal data is erased if there is no longer a justification for it (this is not applicable to candidates and election agents where their personal data is processed under public task) ● ask that the processing of your personal data is restricted in certain circumstances | |
How we protect your data | We use technical and organisational measures to keep your information secure, including: · encryption in transit and at rest ● strong authentication and authorisation controls ● secure IT systems and regular audits ● independent security testing ● staff training and data protection policies ● access based on role and necessity ● UK data residency | |
How do I complain if I am not happy | If you are unhappy with any aspect of this privacy notice, or how your personal information is being processed, please contact the Democracy and Boundary Commission for Wales’ at the details above. You may also contact the Commission’s Data Protection Officer at dataprotectionofficer@gov.wales. The Data Protection Officer provides independent advice and monitoring of the Commission’s use of personal information.
If you have a complaint about how your data has been processed, you must first make that complaint to the DBCC. You can make a complaint by contacting the DBCC or its Data Protection Officer, as above. If you are not happy with how the DBCC deals with your complaint, you then have the right to lodge a complaint with the Information Commissioner’s Office (ICO): Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Email: casework@ico.org.uk | |
Updates to this privacy notice | This privacy notice will be updated as required. The current version is the most up to date. | |