Data protection laws require us to provide you with information about our use of your personal data, and this privacy policy explains how we collect, use and protect personal data, including data you provide to us when you get involved with Young Voices and what your rights are in relation to that data. Where we use the phrase ‘personal data’ we are talking about any information about an individual which enables that person to be identified.

  1. Important information about us and this policy

Data Controller

Young Voices (UK) Limited is the data controller, which means it is the entity responsible for your personal data. We refer to Young Voices (UK) Limited as "we", "us" or "our" in this privacy policy.

Contact Information

If you have any questions about this privacy policy, whether these relate to requests to exercise your legal rights (which are detailed in section 9 below) or otherwise, you can contact us in one of the following ways:

By email: [email protected]

By post: Young Voices, Grove Mews, 1 Coronation Road, Birchgrove, Cardiff CF14 4QY

Updates to this policy

We review this privacy policy periodically. This version was last updated in August 2026.

Who does this policy apply to? 

This privacy policy applies to users of our website at youngvoices.co.uk (“Website”) who are simply browsing the Website, and in some instances communicating with us. 

If you set up a ‘Teacher Centre’ account, a ‘Parent Account’, access the ‘Music Room’ or use the Young Voices Shop, please refer to the separate Privacy Policy included when you set up/access those services.

  1. What types of personal data do we collect?

We may collect, use, store and transfer various kinds of personal data about you, depending on the ways in which you interact with us. Below are the different types of data we collect:

  • Contact Data: this includes names, email addresses and in some instances telephone numbers, as well as contact preferences.
  • Technical Data: this includes internet protocol (IP) address, cookie data, location data (including the city and country you are based in), browser information, browser and plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to view our communications, as well as the time and date of your visit. 
  • Usage Data: this includes information about how you interact with and use our Website, such as the pages that you have visited, how you interact with us on social media and any projects or services you may have participated in or supported.
  • Marketing and Communications Data: this includes your preferences in receiving marketing and other communications from us and others authorised by us, if you have provided us with your contact details.

We may also collect, use and share ‘aggregated’ data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal any person’s identity. For example, we may aggregate Usage Data from lots of individuals to calculate the percentage of users accessing a specific website feature or opening a specific email, to analyse trends in how users are interacting with us.

  1. How do we collect your personal data?

We collect data from and about you in various ways, including:

  • When you provide it directly to us, such as if you get in touch with us. This includes personal data you provide when you:
  • contact us whether in person, by phone, post, email or social media.
  • sign up to receive marketing and other communications from us.
  • give us feedback. 
  • When you interact with us, via social media or with any emails or messages we may send you. We may automatically collect Technical Data about your equipment, browsing actions and patterns. We may collect this personal data by using cookies, server logs and other similar technologies. 
  1. How do we use your personal data?

Legal basis for use

The law requires us to have a legal basis for collecting and using your personal data. You have provided us with your Contact Data and have given us your consent to use that data so that we can keep in contact with you, and we rely on your consent as the legal basis on which we use that data. 

We may also use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to enable us to give you the best and most secure customer experience. We use Technical Data and Usage Data to ensure we are communicating with you in the most effective way and about the things most relevant to you, based on your previous engagement and use. We do not use your personal data for activities where the impact on you overrides our own interests, unless we have your consent or are otherwise required or permitted to by law.

Purposes for which we will use your personal data 

We use your personal data for the following reasons: 

  • to communicate our plans, opportunities and other marketing communications and personalised suggestions to you. We use Contact Data and Marketing and Communications Data and rely on your consent to do this, as well as our rights under the Privacy and Electronic Communications (EC Directive) Regulations 2003. We retain this data for up to 12 months from submission by you.
  • to administer and protect our business, accounts and websites. We use Technical Data and Usage Data and rely on our legitimate business interests to do this (to enable us to run our business effectively). We retain this data for up to 2 years.
  • to use data analytics to improve our relationships with our Website users and other relevant third parties and measure and improve the effectiveness of the content on our Website, our communications and marketing. We use Technical Data and Usage Data and rely on our legitimate business interests to do this. This data is anonymised. We retain this data for up to 2 years. 

Direct marketing

When you contact us we may ask you to indicate your preferences for receiving direct marketing communications from us. If you opt in, you will receive these direct marketing messages from us unless you opt out of receiving them. We may also send you marketing communications if you have interacted with us in another way, pursuant to and in accordance with our rights under the PECR. 

We may also analyse Technical and Usage Data to form a view of which products, services and offers may be of interest to you so that we can make sure any marketing communications we send stay relevant to you. 

Third-party marketing 

We do not permit any third parties to contact you for their own direct marketing purposes, and will always get your express consent before we share your personal data with any third party for this reason. 

Opting out of marketing 

You can ask us to stop sending you marketing messages at any time by following the opt-out links included in our communications, or by contacting us using the contact information set out above.

Cookies

You can find information about how and when we use cookies in the Cookies Policy available on the Website.

  1. Do we share your personal data with third parties? 

Yes, sometimes we do. We work with various other businesses and suppliers to help ensure our Website and our business more generally runs smoothly, and so we may share your personal data with others where necessary. We will ensure that all third parties have agreed to respect the security of your personal data, to process it only for the purposes specified to them and in accordance with our instructions, and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes unless they have obtained your direct consent to do so.

We may share data from general website users with: 

  • Our legal and administrative suppliers, who are based in the UK.
  • Our customer relationship manager and administration support, including Klaviyo (based in the USA).
  • Our Website servers, which are UK based.

We may also share or transfer data if we choose to sell or merge any part of, or the whole of, our business with another, or we choose to acquire someone else’s business. If we do so, any new owners will be obliged to use your data in the same way as set out in this privacy policy, unless you agree otherwise.

Do we transfer data outside the UK? 

Some of the suppliers and partners we work with are based outside the UK, meaning that at times we need to transfer your personal data outside the UK to countries which have laws that may not provide the same level of data protection as UK law.

Whenever we transfer your personal data out of the UK to others, we ensure a similar degree of protection is afforded to it by putting in place an appropriate safeguard in line with guidance from UK data regulators. This may include: 

  • Transferring your personal data to countries which the UK deems will protect that data to an acceptable standard such as countries in the EEA and, in some cases, the USA where the third party is registered with the UK Extension under the EU-US Data Privacy Framework.
  • If we need to work with other businesses that do not fall into the above category, taking steps to ensure that an alternative arrangement is put in place in line with UK regulation, to ensure that they protect your data to an acceptable standard, for example an International Data Transfer Agreement or standard contractual clauses for international data transfers. 

If you would like more information about how we do this, or a copy of these contractual safeguards, please get in touch using the contact information above.

  1. Is your data secure? 

We have put in place reasonable and appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data only to our employees, agents and others who have an absolute need to access it, and they are authorised only to process that data in line with our instructions and are subject to a duty of confidentiality. 

If we suspect a personal data breach has taken place we will follow our own internal procedures, and will notify you and the relevant regulator where we are legally required to do so.

  1. How long do we use personal data for?

We have included information about how long we retain certain categories of data in the ‘Purposes for which we will use your personal data’ section above. We hold on to your personal data for as long as is reasonably necessary to fulfil the purposes we collected it for, and then to satisfy our legal, regulatory, financial and reporting obligations. We may keep personal data for longer if you make a complaint or if we reasonably believe there is a prospect of litigation in relation to our collection/use of your data.

To decide how long it is appropriate for us to keep personal data we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes without holding on to it, and any relevant legal, regulatory, financial or other obligations.

In some circumstances you can ask us to delete your data. You can find out more about this in section 8 of this data privacy policy.

We may choose to anonymise your personal data, so that it can no longer be associated with you, so that we can use it for research or statistical purposes. If we do this we may use the information indefinitely. 

  1. What are your legal rights?

Data protection laws give you various rights in relation to your personal data. You have the right to:

  • Request access (commonly known as a "subject access request"). This means we provide you  with a copy of the personal data we hold about you and enables you to check that we are lawfully processing it.
  • Request correction. This means you can ask us to correct incomplete or inaccurate data we hold about you, though we may need to verify the accuracy of the new data you provide to us.
  • Request deletion. In certain circumstances you can ask us to delete or remove personal data if there is no good reason for us continuing to process it. You can also ask us to delete or remove your personal data where you have successfully objected to us processing it (see below), if we have processed your data unlawfully or if local laws require us to delete it. We may not always be able to comply with your request for deletion if there is a specific legal reason, which we will notify to you, if applicable, at the time of your request.
  • Object to processing. If we rely on a legitimate interest (or those of a third party) as the legal basis for the particular use of your data you can object to us doing so. If you do object, we may in certain situations show that we have compelling legitimate reasons to continue to process your data, which override your right to object.
  • You can also object at any time for any reason to the processing of your personal data for direct marketing purposes. There is more information about this in section 4 of this data privacy notice. 
  • Request transfer. You can ask us to transfer the data we hold about you to you or to someone else. We will provide your data to you, or to the third party you have chosen, in a structured, commonly used, machine-readable format. This right only applies to automated information which you provided consent for us to use, or where we used the information to perform a contract with you.
  • Withdraw consent. You can do this at any time where we are relying on consent to process your personal data. If you withdraw your consent, we will have to block your access to our services. We will advise you if this is the case at the time you withdraw your consent.
  • Request restriction of processing. You can ask us to pause the processing of your personal data in one of the following scenarios:
  • If you want us to establish the data's accuracy;
  • Where our use of the data is unlawful but you do not want us to erase it;
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please get in touch with us using the contact information set out at the top of this privacy policy. 

We will not charge a fee if you ask to access your personal data (or you exercise any of the other rights), unless your request is clearly unfounded, repetitive or excessive (and in such circumstances we may, alternatively, refuse to comply with your request).

If you want to exercise any of these rights, we may need you to provide specific information to help us confirm your identity and ensure you have the right to access your personal data (or to exercise any of your other rights), so that we do not disclose your data to someone who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

We will do our best to reply to legitimate requests within one month, but sometimes it might take us longer, for example if your request is particularly complicated or you have made more than one request. We will do our best to keep you updated. 

  1. How do you make a complaint?

If you have any concerns about our use of your data or want to make a complaint, you can get in touch with us using the contact information at the top of this privacy policy. We would love the opportunity to deal with your concerns directly, so please do contact us initially. 

If you are not satisfied with our response, you also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. You can find their contact details on their website (www.ico.org.uk). 

  1. What else do you need to know?

Keeping your data up to date. It is really important that the personal data we hold about you is correct and up to date. Please let us know if your personal data changes at any time while you engage with us and our services, for example if you change your email address or phone number, so that we can make the necessary changes to our database.

Third party links. Our Website, communications, marketing emails and messages may in some instances include links to third-party resources including websites such as the Young Voices Shop, plug-ins and applications. Clicking on those links or enabling those connections may enable third parties to collect or share data about you. We encourage you to read the privacy/data use policy in place for such third parties, as we do not control how they collect, use or share your data.