Privacy Policy

Who we are 

The National Assembly for Wales Commission is the data controller of your information, and will make sure it is protected and used in line with data protection legislation. Any queries regarding our use of your information should be sent to Assembly’s Data Protection Officer at:

Data Protection Officer

Ty Hywel

National Assembly for Wales

CF99 1NA

0300 200 6494

Why we are collecting your information?

We make efforts to engage the people of Wales and the wider public in our work, and draw your attention to activities which might be of interest. For us to do this, we collect information from people that we interact with in person and online. The information we collect online via Bang the Table’s Engagement HQ platform falls into the following categories:

  • Contact information, such as e-mail addresses. We will use this information if we need to contact users in regard to their contribution and, if they consent, to provide you with details on opportunities to take part in engagement projects run by the National Assembly for Wales. Users are also required to create a username when registering on the engagement platform, which may cause the individual to become identifiable when contributing to public forums;
  • Digital content like pictures and videos that we receive from users to support their contributions;
  • Information provided by individuals as part of their contributions will likely contain opinion and information on their experiences on a range of matters relating to the work of the Assembly. These contributions may contain personal data or special category personal data. This may include, for example, information as to an individual’s geographical location, and information about their health;
  • Data about how people use our online services which is used for statistical purposes and analysis for management purposes in order to administer the website or improve our services.

Our legal basis for using your information

The majority of the information that we collect and use is processed for the purposes of tasks that are in the public interest or in the exercise of official authority vested in us, pursuant to Article 6(1)(e) of the GDPR. Sometimes, however, we will rely on your consent to use your information, pursuant to Article 6(1)(a) of the GDPR.

We may also process special category (i.e. sensitive) personal data. Special category personal data is defined in the GDPR as including personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data, data concerning health or a natural person’s sex life or sexual orientation.

Where we process special category personal data, we will do so on the basis that it is necessary for reasons of substantial public interest, pursuant to Article 9(2)(g) of the GDPR, read in conjunction with paragraph 6 of Schedule 1 to the Data Protection Act 2018. In some instances, we may also rely on your explicit consent to use your information, pursuant to Article 9(2)(a) of the GDPR.

Bang the Table

We use Bang the Table’s Engagement HQ platform to facilitate conversation online on different issues the Assembly is scrutinising or to provide feedback on certain matters.

To contribute, we will ask people to register on the website beforehand. We do this in order to be able to provide you with updates on the project you have taken part in. Should we ask people to register in advance, we ask them create a username and provide us with their email address.

The username chosen will appear when users contribute on the platform, but all other information users provide about themselves when registering will not appear in public. Users can manage their account preferences here:

Users are also able to subscribe for updates to individual engagement projects on the platform. To subscribe we will ask for the person’s email address. The email address’ of those who subscribe will be removed from the platform 6 months after the closing date of the project. Users can unsubscribe at any time here:

Depending on the nature of the project and who we are seeking responses from, these forums may be run privately or publicly, and we may choose to moderate responses before they appear on the site. The Assembly will outline if the online forum is run openly, and if moderation is in operation for each project.

If you respond to online forums which are run openly, responses, including the chosen username, any comments made make, and any digital content users attach will appear publicly. Anyone is able to participate in open online forums (once they have registered on the site). Anyone will be able to see contributions made in open online forums, regardless of whether they have registered to the site or not.

When responding to a closed forum, only other people who have been invited to participate can see contributions and are able to participate.

Contributions made on the platform will be deleted 6 months after the closing date for response. Once the end contract date has been reached, any information Bang the Table hold will be deleted after 90 days.

Details about how Bang the Table will use your information is available on their website. Their privacy policy can be accessed at:

For details about Bang the Table’s security and privacy:

Will personal data be shared or publicised?

Contributions on public forums may be shared with Assembly Members and Assembly staff, published on our website, promoted across social media channels, and appear in relevant reports. This may include direct quotes from responses. We may also respond to and communicate with users about their ideas, questions and comments. This information will remain public indefinitely.

Your rights

You have certain rights over the information we hold. These include: the right to see the information; to correct it; to have it erased; if it is inaccurate; to have it removed; and to limit our use of it. Not all of these rights will apply in all instances.

If you would like to: engage any of the rights that you have under data protection legislation; ask a question; or make a complaint about how your information is used; please contact the Commission’s Data Protection Officer. Contact details are provided above.

You can also make a complaint to the Information Commissioner’s Office (ICO) if you believe we have not used your information in line with the law. The ICO’s contact details can be found on their website.

Requests for information made to the Commission 

In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that you provide. This may include information which has previously been removed by the Assembly for publication purposes. We will only do this if we are required to do so by law.

Changes to this privacy notice

If this privacy notice changes in any way, we will place an updated version on this page. Visit this page regularly to ensure that you are aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties. Paper copies of the privacy notice may also be obtained from the Data Protection Officer.