Privacy
Privacy notice
How the Centre for Youth Voice uses information about you on this website and in the CYV Evidence Library, and what you can do about it.
Last updated 19 October 2026
In short
- You can read everything on this website and search the Evidence Library without giving us any details.
- We only collect personal information when you give it to us: by booking an event, speaking or appearing on camera in an online session we record, signing up to the newsletter, through the contact or submission forms, by submitting a report to the library, or by typing a question to the library's AI assistant.
- Event bookings are taken by Eventbrite on our behalf. Its booking form only loads on our pages when you press "Book your place".
- We count visits to the website and the Evidence Library with Umami, which uses no cookies and does not identify you. We do not use advertising or tracking cookies, and we never sell your information.
- Our online sessions are recorded and the recordings are published on this website. You can take part with your camera and microphone off.
- The library's AI assistant is open as a beta. Questions typed into it are sent to two AI companies (OpenAI and Anthropic) to produce an answer, and deleted after 30 days. Please do not type personal details into it.
- If you have a question, want to use your rights or want to complain, email [email protected].
Who we are
The Centre for Youth Voice (CYV) is a programme hosted by the Network of Regional Youth Work Units, which is why you see the Network's name in the footer of every page. For data protection law, the organisation responsible for your information (the "data controller") is Partnership for Young London, the charity that runs this website and the Evidence Library for the Centre. PYL is itself hosted by the City of London Corporation.
- Data controller
- Partnership for Young London, registered charity 1062226 and company limited by guarantee 03334117, both registered in England and Wales
- Address
- Guildhall, London EC2V 7HH
- ICO registration
- PYL is registered with the Information Commissioner's Office as a data controller, reference ZC274043 (since 13 October 2026)
- Email for anything about your data
- [email protected]
- Hosted by
- City of London Corporation. If a question needs the Corporation's data protection team, we will pass it on and tell you.
This notice covers two places: this website at centreforyouthvoice.org, and the CYV Evidence Library at evidence.centreforyouthvoice.org, which is built and hosted separately. Where the two work differently, we say so.
Each can also be reached at a second address on Partnership for Young London's own domain: cyv.partnershipforyounglondon.org.uk for this website and evidence.partnershipforyounglondon.org.uk for the Evidence Library. We set these up because some workplace web filters block newly registered addresses. They are the same sites, and this notice applies whichever address you use.
This website
Most of centreforyouthvoice.org is just pages to read. This is what happens with your information, feature by feature.
Reading pages
We count visits with Umami, a privacy-friendly statistics service. It records the address of each page viewed (in the Resource Library, the address includes any filters and search words you have used), the website that referred you, your browser and device type, and your approximate location (country, region and city), so we can see how the site is used and report to our funder. It sets no cookies, does not store your IP address, and does not follow you across other websites or build a profile of you. The same count covers the Evidence Library, so a visit to both is treated as one. We do not set any cookies of our own. The company that hosts the site, Cloudflare, sees the standard technical information every website receives when you open a page (your IP address, browser type and the pages requested) and keeps short-lived logs to keep the site running and stop attacks. The Evidence Library search boxes on our home and Data pages send what you type to the Evidence Library, which is covered below.
The contact and submission forms
When you use the form on the About page, we receive your name, email address and message so that we can reply. When you use the submission form to send us a case study or suggest a resource, we also receive your answers about it, plus your organisation and role if you give them. Both forms are delivered to us by a service called Web3Forms, which also runs messages through spam filters. Submissions are read by the Centre's team and the Youth Voice Ambassadors, and if you send a case study and leave the box ticked, an Ambassador may email you to help write it up. We use your details to reply, to keep track of the conversation and, if we use what you sent, to credit you. We do not add you to any list. Please do not send us personal details about young people.
If you choose a research report on the same form, your answers go to the Evidence Library's own system instead of Web3Forms. See The CYV Evidence Library.
Watching videos and recordings
Our recorded seminars, the films in Voices and the video on the Co-Assessment Tool page are hosted on YouTube or Vimeo. Where a video plays inside one of our pages, we use YouTube's privacy-enhanced mode, which does not set cookies until you press play, or Vimeo's player with its "do not track" setting switched on, which stops Vimeo setting cookies or collecting viewing statistics. Most of the recordings listed on Training & Events open on YouTube's own website instead, and a few older ones open on the Network's website. Once you play a video or open one of those websites, that provider may set its own cookies and collect viewing data under its own privacy policy.
Booking events
Our events are booked through Eventbrite. Each event has its own page on this website, and the booking form appears on that page when you press "Book your place". The form is Eventbrite's, shown inside our page. Nothing from Eventbrite loads, and no Eventbrite cookies are set, until you press the button. You can also book on Eventbrite's own website; the same applies there. A few events listed before we moved to Eventbrite in September 2026 are still booked through the Network's website, which uses Wix. We use those bookings for the same purposes and keep them for the same length of time.
| What | Details |
|---|---|
| What you give us | Your name and email address, which ticket you choose (for example practitioner or young person), and your answers to our booking questions: your organisation, where in the UK you are based, and, if you choose to tell us, any access needs. The access question is optional. |
| What we use it for | Running the event: confirming your place, sending the joining link and reminders, making access arrangements, managing the waitlist, sending the recording and slides afterwards, and counting attendance for our funder (as totals only, never names). |
| Eventbrite's role | For your booking, Eventbrite acts on our behalf and on our instructions (as our "data processor"), under a data processing agreement that forms part of its terms with us. If you have or create an Eventbrite account, Eventbrite also uses your account details for its own purposes, as a separate data controller, under Eventbrite's privacy policy. |
| Emails | We only email you about the event you booked. We will not add you to a mailing list unless you tick a box asking for news from us. Eventbrite may send you its own emails about other events; you can unsubscribe using the link in any of them or in your Eventbrite account settings. |
| Cookies | Once you open the booking form, Eventbrite may set cookies, as described in its cookie statement. Until then, none are set. |
| Where it is stored | On Eventbrite's systems, mainly in the USA. See Data outside the UK. We download attendee lists only when we need them to run an event. |
| How long we keep it | 24 months after the event, then we delete it from Eventbrite and from anything we downloaded. |
| Young people | Our events are for people aged 16 and over. If you are 16 or 17 you can book in your own right and have the same rights over your information as an adult. |
If you cannot or would rather not use Eventbrite, email [email protected] and we will book a place for you.
Being recorded at an event
Our online sessions are usually held on Zoom and are recorded, as our event pages say. Afterwards we publish the recording, and the slides if there are any, on this website so that people who could not come can watch. If you speak or turn your camera on, your name, voice or image may be in the recording. You can take part with your camera and microphone off. If you are in a recording and want that part removed, email [email protected] and we will edit it out or take the recording down.
The newsletter
If you type your email address into the newsletter box (in the footer of most pages on this website and the Evidence Library, and on the About page) and press "Sign up", we use it to send you our monthly newsletter: new resources, training dates, blogs from our Youth Voice Ambassadors, case studies and news from the Centre. Your email address is all we ask for. The newsletter is sent with Mailchimp, and the mailing list is kept in the Mailchimp account of the Network of Regional Youth Work Units, which hosts the Centre. The sign-up box is our own, so nothing from Mailchimp loads on our pages. Pressing "Sign up" sends your email address to Mailchimp and opens its confirmation page in a new tab, where Mailchimp may set its own cookies. Like most newsletter services, Mailchimp can show us whether an email was opened and which links in it were clicked. Every email has an unsubscribe link, and you can also email [email protected] to be removed.
Following us
Our LinkedIn page is run by LinkedIn and is covered by LinkedIn's privacy notice, not this one.
People named or pictured on the site
Our Voices pages name the Youth Voice Ambassadors, blog authors and the people quoted in case studies. Everyone named has agreed to appear. The site also shows portraits of the Ambassadors and photographs taken at our sessions and events. If you are named or pictured and want something changed or removed, email us and we will do it.
The CYV Evidence Library
The Evidence Library is a searchable collection of research reports about young people aged 16 to 25. You can search it and read every summary without an account and without giving us any details. Personal information comes in through four routes.
| What you do | What we collect | Where it goes | Kept for |
|---|---|---|---|
| Search and read reports | Nothing from you. Standard hosting logs (IP address, browser) and the words you search for. | Vercel (hosting), Algolia (search) | Provider defaults; short-lived logs |
| Ask the AI assistant | The questions you type. Your IP address is stored only as a scrambled code (a "salted hash") so we can limit how many questions each person can ask. | OpenAI and Anthropic (to produce the answer); Supabase, London (to store the conversation) | 30 days, then deleted automatically |
| Submit a report (the research report option on our Submit page) | The report link, the organisation you submit it for, your name and email address so we can tell you what happened, your answers to the permission questions, and any notes. | Supabase, London. We reply from our own email. | Until we decide on the report, then up to 12 months |
| Admin log-in (staff and interns only) | Work email address and password | Supabase | While the person needs access |
| Visitor statistics | Nothing that identifies you. Umami counts visits without cookies and without storing IP addresses, as on the rest of this website. | Umami | Up to 6 months, as totals only |
There are no public accounts on the Evidence Library, so you never need to sign up.
Report authors
Report records usually name the organisation that published them, but some also name the authors. We take these names from the published report itself or from the publisher's website. We show them because authors expect to be credited, and it helps readers find related work. If you are an author and a record is wrong, or you would rather not be named, email us and we will correct or remove it within a month. See For publishers and authors.
The AI assistant Beta
The assistant is open to everyone as a beta. It works, but we are still testing and improving it, so please read the limits below before relying on an answer.
Please do not type personal details into the assistant, about yourself or anyone else. It is built to answer questions about research, not about people. If you do type something personal, it is stored with the conversation for 30 days and then deleted. It is never used to build a profile of anyone.
How it works
- Your question is sent to OpenAI, which turns it into a set of numbers used to find matching passages in the library's reports.
- The matching passages and your question are sent to Anthropic, whose Claude model writes an answer using only those passages, and cites the reports it used.
- Automatic checks then remove any citation or number that does not actually appear in the reports it was given.
- The conversation is saved in our database in London so you can carry on the conversation, and is deleted after 30 days.
What it will not do
It will not give advice about your personal situation and will not answer from general knowledge. If the reports in the library do not cover your question, it says so. It cannot list or count reports; use search for that.
Known limits
The assistant can make mistakes, so check the cited report before relying on an answer. Coverage is uneven: some reports have little text, and the assistant sometimes plays safe and gives a shorter answer. Most reports are UK-wide, national or London-focused, so the English regions are less well covered.
What OpenAI and Anthropic do with your questions
Both companies process your question only to produce the answer, under their business terms with us. Under those terms, neither company uses questions sent to it this way to train its models, and each normally deletes them within 30 days. Either may keep a question for longer if its systems flag it as misuse or the law requires it to.
Limits on use
There is a limit on how many questions each person can ask per session and per day. This keeps the service free and fair for everyone; every question costs us money. The scrambled IP code described above is what makes the limit work.
Reports left out of the assistant
Publishers can ask for their reports to be left out of the assistant. Those reports stay listed and searchable but are never used to write answers.
Why we use your information
UK data protection law says we need a reason (a "lawful basis") for each use of personal information. These are ours.
| Use | Lawful basis | Why |
|---|---|---|
| Running the website and the library securely | Legitimate interests | We cannot run a website without hosting logs, and we need them to stop abuse. |
| Counting visits (Umami) | Legitimate interests | We need to know how the site and library are used, to improve them and report to our funder; nothing identifies you. |
| Answering your questions through the assistant | Legitimate interests | You asked a question and expect an answer; the processing is limited to producing it. |
| Limiting how many questions each person can ask | Legitimate interests | Keeps the free service available to everyone. |
| Replying to contact-form messages and submissions, and crediting people whose submissions we use | Legitimate interests | You contacted us and expect a reply. |
| Running events you book (joining link, reminders, waitlist, recording, attendance totals) | Legitimate interests | You asked for a place and expect us to run the event and follow it up. |
| Access needs you tell us about when booking | Explicit consent | Access needs can include information about health or disability, which the law treats as especially sensitive. You choose whether to tell us, we use it only to make arrangements for that event, and you can ask us to delete it at any time. |
| Recording online sessions and publishing the recordings | Legitimate interests | So that people who could not attend can still use the training. Our event pages tell you beforehand, you can take part without being seen or heard, and you can ask to be removed. |
| Naming Ambassadors, blog authors and people quoted in case studies | Consent | They agreed to appear and can ask us to change or remove it at any time. |
| Naming report authors in library records | Legitimate interests | Authors expect credit and readers need to find related work; the names are already public. |
| Staff and intern admin log-ins | Legitimate interests | Only the people who look after the library can change it. |
| Sending the newsletter, and anything else optional we add later | Consent | You sign up yourself and can unsubscribe or withdraw at any time. |
Where we rely on legitimate interests we have weighed our reasons against your rights, and we keep a record of that assessment. You can object to any of these uses; see Your rights.
You never have to give us your details. No law requires you to. If you would rather not, the only difference is that we cannot do the thing that needs them: we need your name and email address to book you a place at an event or to reply to a message, and your email address to send you the newsletter. Telling us about access needs is always optional.
No automated decisions. Nothing on this website or in the Evidence Library makes decisions about you with legal or similarly important effects.
Who we share it with
We use a small number of companies to run the website and the library. Most of them act only on our instructions and can only use your information to provide their service to us (they are our "data processors"). YouTube and Vimeo are different: when you play a video, they collect viewing information for their own purposes under their own privacy policies, as explained in Watching videos and recordings. We do not sell your information and do not use it for advertising.
| Company | What it does for us | Where it processes data |
|---|---|---|
| Cloudflare | Hosts this website, and stores the Evidence Library's backup copies | Global network; UK and EU data centres. The backups are stored in the EU. |
| Web3Forms | Delivers contact-form messages and website submissions to our inbox and filters spam | India, with servers in the USA and EU |
| YouTube and Vimeo | Host and play our videos and recorded seminars | USA |
| Eventbrite | Takes event bookings on our behalf, and sends confirmations, reminders and messages from us about the event | USA and EU |
| Zoom | Runs our online sessions and records them | Global (USA) |
| Wix | Takes bookings for the few events still listed on the Network's website | Global (including the USA) |
| Mailchimp | Holds the newsletter mailing list, in the Network's account, and sends the newsletter | USA |
| Vercel | Hosts the Evidence Library | Global (USA) |
| Supabase | The library's database and admin log-ins | London, UK |
| GitHub | Holds the library's code and runs its nightly backup. The backup passes through GitHub's servers on its way to Cloudflare but is not kept there. | USA |
| Algolia | Runs the library's search | Global (USA and EU) |
| OpenAI | Turns assistant questions into search numbers | USA |
| Anthropic | Writes the assistant's answers (Claude) | USA |
| Umami | Counts visits to this website and the Evidence Library without cookies | See Umami's privacy policy |
The Network of Regional Youth Work Units, which hosts the Centre, can also see two things: the newsletter mailing list, because it is kept in the Network's Mailchimp account, and bookings for the few older events still taken on the Network's website.
We would also share information if the law required it, for example to comply with a court order.
Data outside the UK
Some of the companies above process data outside the UK, mainly in the United States. When that happens, the transfer is protected by one of the safeguards UK law allows: the UK's adequacy regulations for the country concerned, the UK–US Data Bridge for companies certified under it, or the ICO's International Data Transfer Addendum built into our contract with the company. For example, Eventbrite is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge) and also signs standard contractual clauses. Email us if you would like to know which safeguard applies to a particular company.
How long we keep it
| Information | Kept for |
|---|---|
| Assistant conversations and scrambled IP codes | 30 days, then deleted automatically every night |
| Backup copies of the Evidence Library, which can include any of the library information in this table | Our own backups are deleted automatically after 14 days, and our database provider's after 7 days. Anything deleted from the library normally drops out of every backup within 14 days. |
| Contact-form messages, website submissions (case studies, resources, report contributions) and our replies | 12 months after we last reply, unless you ask us to delete them sooner |
| Event bookings (attendee lists), including any access needs | 24 months after the event, then deleted. Access needs are deleted sooner if you ask. |
| Seminar recordings, and names and pictures of people on the site | While they are still useful and current. We edit or remove them sooner if the person asks. |
| Newsletter sign-ups (your email address) | Until you unsubscribe. Mailchimp then keeps the address marked as unsubscribed so it is not signed up again by mistake; email us if you want it deleted completely. |
| Report submissions and the submitter's details | Until we have decided whether to list the report, then 12 months |
| Visitor statistics (Umami) | Up to 6 months. They contain no information that identifies you; we may keep the monthly totals for reporting. |
| Hosting logs | The provider's default, normally days to a few weeks |
| Admin log-ins | Deleted when the person no longer needs access |
| Author names in library records | While the report is listed, or until the author asks for the name to be removed |
Your rights
You have the right to:
- see the information we hold about you (a "subject access request")
- correct anything that is wrong
- have it deleted
- limit how we use it while a question is sorted out
- object to any use based on legitimate interests
- receive a copy of information you gave us in a form you can move elsewhere, where this applies
- withdraw consent at any time for anything you opted into
- complain to us, and to the Information Commissioner's Office, about how we have used your information (see How to complain).
To use any of these, email [email protected]. Tell us which right you want to use and what the information relates to (for example, "the message I sent through the contact form on 3 March"), so we can find it. We may ask you to confirm who you are. We will reply within one month. It is free, unless a request is clearly unfounded or excessive.
If you are under 18 you have exactly the same rights, and you can ask a parent, carer or trusted adult to help you if you like.
How to complain
You have the right to complain to us if you think we have not handled your information properly. Please tell us in whatever way suits you: email [email protected], use the contact form on our About page, or write to us at Partnership for Young London, Guildhall, London EC2V 7HH. You do not need to use any particular words, and a parent, carer, advocate or anyone else you choose can complain for you (we will check with you that they are acting for you before we look into it).
We will acknowledge your complaint within 30 days, look into it without delay, keep you updated, and tell you what we found and what we are doing about it.
If you are not satisfied with our answer, or would rather not come to us, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113. It will help the ICO if you give our registration reference, ZC274043.
Cookies and storage
This website sets no cookies of its own and uses no advertising trackers. Our visitor statistics (Umami) work without cookies or any other storage on your device. The only cookies you may get come from YouTube or Vimeo when you play a video (see Watching videos and recordings), and from Eventbrite when you open a booking form (see Booking events). If you sign up to the newsletter, Mailchimp may set cookies on its own confirmation page, which opens in a new tab; it sets none on this website.
The Evidence Library uses only strictly necessary browser storage: a token that keeps staff logged in to the admin area, and a small marker that lets the assistant apply its question limit to your session. Umami statistics work without cookies. Because none of this is used for tracking or advertising, no cookie banner is needed.
For publishers and authors
Both of our libraries list work published by other organisations: research reports in the Evidence Library, and toolkits, guides and evaluations in the Resource Library on this website. This is what we do with them and how to ask for changes.
What we do with reports and resources
Each record links to the original on the publisher's website. In both libraries a record shows a small image of the front cover, to help people recognise it. We are contacting publishers to check they are happy with this. If you would rather your covers were not shown, email us and we will replace them with a plain drawn cover.
In the Evidence Library, each record's summary and topic tags are drafted with AI from the report's text, and the assistant uses the text to answer questions. We keep a private archive copy of each report, which is only shown if the original link stops working and the publisher has agreed, and we may also save a copy to the Internet Archive's Wayback Machine. For the Resource Library we may keep a private backup copy of a resource on the same terms.
Why we can use the text
The assistant's use of report text is non-commercial text and data mining for research, which is permitted under section 29A of the Copyright, Designs and Patents Act 1988. The library is free, and answers always cite and link to the source report. Publishers have been, or will be, notified that their reports are included.
Opting out of the assistant
If you would rather the assistant did not use your reports, email [email protected] with the report titles or your organisation's name. We will confirm within 10 working days. Your reports stay listed and searchable, but the assistant will never use them to write answers.
Corrections and removal
Email us if a record has wrong details, a dead link, or you want a report removed altogether. Corrections and dead links are fixed within 10 working days; removal requests are acted on within a month, usually much sooner.
Suggesting a report
Anyone can submit a report for the Evidence Library, or suggest a resource for the Resource Library, on our Submit page. The Evidence Library's inclusion criteria explain what it includes.
Changes to this notice
We review this notice at least once a year, and whenever we add a new service or provider. The date at the top shows when it was last changed. If a change affects how we use information you have already given us, we will say so on this page and, where we can, tell you directly.
Last updated 19 October 2026. Next review by September 2027.