Privacy & global data protection
Privacy policy
WeVoi is a global speaking platform for young people aged 6–18. This notice explains how we collect, use, store, share and protect personal data — wherever you live. It is written to meet the EU General Data Protection Regulation (GDPR), UK GDPR and Data Protection Act 2018, and to honour equivalent rights under privacy laws in the rest of the world.
We do not sell personal data. Optional cookies stay off until you opt in. You can exercise your rights at any time via the rights request form or info@wevoi.org.
1. Who we are (data controller)
The controller of your personal data is WeVoi, 124 City Road, London, EC1V 2NX, United Kingdom. You can contact us at info@wevoi.org or +44 207 406 1459.
WeVoi is established in the United Kingdom. For the EEA we treat the UK Information Commissioner’s Office (ICO) as our primary supervisory authority for UK GDPR, and we will cooperate with EEA supervisory authorities and appoint an EU Article 27 representative if and when required. For Türkiye we act as data controller (veri sorumlusu) under Law No. 6698 (KVKK).
2. Scope and worldwide coverage
This policy applies to wevoi.org, new.wevoi.org, related apps, registrations, payments, the WeVoi Forum, We Talk clubs, school/agency partnerships, and communications. It is designed as a global baseline: we apply GDPR-level fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality and accountability wherever we operate, then add regional rights below.
Laws we align with include, without limitation:
- Europe: EU GDPR, ePrivacy Directive, UK GDPR, DPA 2018, Age Appropriate Design Code, Swiss FADP.
- Americas: US COPPA; California CCPA/CPRA and other US state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar); Canada PIPEDA and provincial laws; Mexico LFPDPPP; Brazil LGPD; Argentina PDPA and other Latin American frameworks.
- Türkiye: KVKK (Law 6698) and secondary regulations of the Personal Data Protection Authority (KVKK Kurulu).
- Middle East: UAE PDPL, Saudi PDPL, Qatar and Bahrain PDPL and similar.
- Asia: India DPDP Act 2023; China PIPL; Japan APPI; South Korea PIPA; Singapore PDPA; Thailand PDPA; Indonesia PDP Law; Philippines DPA; Malaysia PDPA; Vietnam PDPD and similar.
- Oceania: Australian Privacy Act and APPs; New Zealand Privacy Act 2020.
- Africa: South Africa POPIA; Kenya Data Protection Act; Nigeria NDPR/NDPA; Ghana DPA; Egypt PDPL and other national laws.
If a local law gives you a stronger right than this notice, we will honour the stronger right for that processing. If a law does not apply to a particular activity, we still follow this baseline.
3. Personal data we process
Depending on how you use WeVoi, we may process:
- Identity and account: name, email, password (stored as a hash), role (administrator, student, supervisor, judge, parent, team, manager, agency), account status, date of birth, country, city.
- Contact: WhatsApp/phone, school name, organisation, job title, website.
- Programme data: round registrations, age category, video submissions (typically a public YouTube URL), titles/topics, scores, medals, ranks, Forum bookings, vouchers, partnership applications.
- Payments: amount, currency, status and Stripe identifiers. Card numbers are processed by Stripe, not stored on our servers.
- Safeguarding and links: parent–child and supervisor–student links you create.
- Communications: contact-form messages, support emails, optional newsletters.
- Technical: IP address, user agent, session tokens, cookie choices, approximate location derived from IP, security logs.
- Public stage content: speeches you submit may be shown on results or highlight pages if you (or a parent/guardian) agree through programme rules.
We do not intentionally collect special-category data (health, religion, political opinions, biometric templates) unless you include it in a speech or message. Please do not include such data unless it is necessary for your topic.
4. Why we process data and legal bases
Under GDPR / UK GDPR we rely on one or more of the following for each purpose:
- Contract (Art. 6(1)(b)): creating an account, running rounds, taking payment, issuing medals/certificates, Forum tickets.
- Legitimate interests (Art. 6(1)(f)): securing the platform, preventing fraud, improving features, limited service announcements. We balance these against your rights, especially for children.
- Consent (Art. 6(1)(a) and ePrivacy): optional cookies, marketing emails, optional publicity. You may withdraw consent at any time without affecting prior lawful processing.
- Legal obligation (Art. 6(1)(c)): tax, accounting, safeguarding referrals, responding to lawful requests.
- Vital interests (Art. 6(1)(d)): rare safeguarding or safety emergencies.
In Türkiye, processing is based on KVKK Art. 5 (including explicit consent where required, contract, legal obligation, legitimate interest of the controller provided it does not violate fundamental rights). In other countries we map the same purposes to the closest local lawful ground (for example PIPEDA “reasonable purposes”, LGPD legal bases, POPIA justification, DPDP legitimate uses).
5. Children and young people
WeVoi is designed for ages 6–18. Children’s data is given extra protection under GDPR Art. 8, the UK Age Appropriate Design Code, COPPA (under 13 in the US), KVKK, and equivalent child-privacy rules worldwide.
- A parent or guardian must consent to registration for students under 16 (and under 13 in every jurisdiction). We may ask a parent account to be linked.
- We do not use children’s data for targeted advertising or sell it.
- Profiling of children for marketing is off by default.
- Submissions are programme content; parents/guardians should review videos before they are made public on YouTube.
- Parents may exercise rights on behalf of a child. See Safeguarding.
8. International transfers
WeVoi is used worldwide. Data may be processed in the United Kingdom, the EEA, and other countries where our processors operate. Where GDPR/UK GDPR requires a transfer tool, we use the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures where needed. For KVKK, PIPL, LGPD and similar, we apply the local transfer conditions (adequacy, consent, contract, or other permitted grounds).
9. How long we keep data
- Account and profile: while the account is active, then up to 24 months after last login unless you ask us to delete sooner (subject to legal holds).
- Competition records, medals and certificates: typically 7 years for programme integrity and awards queries.
- Payment and invoice records: 7 years (tax/accounting).
- Contact messages and privacy requests: up to 3 years after closure.
- Security logs: generally 12 months.
- Cookie consent records: up to 24 months, then you will be asked again.
We may keep a minimal record of deletion requests to show we fulfilled them.
10. Security
We use HTTPS, hashed passwords, session controls, access-restricted databases, and staff need-to-know access. No online service is perfectly secure. Tell us immediately at info@wevoi.org if you suspect unauthorised access.
11. Your rights (global baseline)
Wherever you live, you can ask us to: access your data; correct it; delete it (subject to legal exceptions); restrict or object to certain processing; receive a portable copy; withdraw consent; opt out of marketing; and opt out of “sale” or “sharing” where those concepts exist. Use the rights request form, email info@wevoi.org, or — if you have an account — download a copy from your profile.
We will verify your identity before fulfilling a request. We aim to respond within one month (GDPR/UK GDPR), 45 days (CCPA/CPRA, extendable), 30 days (KVKK and many other laws), or sooner if local law requires. There is usually no fee unless a request is manifestly unfounded or excessive.
12. European Union, United Kingdom and Switzerland
You have the rights in GDPR Articles 12–22 and 34: information, access, rectification, erasure, restriction, portability, objection (including to legitimate-interest and direct-marketing processing), and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may lodge a complaint with your local supervisory authority or the UK ICO (https://ico.org.uk/make-a-complaint/). Swiss residents have equivalent FADP rights, including access and the right to refuse disclosure to third parties for marketing.
13. United States, Canada and the Americas
United States. WeVoi does not sell personal information. California residents (CCPA/CPRA) and residents of other comprehensive state privacy laws may request to know, correct, delete, and opt out of sale/share, and are protected from discrimination for exercising rights. We honour GPC as an opt-out. Children under 13 are covered by COPPA: we require verifiable parental consent. Sensitive data is used only to run the programme you requested. See Your privacy choices.
Canada. We process data for purposes a reasonable person would consider appropriate (PIPEDA). You may withdraw consent for optional uses, access and correct your data, and complain to the Office of the Privacy Commissioner of Canada or a provincial commissioner.
Brazil (LGPD) and Latin America. You may confirm processing, access, correct, anonymise, port, delete, revoke consent, and information about sharing. Mexico, Argentina, Colombia, Chile and other countries have ARCO-style rights (access, rectification, cancellation, opposition) which we will honour through the same request form.
14. Türkiye — KVKK (6698 sayılı Kanun)
WeVoi, 6698 sayılı Kişisel Verilerin Korunması Kanunu kapsamında veri sorumlusudur. Kişisel verileriniz; hesap açma, yarışma/round kaydı, ödeme, değerlendirme, Forum, iletişim ve yasal yükümlülükler için işlenir. KVKK m.11 uyarınca: verilerinizin işlenip işlenmediğini öğrenme, bilgi talep etme, amacına uygun kullanılıp kullanılmadığını öğrenme, yurt içi/yurt dışı aktarılan üçüncü kişileri bilme, düzeltme, silme/yok etme, bu işlemlerin üçüncü kişilere bildirilmesini isteme, otomatik sistemlerle analize itiraz ve zararın giderilmesini talep etme haklarına sahipsiniz.
Taleplerinizi info@wevoi.org adresine veya hak formu üzerinden iletebilirsiniz. Başvurular KVKK ve Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ’e uygun olarak en geç 30 gün içinde sonuçlandırılır. Şikâyet için Kişisel Verileri Koruma Kurulu’na başvurabilirsiniz.
15. Asia, Middle East and Oceania
India (DPDP Act): you may access, correct, erase, and withdraw consent; we will honour grievance redressal through info@wevoi.org.
China (PIPL): we process personal information on consent or other PIPL bases necessary to provide the service you requested; separate consent is sought for optional marketing and non-essential cookies. Cross-border transfers follow PIPL requirements.
Japan (APPI), Korea (PIPA), Singapore / Thailand / Indonesia / Philippines / Malaysia / Vietnam: you may access, correct, and (where the law provides) delete or withdraw consent. We will not send marketing without consent where the local PDPA requires it.
UAE, Saudi Arabia and Gulf PDPL regimes: you may access, rectify, erase, restrict and withdraw consent as provided by local PDPL, via the same form.
Australia and New Zealand: we handle personal information in line with the Australian Privacy Principles and NZ Information Privacy Principles, including access, correction, and complaints to the OAIC or NZ Privacy Commissioner.
16. Africa
South Africa (POPIA): you are a data subject with rights of access, correction, deletion, and objection. Our information officer can be reached at info@wevoi.org. You may complain to the Information Regulator.
Kenya, Nigeria, Ghana, Egypt and other African states: we apply this policy’s baseline and honour statutory access, correction, deletion and consent-withdrawal rights through the rights form.
17. Automated decisions
Medal and ranking outcomes are produced from judge scores, not from solely automated profiling with legal effects. We do not use AI to decide eligibility in a way that produces legal or similarly significant effects without human review. You may object to any automated processing that does.
18. Complaints
Please contact us first so we can help: info@wevoi.org. You also have the right to complain to a supervisory authority in your country, including the UK ICO, your EU DPA, KVKK Kurulu (Türkiye), the US state Attorney General, OPC Canada, ANPD Brazil, POPIA Information Regulator, and equivalent bodies worldwide.
19. Changes to this policy
We will post updates on this page and change the effective date. Material changes (for example a new purpose or a new category of optional cookies) will be highlighted and, where the law requires, we will ask for consent again.
20. Contact
WeVoi
124 City Road, London, EC1V 2NX, United Kingdom
+44 207 406 1459
info@wevoi.org
Related pages: Cookie Policy · Exercise your rights · Do not sell / GPC · Terms · Safeguarding.