Privacy notice and cookie policy

WY Metro privacy notice

This website is operated and controlled by West Yorkshire Combined Authority (‘the Combined Authority’). WY Metro, CityConnect, Weaver Network and Home Energy West Yorkshire are all brands of the Combined Authority, which remains the data controller and the responsible statutory body in relation to these brands.

Personal data we process and how we collect it

Personal data is data that relates to an identified (or identifiable) living person, directly or indirectly. The Combined Authority processes personal data for a variety of reasons and we usually collect the data directly from the person it relates to.

This could be, but is not limited to, when:

You share your views or experiences, in e.g.
- Consultation and survey responses.
- Community or stakeholder engagement sessions.
- Feedback and complaints.
- Case studies, for promotional material and success stories.

You make an application, e.g.
- To a programme run by the Combined Authority, such as a skills development scheme.
- On behalf of a business or organisation, such as to seek access to funding or bid for a tender.
- For a travel pass.
- For a job vacancy.

You attend our premises, e.g.
- By signing in as a visitor.
- On CCTV or body-worn video (BWV).

Occasions when we could receive personal data from other sources include, but are not limited to, scheme referrals from partner organisations, next of kin details provided by our employees, use of datasets such as Companies House, or contact from the police to locate missing persons, for example.

Purposes of personal data processing

At the Combined Authority, we typically use service-specific or programme-specific privacy notices which explain the processing that will take place for the reason you have come into contact with the Combined Authority. For example, if you apply for one of our vacancies, you will be given the Applications & Employment Privacy Notice, which outlines the personal data processing the recruitment process will involve.

Personal data is processed for the following general purposes:

Performing our statutory functions in relation to transport, service improvement, business, innovation, inclusive economy, regeneration, environment, housing and planning, adult education, skills training, policing, crime and violence reduction.
Supporting other public sector organisations in performing their statutory functions.
Planning for the future regional development of West Yorkshire.
Processing requests for information, complaints and casework.
Providing information where you have consented.
Legal obligations, including fraud protection and crime prevention.
Purposes related to the Policing and Crime functions of the Office of the Police and Crime Commissioner. For further information about these purposes, please see the Policing and Crime Privacy Policy.
The use of CCTV and BWV for preventing crime and ensuring public safety (more information below).
Research, performance monitoring, statistical analysis and evaluation of the services and programmes we co-ordinate or deliver (more information below).

CCTV and BWV

We use CCTV cameras for preventing crime and ensuring public safety. We may also disclose CCTV and BWV footage where it is lawful for us to do so and there is a legitimate purpose, such as when we have been approached by a law enforcement agency as part of an active investigation. For these reasons, the information processed may include visual images, personal appearance, and behaviours. In addition, there may instances where our staff use BWV technology in specific locations. Where BWV is used, this will be clearly sign-posted within the vicinity of the relevant area(s).

Research, performance monitoring, statistical analysis and evaluation

The Combined Authority uses data, which can include personal data, to monitor the performance of the programmes and services we offer, evaluate their impact and value, and to inform our strategic direction. We draw upon various sources and use a range of tools to analyse data and produce useful insights. We also speak to service users, scheme participants, partners and stakeholder groups, to gather opinions and feedback firsthand. Often we will use the help of specialist providers to carry out these types of activities.

Lawful basis for processing

We only process personal information when a lawful basis in Article 6 of the UK GDPR is applicable. The Combined Authority relies primarily on Article 6(1)(e), which states that ‘processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller’. This lawful basis is known as ‘public task’ and it is used when we are processing personal data to carry out our official functions as a Combined Authority.

On some occasions, the lawful basis of processing personal data may be:

Article 6(1)(a), which states that ‘the data subject has given consent to the processing of their personal data for one or more specified purposes’. For example, if we wish to create a case study for our website, we will only do this with the consent of willing participants.
Article 6(1)(b), which states that ‘processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject before entering a contract’. For example, this lawful basis applies when you have signed a contract to work at the Combined Authority.
Article 6(1)(c), which states that ‘processing is necessary for compliance with a legal obligation to which the controller is subject’. For example, we would disclose personal data if we were obliged to due to a court order.
Article 6(1)(f), which states that ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data’. For example, we make use of (or make available) tools and systems that can process personal data, such as assistive technology, on the basis of our legitimate interests.

Disclosure of personal data

We will only disclose your information to third parties when:

There is a business need to do so, as we may use other organisations to process data on our behalf, or run projects with our partners.
We are under a duty to do so, to comply with a legal obligation, or we are permitted to do so to protect the rights, property or safety of others. This includes, but is not limited to, exchanging information with other organisations for the purposes of fraud protection, crime prevention, and public safety. Should you wish to make a request for disclosure of third party data for crime or legal proceedings, where we are under a duty or are permitted to do so, please complete a request form for crime or legal proceedings and email it to freedom.info@westyorks-ca.gov.uk.
Where you have consented to your information being shared.

Personal data retention

We will retain your information in line with the period only for as long as it is necessary to do so. In cases where personal data forms part of a record, it will be kept under the relevant period specified in the Combined Authority’s records retention schedules.

International data transfers

In the event that we need to transfer personal information outside of the United Kingdom, we will take all steps reasonably necessary to ensure that the appropriate safeguards are in place and that your information is processed securely.

Your rights

Depending on the lawful basis on which your personal data is processed, you have various rights available to you under the UK GDPR. This means that you can contact us to request for your personal data to be edited, deleted, restricted, or for the processing to stop. You can also request a copy of the personal data we hold.

If you wish to request a copy of your personal data, please complete our ‘Subject Access Request (SAR)’ form.

If you wish for us to stop processing your personal data, please note this may result in the withdrawal of particular services you have requested from us, where the processing of your data is necessary for the delivery of those services. Opting out of marketing communications will not affect your entitlement to receive services from us.

If you are ever unhappy with how we have dealt with your request or the use of your personal data, you can contact the Information Commissioner’s Office at:

The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AX
Website: www.ico.org.uk
Email: casework@ico.org.uk

Contact details

If you wish to contact us about this privacy statement or to make a request, please use the following details:

DPO@westyorks-ca.gov.uk
The Data Protection Officer
West Yorkshire Combined Authority Wellington House
40-50 Wellington Street
Leeds
LS1 2DE

WY Metro cookie policy

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to help website's function, enhance the users experience, share statistical information to the owners of the site and support advertising and marketing activities.

When you first visit our website, we'll ask for your consent to use certain cookies. You can choose which types of cookies to accept or reject. Some cookies are strictly necessary for the website to work properly and don't require your consent. Others, like marketing cookies, will only be placed with your permission. You can change your cookie preferences at any time using the link in the footer.

We process cookies in accordance with the Privacy and Electronic Communications Regulations (PECR). Some cookies are exempt, under the Data (Use and Access) Act 2025, from consent requirements because they are strictly necessary for the service or fall under specific exemptions.

How we use cookies

Necessary cookies

Necessary cookies are needed for the basic functionality of a website. They enable core features such as traffic distribution, access to secure areas of the website, and other essential functionalities that make the website usable. Without these cookies, the website cannot function properly, and certain services or features may not be available to the user.

Examples of necessary cookies include:

Session cookies: These cookies store temporary information and are deleted once you close your browser. They are used to maintain the state of your session, such as keeping you logged in while you navigate through the site.
Authentication cookies: These cookies help identify and authenticate users, ensuring that only authorised individuals can access specific areas of the website.
Security cookies: These cookies are used to prevent fraud and protect your data, such as detecting and mitigating malicious activities.

Essential cookies do not collect any personal data for marketing purposes and are typically essential for the website to function optimally.

Preference cookies

Preference cookies allow our website to remember choices you make (such as language selection, text size, or other accessibility settings) and provide enhanced,

personalised features. These cookies don't require your consent as they're solely used to adapt the website to your stated preferences and improve your experience.

Statistics cookies

Statistics cookies are used to collect information about how visitors interact with a website. These cookies help website owners understand and analyse website traffic and user behaviour, enabling them to improve the functionality and performance of the site. The information gathered is aggregated and anonymised, meaning it does not personally identify individual visitors.

Examples of how we use statistics and analytics cookies include:

Performance cookies: These cookies collect information about how visitors use the website, such as which pages are visited most often and any error messages users may encounter. This helps website owners identify and fix issues and improve the user experience.
Analytics cookies: These cookies are used to gather data on user interactions with the website, such as the number of visitors, the time spent on the site, sources of traffic and user behaviours. We use Google Analytics, Microsoft Clarity and Hotjar to provide insights into website performance and user engagement.

By using statistics cookies, website owners can make data-driven decisions to enhance the overall functionality and user experience of their site, ensuring it meets the needs and preferences of its visitors.

Marketing cookies

Marketing cookies are used to track visitors across websites with the goal of displaying ads that are relevant and engaging to individual users. These cookies help in collecting data about users browsing habits and behaviours, which is then used to build a profile of their interests. This information is essential for targeted advertising and marketing efforts.

Examples of how we use marketing cookies include:

Personalised advertising: Marketing cookies help deliver ads that are tailored to your interests based on your browsing history, this may include retargeting adverts for websites you have previously visited.
Tracking advertising performance: Marketing cookies help measure the effectiveness of marketing campaigns by tracking actions such as clicks, conversions, and sales generated from specific ads.
Social media integrations: Marketing cookies enable the integration of social media functionalities, such as sharing buttons or embedded content.

By using marketing cookies, we can ensure that our ads are shown to the right audience, improving the relevance of the ads and the likelihood of engagement and conversion. This targeted approach benefits both the advertiser and user by delivering more relevant and useful advertisements.

Third-party cookies in embedded content

Embedded content from other websites such as videos and maps can also set cookies on your device. These third-party cookies may be used for a variety of purposes, including tracking user interactions, collecting usage data, and delivering personalised content or advertisements.

We capture YouTube cookies, but you are able to reject them. We also embed Vimeo videos, which may set cookies to store player preferences and collect limited analytics to improve video performance. Essential cookies are required for the videos to play, while non-essential ones are only set with your consent.

The Combined Authority does not control the dissemination of any other third-party cookies. You should check the third-party websites for more information about these. This cookie policy only applies to the West Yorkshire Combined Authority website and does not cover other websites or services to which we may link.

Third-party embedded content on our websites include:

YouTube videos: YouTube uses cookies on videos embedded on our website to enhance user experience by tracking video performance and player preferences.

Vimeo videos: Vimeo uses cookies to ensure videos play correctly, remember user settings, and gather limited performance data.

Alerts 71 Bus