Privacy policy Introduction At Migrant Help we are committed to protecting your privacy and being transparent about how we use your data. We will only use the information we collect about you lawfully in accordance with the Data Protection, Privacy and Electronic Communications Regulation 2019 (UK GDPR) and the Data Protection Act 2018 (DPA). This, together with our website terms and conditions, tells you about what we collect and how we use and store your personal information. If you have any queries about our Privacy Statement, please contact us at [email protected] How we collect information from you Migrant Help supports people in a number of ways, and we collect information in different areas. These include, but are not limited to: Asylum Helpline Regional offices around the country Modern Slavery Victims Care Services (MSVCS) Victims of Slavery Support Services (VSSS) Trafficking and Exploitation Support Service (TESS) UK Resettlement Scheme (UKRS) These services may be available on the website, by telephone, email, SMS, letter and face-to-face in a number of settings. Some of the information you give to us will be held on central systems and accessed by authorised staff employed by Migrant Help, our subcontractors, authorised suppliers, Commissioning Authorities and accommodation and payment card providers. Third Party Organisations You may have provided permission for us to share your data with third parties, including charities, statutory bodies, certification bodies, subcontractors, commissioners, accommodation and card providers. We will not share your data with these or other third parties unless we have your permission, or we have a legal obligation, or it is in in the public interest to do so. In these cases we will rely on the below legal bases for processing: Consent: the data subject has given their clear, unambiguous, specific consent Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations) Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law Transferring data outside the UK Where data is transferred from the UK to an EEA Country or to a third-party country, Migrant Help will ensure such transfers are protected by suitable and appropriate safeguards such as Standard Contractual Clauses (SCCs). Where necessary and subject to an assessment of risk, the use of such SCCs will be on a case-by-case basis. What personal data we collect and how we use it Any information we collect about you will:Be obtained and processed fairly and lawfully and shall not be processed unless certain conditions are met Be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with that purpose Be adequate, relevant and not excessive for those purposes Be accurate and kept up to date Not be kept for longer than is necessary for that purpose Be processed in accordance with the data subject's rights Be kept safe from unauthorised access, accidental loss or destruction Not be transferred to a country outside the European Economic Area, unless that country has equivalent levels of protection for personal data The type and quantity of information we collect and how we use it depends on why you are providing it. Lawful Basis Under the DPA we process data under the “conditions for processing”. Under the UK GDPR, this is our “lawful basis” for processing personal data. This policy documents our lawful basis. The lawful basis for processing data can include: Consent: the data subject has given his or her clear, unambiguous, specific Consent Contract: the processing is necessary for the performance of a contract we have with the data subject, or because the data subject has asked us to take specific steps before entering into a contract; Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations), for example retention of financial data for 6 years Vital interests: the processing necessary to protect the data subject's vital interests forexample the processing is necessary to protect the data subject’s life Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law Legitimate interests: the processing is necessary for legitimate interests pursued by us or a third party unless there is a good reason to protect the data subject’s personal data which overrides those legitimate interests. The purposes for which we process personal data for legitimate interests need to be set out in applicable Privacy Notices. The conditions for special categories of data, formerly known as sensitive data are: Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law Processing is necessary for carrying out obligations under employment, social security, social protection law or a collective agreement Processing necessary to protect the vital interests of a data subject where the subject is incapable of giving consent Processing is necessary for the establishment, exercise or defence of legal claims Processing is necessary for reasons of substantial public interest Processing is necessary for the assessing the working capacity of the employee Processing is necessary for reasons of public interest in the area of public health Under this basis, we rely on the conditions for specific processing: Client data - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and processing is necessary for the purposes of legitimate interests of the controller. Recruitment To process and administer your application for employment or volunteering with us, you will be asked to provide personal documents for identification processes and security checks. Please refer to our Data Retention Policy for reference to how long we will hold these documents for.We will ensure, where special category or criminal convictions personal data is processed, that: there is a record of that processing, and that record will set out the retention periods of the different categories of data where we no longer require special category or criminal convictions personal data for the purpose for which it was collected, we will delete it or render it anonymous ensuring that it cannot be retrieved data subjects receive full privacy information about how their data will be handled This type of data can include criminal records (for example, DBS checks), ethnicity, religious belief, health, sexual orientation, etc. For this type of data processing, we rely on the lawful basis of Legitimate Interest: the processing is necessary for legitimate interests pursued by us or a third party unless there is a good reason to protect the data subject’s personal data which overrides those legitimate interests. The purpose of processing this data is the prevention and detection of unlawful acts and/or equality of opportunity or treatment. Clients If contacting our Telephone Helpline for advice, issue reporting or assistance, the Data Storage Agreement and Data Release Storage information will be read to you in English, and you can request it be interpreted in an available language. Under our UK Resettlement Scheme, Modern Slavery Victims Care Service and Victims of Slavery Support Services, clients will be issued a Service User Consent Form and Data Protection Statement during induction, to be read aloud with an interpreter, where required. If you have contacted Migrant Help for advice and help, we may need to refer or liaise with other agencies such as: Accommodation Providers Educational services Healthcare services Home Office Payment Providers Police Social Services Utility providers Records of our work will be kept securely; these may be electronic or paper copy. Documentation will be kept in line with our Data Records Retention Policy. Any paper documentation is disposed of by secure shredding. Electronic files will be deleted securely by the IT Department. Donors If you support us by making a donation, you can do this via the website, by sending in a cheque or setting up a direct debit. We will collect the following details: Your name Your contact details Your bank or credit card details We will write to you to thank you for your donation and ask whether we can keep in contact. We will use your data to: Administer your donation or support your fundraising, including processing gift aid Ensure we know how you prefer to be contacted. We will ask you to give your permission via email, letter or telephone We do not sell or share personal details to third parties for the purposes of marketing. We will be very clear what will happen to your data when you register. CCTV We utilise CCTV at some locations. We comply with necessary legislation regarding signage. We retain footage for up to 30 days or in the case of an incident, longer as required to investigate or resolve the incident. The recording is then erased. Making a Complaint Migrant Help has a Complaints Procedure available on our website. Complaints may be reported in writing either via an email or using the complaints form, via webchat, by telephone or face-to-face. All logged complaints are given a unique reference number. Any complaints regarding Asylum Services will be shared with the Home Office quarterly. Any complaint regarding MSVCC will be shared with The Salvation Army upon receipt. How we keep your data safe and who has access Migrant Help ensure that there are appropriate technical controls in place to protect your personal details. For example, our online forms are always encrypted, and our network is protected and routinely monitored. We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained and vetted personnel. We may use external companies to collect or process personal data on our behalf. We do comprehensive checks on these companies before we work with them and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they collect or have access to. We may need to disclose your details if required to the government and regulatory bodies or legal advisers. We will only ever share your data in other circumstances if we have your explicit and informed consent, we have a legal obligation or it is in the public interest to do so. If you have any queries about this statement please contact the Head of Quality at Migrant Help, Charlton House, Dour Street, Dover, Kent, CT16 1AT or email [email protected] Your right to know what data we keep, how to make changes or ask us to stop using your data Clients, staff, newsletter recipients and donors of Migrant Help have the right to access any personal data that is being kept about them by Migrant Help. Any client who wishes to exercise this right should contact their adviser in the first instance; The organisation aims to comply with requests for access to personal information as quickly as possible but will ensure that it is provided within one month as per the UK GDPR guidelines. This can be extended where requests are complex or numerous, but the individual must be notified within one month of the receipt of the request and given an explanation why the extension is needed. For some of our services, Migrant Help is the Data (sub) Processor on behalf of the Commissioning Authority, who are the Data Controller. This means Migrant Help cannot provide access to the personal data held under these services without express permission from the Authority. If we receive a Subject Access Request by clients under these services, we will either forward the request to the Data Controller or inform you where to direct the request. Using our website What are cookies? Our website uses cookies to collect information. Cookies are small data files which are placed on your device when you browse a website. Cookies are essential to the effective operation of our website and improve the performance and your experience of using our website. They may be essential to some aspects of the website, for example if you are required to register to attend an event or purchase a service. Information collected Some cookies may collect information about browsing behaviour from the same device. This includes information about pages viewed. We do not use cookies to collect or record any personal information such as name, address or other contact details. How do I disable cookies? If you want to disable cookies you need to change your website browser settings to prevent cookies being stored. How you do this will depend on the browser you use. Typing: “How do I disable cookies” into any popular search engine will give you a list of pages showing you how to do this in your own internet browser. What happens if I disable cookies? This depends on which cookies you disable, but in general the site will not operate properly if cookies are switched off. IP Addresses IP addresses may be collected by analytical systems when connecting to our website, but these are not linked to individuals in our records. Newsletter Our website provides you with the option to sign up to our newsletter. If you sign up, we will store the information you provided securely and will only use it for communication purposes. You can unsubscribe from the newsletter at any point. Manage Cookie Preferences