Privacy Policy

Greater Manchester Immigration Aid Unit takes data protection and data security extremely seriously. This Privacy Notice explains the types of personal data we may collect about you; the legal basis for collecting the information, what we intend to do with the information and who we share it with. It also explains how we will store and handle that data and keep it safe.

We process personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679. These regulations are a significant upgrade on the way data protection is managed in the UK, protecting individuals’ rights in the collection and use of their personal data. Greater Manchester Immigration Aid Unit is committed to meeting the requirement in the new regulations and want to ensure that the personal data of clients, staff and others who work with us, are only collected because we need them, are kept safely, are not shared with anyone who should not see them and are disposed of when we no longer need them.

We know that there is a lot of information here, but we want you to be fully informed about your rights, and how the Greater Manchester Immigration Aid Unit uses your data.  We hope that the following sections will answer any questions you have. If not, please do get in touch with us.

We are only entitled to hold and process your personal data where the law allows us to. Personal data is any information that can be identified to a specific, living individual and processing means collecting, holding or using that information.

The reasons for collecting this personal data are to enable us to meet our contractual obligations with our funders, where applicable to conduct casework on your behalf, and to monitor our service to make improvements. The legal basis for processing this personal data is to a) to fulfil our contract with you as a client, and b) to meet the legitimate needs of Greater Manchester Immigration Aid Unit to monitor our services.

The current law on data protection sets out a number of different reasons for which we may collect and process your personal data. These include:

Contractual obligations

The main purpose for our holding your data is to provide you with legal and support services under the agreement we have with you. This agreement is a contract between us and the law allows us to process your data for the purposes of performing a contract (or for the steps necessary to enter in to a contract). We may also need to process your data to meet our contractual obligations to the Legal Aid Agency where you receive legal aid to fund your case or advice.

Legitimate Interests

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running the organisation and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our regulators, or to properly report to funders in cases where you have received services or advice obtained under a grant-funded service that we administer.

Legal compliance

If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.

Consent

In some situations, we can collect and process your data with your consent. For example, when you tick a box to receive email newsletters, or if you consent when signing up for certain services or when making gifts and donations to us. When collecting your personal data, we will always make clear to you which data is necessary in connection with a particular service/purpose.

We normally collect your data when you provide it to us or when it is provided to us by others. You may give us your data by email; through an online web form; on a paper form; over the telephone; face to face; or by post.

The type of data we collect depends on why we are processing your data. The data provided will typically be used for conducting casework, for fulfilling reporting, monitoring and audit requirements to our funders, and to request feedback from you about the service you received.

We only use your data for the purposes for which it was provided.  For instance:

Casework and Legal Advice

We maintain records of personal data, including special categories of personal data, as part of our legal advice and casework provision. This will include contact information as well as sensitive information about your case, provided directly from you, and/or via requests to the Home Office and any former legal representatives acting on your behalf. This data is collected in order for us to fully support you with your case, on the basis of our contract with you. When collecting this data we will clearly explain your rights to access this data, our privacy policy and how this data will be used. Where we collect data from people under the age of 18, we will ensure that this privacy notice and consent request is given in easy to understand language, and that appropriate additional provisions are in place.

You have the right to request access to this data in a format easily used; and the right to withdraw your consent for us to maintain this data. However, there are some circumstances where we will have the right to retain your data on the basis of our legitimate interests.

All legal advice and casework is recorded on AdvicePro, a web-based case management system based in the UK. AdvicePro will act as a data processer of this data. We will ensure that all personal data that is recorded through AdvicePro is accurate and will only record necessary, relevant information. Having reviewed AdvicePro’s privacy policy, we believe there are adequate security measures in place for the protection of personal data. You can review AdvicePro’s privacy policy here: https://www.advicepro.org.uk/privacy-policy/

Supporters

We maintain a database of supporters. This includes contact information and is managed through CiviCRM, for the purpose of sending e-bulletins about the work of the Greater Manchester Immigration Aid Unit. You will have subscribed to or have opted in to being included in this database.

CiviCRM is based in the US and therefore your data (name and email address) is transferred outside of the EU. However, we believe that, given the limited nature of the data being transferred, the US-EU Privacy Shield provides adequate data security and protection.

We also maintain records of other supporters, including external media partners, on Excel sheets.  This data is restricted to contact data that has been shared with us by you as the data subject; you have the right to request access to or deletion of this data.

If you are no longer happy for us to hold your details, at any time you can stop receiving emails from us by unsubscribing from the list, or updating your mailing preferences.

Donors

We accept donations through JustGiving, a donations portal.  Donor data is stored by JustGiving and we do not receive any personal data. However, we can log in to our JustGiving account to see the donor data, except for payment details, which we cannot see at all. Full details of the JustGiving privacy policy can be found at: https://justgiving-charity-support.zendesk.com/hc/en-us/sections/360000284793-GDPR-updates-on-JustGiving

When you visit the website

The Greater Manchester Immigration Aid Unit uses Google Analytics and cookies in order to analyse how the website is used and improve our service and your user experience. Aside from the approximate location (IP address), the information collected by Google Analytics is mostly anonymous and relates to site traffic, including browser information, device information and language.

When you browse our website, we do not collect additional information, such as your age, gender, interests, bank details or clickstream.  However, when you contact us via the website, we do collect personal information about you.

Our website may contain links to other websites that are outside our control and are not covered by this Privacy Policy. If you access other sites using the links provided, the operators of these sites may collect information from you that will be used by them in accordance with their privacy policy, which may differ from ours.

Use of Cookies

A cookie is a small piece of information sent by a web server to a web browser, which enables the server to collect information from the browser. Find out more about cookies on www.allaboutcookies.org. We use cookies to identify you when you visit this website and to keep track of your browsing patterns and build up a demographic profile. Most browsers will allow you to turn off cookies. If you want to know how to do this please look at the menu on your browser, or look at the instruction on www.allaboutcookies.org. Please note however that turning off cookies will restrict your use of our website.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

The website contact form

If you have used the form on our website to submit an enquiry – for example, to request legal advice, ask about volunteering, a media enquiry, a general enquiry, or report issues with the website – then we may collect your first/last name, email address, telephone number and your nearest town, along with details of your enquiry.

We only ask what is required in order to provide assistance on what you have requested. Queries submitted to ask for legal advice do often contain confidential and sensitive information. We record enquiries on paper files and in Excel spreadsheets; these are retained by GMIAU and we aim to confidentially destroy these within 18 months. We do not share data from these enquiries with any other party.  Additional personal data may be given via applications and enquiries about volunteering with GMIAU. We aim to confidentially destroy any initial enquiries that do not lead to a volunteering relationship within 18 months of the enquiry.

Personal data supplied by potential volunteers on the application form sent through the website form or email are maintained on Excel sheets and the application form is maintained in hard files.  When you complete this form you will be informed of how this data will be used and maintained, and informed of your right to request access to, or to withdraw, this data.

Personal data in respect of sole traders and partnerships

Some freelance workers, consultants and service users fall into this category.  We only collect as much data as needed to facilitate the agreement (typically provision of services to GMIAU or to render services to a customer by nature of our business relationship e.g. training and events) with them.  We will hold this data until we no longer consider it relevant for the purpose it was originally collected.  Until then we have a legitimate interest in keeping this information on our systems by nature of our business relationship.

We take protecting your data very seriously.  The data you give us may be subject to Legal Professional Privilege and is often extremely sensitive and confidential.

With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it.   We have clear data protection and information security policies and procedures in place, along with Regulatory and other legal obligations to keep your data safe. These are regularly assessed as part of our Quality Standards and compliance processes.

We protect our IT system from Cyber Attack. Access to your personal data is password-protected, and we regularly review and improve our security infrastructure.

We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.

IT Systems

Greater Manchester Immigration Aid Unit cares to ensure the security of personal data. When GMIAU collects information about you, we also make sure that your information is protected from unauthorized access, loss, manipulation, falsification, destruction or unauthorized disclosure. This is done through appropriate technical measures. For example, emails and our online forms are encrypted, our network is protected and routinely monitored, remote devices e.g. mobile phones and computers have password policies in place for staff to securely access the organisation’s IT systems. Our IT support company undertakes periodic review of our security to ensure we are protected.

Staffing and Internal Management

We undertake regular reviews of who has access to information that we hold, to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Staff have access to personal information on a ‘need-to-know’ basis so, for example, highly sensitive data such as employment records are only available to managers with the designated permissions to access and process that data.

We only keep your data for as long as is necessary for the purpose(s) for which it was provided.

Where we have provided legal advice, and with data relating to contracts with third party consultants or trainers etc., we will normally keep the data for 7 years after the case, matter or contract ends. For some matters/contracts we may decide that it is proper and appropriate to keep data for longer than 7 years. If we believe that your case/contract falls into this category, we will notify you.

For enquiries we will normally keep your data for 18 months after we receive your enquiry. For supporters who have consented to be included on our supporter database we will hold the data until the individual unsubscribes or withdraws consent, or when it becomes clear that emails and other communications are no longer being delivered.

We sometimes share your personal data with trusted third parties.  We only do this where it is necessary for providing you services or for the effective operation of Greater Manchester Immigration Aid Unit.

For example, we may share your data with experts; translators; secure file storage and destruction companies; auditors; and the company that securely hosts our off-site cloud storage servers.

The policy we apply to those organisations to keep your data safe and protect your privacy is as follows:

• We provide only the information they need to provide their specific services;
• They may only use your data for the exact purposes we specify in our contract with them;
• We work closely with them to ensure that your privacy is respected and protected at all times;
• If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Unless we state otherwise, your data is stored and processed within the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.

As noted above, supporter lists stored on CiviCRM are processed in the US but we believe that, given the limited nature of the data being transferred, the US-EU Privacy Shield provides adequate data security and protection.

If we ever have to share your personal data with third parties and suppliers outside the EEA, we will ensure that it is sent and stored securely and, where appropriate, we will seek your specific consent to do so.

You have the right to request:

• Access to the personal data we hold about you, in a digital format which you are able to use yourself.
• The correction of your personal data when incorrect, out of date or incomplete.
• The deletion of your personal data, for example when you withdraw consent; or object and we have no legitimate overriding interest; or once the purpose for which we hold the data has come to an end – although we are not required to delete your data where data where we are required to hold it for complying with our own legal obligations.
• That we stop any consent-based processing of your personal data after you withdraw that consent.

To request your information, please contact our named Data Protection Officer Denise McDowell at info@gmiau.org.

If we choose not to action your request, we will explain to you the reasons for our refusal.  In order to comply with your request, we may ask you to verify your identity.

Your right to withdraw consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.

Where we rely on our legitimate interest

In cases where we process your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113, or visit www.ico.org.uk/concerns. Please note that we cannot be responsible for the content of external websites.

Please note that this privacy policy is subject to change from time to time. It was last updated in June 2018.