This privacy notice explains how Cardiff Council (as a Data Controller) will collect, use, and protect personal data specifically with regards to the Homes for Ukraine Sponsorship Scheme.
In order to provide support to Ukrainian citizens fleeing the conflict in Ukraine, Cardiff Council and our local public sector partners will be processing the personal identifiable data of those people and those who are sponsoring them to come to the UK.
What types of personal data do we process?
The types of personal data we process include, but are not limited to:
- Name
- Date of birth/Age
- Gender
- Contact information
- Details of anyone travelling with you
- Identity information to perform relevant checks
- Visa application data
- Bank details if you receive the Scheme payment
We may also process special categories of data including:
- Safeguarding information
- Data concerning health
- Personal data revealing racial or ethnic origin
- Personal data revealing religious or philosophical beliefs
We may, in this current crisis, need to ask you for personal data including sensitive personal data that you have not already supplied - for example, your age or if you have any underlying illnesses or are vulnerable. This is so the Council can assist you and prioritise its services to support those who need them the most.
How do we obtain your personal data?
The data will be collected from multiple sources, including UK Government departments, and directly from individuals. We will only collect the information that is necessary to support Ukrainian citizens being sponsored to come to Cardiff either by Welsh Government or by other individuals and organisations in the UK.
How do we use your personal data?
The data will be processed to support Ukrainian citizens during the arrival process and for the duration of any sponsorship arrangements in Cardiff.
This will be for the purposes of providing and managing essential support services.
If we have information indicating that you are vulnerable or in need of support, we may contact you to ensure your safety and to assist you where possible
What is our lawful basis for processing your personal data?
We will process your personal data in pursuance of our public task and the official authority vested in us under UK GDPR Article 6 (1) (e).
Where the information amounts to special category data, we will process it in the substantial public interest of protecting vulnerable people under UK GDPR Article 9 (2) (g).
Where we collect criminal data, for the purposes of checks carried out on sponsors and refugees, this is processed within the Council under Article 10 of the UK GDPR.
How long will we retain your personal data?
Personal identifiable data held by Cardiff Council will be retained for the duration of the sponsorship scheme, and for a period of at least six months afterwards. Data may be retained for longer periods, including by our public sector partners, where there is a statutory obligation or ongoing requirement to do so. The data will be securely destroyed once it is determined that it is no longer required.
The organisations we may share your personal data with
We will only share personal data insofar as it is necessary to support Ukrainian citizens, or where we are required to by law.
Personal, identifiable data shared with our public sector and other partners will only be transferred using accredited secure data transfer systems. Only data absolutely necessary for the delivery of support to Ukrainian citizens will be shared.
We may share your personal data with other departments within Cardiff Council and external organisations we work with. These may include:
- Our staff – where the information is vital and required for their work.
- Our partners – strictly in line with agreed procedures.
- Welsh Government
- Police
- Health Board
Your data may also be shared externally with organisations to carry out safeguarding checks and provide services.
Your personal data will not be transferred outside of the UK.
Your data protection rights
Under data protection law, you have rights including:
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at dataprotection@cardiff.gov.uk.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.ukExternal link opens in a new window
Contacting Data Protection
Please contact the Data Protection Officer for further information.
Data Protection Officer
Information Governance Team
County Hall
Atlantic Wharf
Cardiff
CF10 4UW
dataprotection@cardiff.gov.uk