Homes for Ukraine visa sponsorship scheme: privacy notice

The Ministry of Housing, Communities and Local Government (MHCLG) and the Home Office are data controllers for the Homes for Ukraine visa sponsorship scheme.

The purpose of this privacy notice is to tell you how MHCLG and the Home Office will process your personal data for their shared purposes to deliver the sponsorship scheme and the common objective of providing homes to those seeking refuge from the war in Ukraine. You have rights concerning how your data is collected and used for this purpose. We inform you here what those rights are and how you can exercise them.

MHCLG and Home Office are committed to protecting the privacy and security of your personal data. As our two departments need to use different personal data for separate purposes, , we may publish separate privacy notices where appropriate which further explain how your personal data is used for their respective purposes.

Read more details of how the Home Office will use your personal data, including your data protection rights: Borders, immigration and citizenship: privacy information notice.

MHCLG – our general privacy charter is available here

We are only allowed to use, gather, and share personal information where we have an appropriate legal basis to do so. We only collect and processes personal information to fulfil our legal and official functions. We will only use personal information when the law allows us to and where it is necessary and proportionate to do so.

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and ourthe Home Office Data Protection Officer

MHCLG hasand Home Office each have an appointed Data Protection Officer (DPO) to help ensure that the departments fulfil their legal obligations when processing personal data. You can contact DPO:each DPO respectively, or both:

MHCLG DPO@communities.gov.uk or by writing to the following address:

2.

Home Office DPO@homeoffice.gov.uk, or by writing to the following address:

Data Protection Officer
Home Office
2 Marsham Street
London,
SW1P 4DF

What personal data we are collecting and why

We collect your name, work email address, other contact details (including postal address), and details about offers of accommodation that you submit. It may also be necessary to provide personal data about others relating to your offer.

For anyone who provides data to us, we may also collect certain technical data like your IP address, in order to manage delivery of our sponsor application portal.

Future research

If a decision is later made to undertake research in order to inform policy development on the Homes for Ukraine Scheme, this may involve processing your personal information. For example:

• for applicants - information about you may be provided to us by your sponsor
• for sponsors - information about you may be provided to us by your guests

If any special category personal data is inadvertently supplied to us during future research, we will delete or anonymise this at the earliest opportunity.

For individual sponsors

We collect your name, address, contact details (including email), and details about your property. We may also need to collect and use personal data about others, such as your household members or others living in your property.property, or someone you have nominated to be a sponsor.

For

If a decision is made to undertake research to inform policy development on the Homes for Ukraine permissionScheme, holdersthis may involve processing information about you which has been provided by your guests

For visa applicants

In circumstances relating to the re-matching of visa applicants and sponsors we will hold your name, address, and contact details. We will use this information to help keep you advised of the options available to you.

For unaccompanied minor visa applicants 

If you are a child travelling to the UK who is: is:

• not travelling with a parent or legal guardian; or 

  or

• is travelling to join a parent or legal guardian 

  guardian

We collect your name, date of birth, passport number or identification document number and visa application reference number. We use this information to support local authorities in their safeguarding obligations to minors travelling without a parent or legal guardianguardian, andincluding toidentifying qualitychildren assurein claims for local authority fundingcare forto minorsallow whoquality subsequentlyassurance moveof intocare local authority care.  claims.

For parents or legal guardians of children/minors children/minors

We collect data to confirm parental consent for sponsorship arrangementsarrangements; for unaccompanied minors (not travelling with you or to join you or a legal guardian), and to contact you in the event of a change in circumstancescircumstances. where new parental consent documents are required. If your child is travelling to the UK to join you or a legal guardian, we will collect your name, address,address and contact details (including email). We will also collect this data for your child’s next of kin. kin.

Organisations and non-governmental organisations (NGOs)

We collect your name, work email address, other contact details (including address), and details about offers of accommodation that you submit. If you need to provide additional personal data relating to your offer, we will process this as well.  

Future

For research

anyone who provides data to us, we may also collect certain technical data like your IP address, in order to manage delivery of our sponsor application portal.

IfWe may collect personal information if a decision is made to undertake new research in order to inform policy development on the Homes for Ukraine Scheme,scheme, thisfor may involve processing your personal information. For example: example:

• forIf applicantsyou are an applicant - information about you may be provided to us by your sponsor 

  sponsor

• forIf sponsorsyou are a sponsor - information about you may be provided to us by your guests 

  guests

See the Homes for Ukraine user research privacy notice.

If any ‘special category’ personal data is inadvertently suppliedcollected to us during any future research, we will delete or anonymise this at the earliest opportunity. opportunity.

Please note: For anyone who provides data to us, we may also collect certain technical data like your IP address, in order to manage delivery of our sponsor application portal. 

How the personal data is used for the scheme to operate

MHCLG

MHCLG collects individual sponsor and organisational offers of accommodation that are submitted submitted for the scheme via our portal on the UK Government website, GOV.UK. We have overall responsibility for compiling, maintaining and managing the central repository of data necessary to collect information about accommodation offers, sponsors and guests from Ukraine.Ukraine so that these can be matched with visa applicants.

Home Office

ForThe howHome Office is responsible for processing visa applications for the purposes of the scheme and will do so under its borders, immigration and citizenship privacy policy. Home Office visa approval or rejection data will be submitted to the repository of data managed by MHCLG.

The Home Office may usealso yourprocess personalthe data you submit for necessary vetting of sponsors as part of the matching process, which may involve a check against Police National Computer records and yourrelated rightssafeguarding pleasechecks.

Both read:MHCLG Borders,and immigrationthe Home Office will use the data that we  collect to enable suitable and citizenship:safe privacymatches informationof notice.sponsors and organisation offers of help with applicants that have been visa cleared.

Local authorities

Local authority data is shared with the Home Office to flag any safeguarding concerns through a platform which matches hosts with Ukraine visa holders in the UK (Share).(Foundry). localLocal authorities also use a platform called Jira for safeguarding outcomes covering sponsor and accommodation checks and sponsor and guest withdrawals.

Visa applicants

After your visa has been granted, your personal data maywill also be used by local authorities to produce management monitoring reports for MHCLG on local delivery of the scheme. Once produced, these reports only contain anonymised data and will not contain any identifiable personal data about you.

Parents or legal guardians of visa applicants travelling as a minor

If you are a parent/legal guardian of a visa applicant travelling as ana unaccompanied minor (i.e., who is not travelling with you or to join you), MHCLG will use your personal data you have provided to us to confirm parental consent for the sponsorship arrangements. LocalMHCLG authorities will also use this information to contact you in the event of a change in circumstances of the sponsorship arrangement. If we are unable to contact you in this event, we will use the data you provided to us as being your child’s next of kin.

3. Lawful basis for processing the data data

We are relying on the following lawful basis under UK GDPR to process personal data:

• Article 6(1)(e) of the UK GDPR – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority

If it becomes necessary to process special categories of personal data which may identify religious, political orpolitical  or health information ,information  , sexual orientation, andorientation,  and biometrics, our lawful basis for this will be:

• Article 9(2)(g) of the UK GDPR – processing is necessary for reasons of substantial public interest.
• DPA 2018, Part 2, Chapter 2, section 8 (d) – the exercise of a function of the Crown, a Minister of the Crown or a government department.

4. With whom we will be sharing the data

For the purposes of the scheme’s delivery, MHCLG and the Home Office may need to share your personal data with parties workingparties  working to match potential sponsors with applicants to the scheme. These parties currently include:

• localLocal authorities, so that they can take forward local placement in homes when a suitable match has been made

  made;

• theThe UK Devolved Administrations (Scotland,(Scotland Wales and NorthernWales), Ireland), to deliver necessary processing to fulfil their obligations under the Homes for Ukraine Scheme, and to deliver offers of suitable sponsors to visa cleared applicants to the scheme and to undertake suitability checks

  checks,
• Home Office will be sharing nationality data with MHCLG and Devolved Administrations. Nationality data is treated in the same way as special category data in the Home Office because it can be used in some cases as a proxy for race or ethnicity

whenWhen personal data is shared with these parties, that organisation will take on responsibility for your data at that point, and you should refer to their own privacy notice for details on how they will process your datadata.

A list of voluntary and community sector organisations running programmes which help to match people coming from Ukraine with sponsor in the UK, and alsoand  also help people living in the UK to become sponsors as part of the Homes for Ukraine Scheme can be found at: at: Find a sponsor using recognised providers: Homes for Ukraine.

Data processorsProcessors

MHCLG appointsand the Home Office appoint organisations to process personal data on their behalf and these are regarded as ‘data processor’. These organisations act under the instruction of MHCLG and the Home Office to help analyse the applications and responses to support the matching of potential sponsors with applicants or for the purpose of visa applications. Where this is done, MHCLG and Home Office will ensure that the processing of your personal data remains in strict accordance with the requirements of UK data protection legislation and we will update this privacy notice to reflect those arrangements where necessary.

• “Homes for Ukraine: record your interest” GOV.UK service – MHCLG hasuses built the form which is linked from GOV.UK – to electronically collect individual sponsor submissions and submissions from organisations.

• Palantir and MadeTech – MHCLG has appointed athese third-party suppliercompanies Madeto Techassist towith providethe technicalcollation, support.secure Thetransmission formand issharing hostedof onyour cloudpersonal infrastructuredata locatedwith local authorities in London,England Unitedand Kingdom. the devolved administrations.

• ShareFoundry Homes for Ukraine data (Share) – MadePalantir Techoperates also assists with supporting this MHCLG-owned secure analytical platform, for cleansing and analysing personal data. The platform is hosted on cloud infrastructures located in London,Dublin, UnitedIreland.

• MHCLG Kingdom.is also using a secure platform run by the Department and based in Dublin, Republic of Ireland for the purpose of cleansing and analysing personal data collected under the Homes for Ukraine scheme.

• Jira –- MHCLG and local authorities also share data via this platform where enquiries, mostly operational delivery, but on occasion safeguarding matters are submitted then triaged by XBPXPB a third-party contractor who provides a first line response where appropriate, but also ensures the message finds the appropriate MHCLG lead if a more detailed response is required. All personal identifiable information is removed from Jira by XBP before forwarding to MHCLG Operational Delivery team. Although there are exceptions such as when a guest cannotcan’t be located on ShareFoundry by the local authority.

ForHow how long we will we keep theyour personal data, or criteria used to determine the retention perioddata

Your personal data will be kept only as long as it is necessary for these permitted purposes which includes matching suitable host with Ukrainian visa holder, undertaking accommodation and safeguarding checks and policy research.checks.

For data relating to the initial expressions of interest exercise sent by prospective hosts of Ukrainian guests, this will be held for two years from the closure of the site unless MHCLG identifies that its continued retention is unnecessary before that point.

5.

Is Yourany rights,personal e.g.data access,sent rectification, erasure 

overseas?

YouPalantir havecarries theout rightsecurity to:

• askchecks uson whatstaff personalusage datalogs ofand yoursundertakes wethis are processing and to request access to it
• be informed about how and why your data is being used (e.g., in a privacy notice)
• have your data rectified
• the rightUS. toData objecttransferred (ininclude certaina circumstances)
• thesmall portabilitynumber of yournon-vulnerable dataadults, (instaff, certainvolunteers circumstances)
• not to be subject to a decision based solely on automated means; and
• complain tosuppliers. theTransfer InformationRisk CommissionersAssessment Officeconcluded (ICO),that theall UK regulator for data protection

More information about your data protection rights can be found on the ICOcategories website: The rights of individuals.

6.personal Sendinginformation databeing overseas

Notransferred data is sent overseas – all logs, and Apps are deployedlow in AWS, and logs/tables/ etc are all in the UK (London) risk.

MHCLG will send personal data to a secure analytical platform (Share)(Foundry) assistedoperated by a third-party processor, MadePalantir, Tech, hosted on cloud servers located in London,Dublin, UnitedIreland. Kingdom.The Republic of Ireland is a country judged as having equivalent data protection standards to the UK.

7.

Automated decision making

and profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement).

MHCLG and the Home Office may use personal information from previous visa applicants to develop tools that allow the assessment and processing of applications in a particular way, to help us to target resources and ensure processing is efficient and allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases and any such processing will comply with our wider obligations under equality legislation.

8.

Storage, securitysecurity, and data management

MHCLG and the Home Office both have a duty to safeguard and ensure the security of your personal data and comply with data protection legislation. We do this by by having a secure systemsystems and policies in place to limit access to your information and prevent unauthorised disclosure, accidental loss, or unauthorised alteration of your data. We have also procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9.

Your data protection rights  

You have the right to:

• ask us what personal data of yours we are processing and to request access to it
• be informed about how and why your data is being used (e.g., in a privacy notice)
• have your data rectified, erased or restricted (in certain circumstances)
• the right to object (in certain circumstances)
• the portability of your data (in certain circumstances)
• not to be subject to a decision based solely on automated means; and
• complain to the Information Commissioners Office (ICO), the UK regulator for data protection

More information about your data protection rights can be found on the ICO website:

The rights of individuals.

Complaints and more information

If you have concerns about the way that MHCLG has acted when using your personal data, you can can make a complaint to usus.. If If you remain unhappy with the outcome of your complaint, you should contact the relevant Data Protection Officer at the addressaddresses above in the first instance.

If your complaint relates to how your data has been used for visa application purposes, please refer to the Home Office privacy notice link provided above.

If you remain dissatisfied, you have the right to raise a concern with the ICO via their website at: at: Make a complaint about how an organisation has used your personal information  or or by writing to them at:

Telephone: 0303 123 1113 or 01625 545 745
https://ico.org.uk/