Homes for Ukraine Scheme: privacy notice

Overview

The Welsh Government and their public sector partners (local authorities and Health Boards in Wales) are data controllers for any personal data it collects, and any personal data which is shared with them by UK Government under the Homes for Ukraine scheme.

The purpose of this privacy notice is to tell you how the Welsh Government and partners will process your personal data for their shared purposes to deliver the scheme and the common objective of providing homes to those fleeing the war in Ukraine. You have rights concerning how your data is processed. We inform you here what those rights are and how you can exercise them.

The Welsh Government and partners are committed to protecting the privacy and security of your personal data. As the organisations have distinctive statutory responsibilities and accountabilities, they may publish separate privacy notices where appropriate which further explain how your personal data is used for their respective purposes.

We are only allowed to use, gather, and share personal information where we have an appropriate legal basis to do so. We only collect and process personal information to fulfil our legal and official functions. We will only use personal information when the law allows us to and where it is necessary and proportionate to do so.

What personal data we are processing

Your personal data is being processed and used to deliver the Homes for Ukraine scheme, for the purpose of supporting Ukrainian citizens during the arrival process and for the duration of any sponsorship arrangements in Wales. This will include providing and managing essential support services for those arriving in Wales, offers of support from organisations and individuals, including accommodation, and undertaking required safeguarding checks. The data we process includes:

For Ukrainian citizens

Your name, address, contact details, demographic data, visa status, passport number your intended UK destination, housing needs and the details of your travelling party.

For sponsors

We process your name, address, contact details, demographic data and details about your property and the outcome of property and safeguarding checks. We may also need to process and use personal data about others, such as your household members or others living in your property.

With whom we will be sharing the data and for what purpose

We will be sharing data with third parties, such as public sector partners in Wales and with UK Government. The public sector partners include:

• local authorities, to provide support to Ukrainian citizens and the hosts in their areas. For example, with access to accommodation, education and social care. It will also enable them to undertake property and Disclosure and Barring Service (DBS) checks
• health boards, to contact Ukrainian citizens to arrange health screenings (primarily for Tuberculosis) and arrange GP registration and other medical treatments as required
• Digital Health and Care Wales (DHCW), as data processors on our behalf, for the secure transfer and sharing of your personal data between ourselves, local authorities and Health Boards in Wales

Where necessary, we will also share personal information with charitable and private sector partners who will be delivering services on our behalf to support Ukrainian citizens, or where we are required to do so by law.

How your data is handled

Personal data provided to us is stored on secure servers. Personal, identifiable data shared with our public sector and other partners will only be transferred using accredited secure data transfer systems. Only data necessary for the delivery of support to Ukrainian citizens will be shared.

Personal identifiable data held by Welsh Government will be retained for the duration of the sponsorship scheme, and for a period of six months afterwards. Data may be retained for longer periods, including by our public sector partners, where there is a statutory obligation or ongoing requirement to do so. The data will be securely destroyed once it is determined that it is no longer required.

Lawful basis for processing the data

We are using the following lawful basis under UK GDPR to process personal data:

Article 6(1)(e) of the UK GDPR, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We may also process special categories of personal data which may include information about political beliefs, health, sexual orientation, religious beliefs, and biometrics. Where we do so our lawful basis is:

Article 9(2)(g) of the UK GDPR, processing is necessary for reasons of substantial public interest.

Your rights, for example: access, rectification, erasure

Under GDPR, you have the following rights in relation to the personal information you provide us to enable to support you, specifically you have the right:

• to access a copy of your own data
• for us to rectify inaccuracies in that data
• to object to or restrict processing (in certain circumstances)
• for your data to be ‘erased’ (in certain circumstances)
• to lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection

The contact details for the Information Commissioner’s Office are:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Phone: 01625 545 745 or 0303 123 1113

Information Commissioner’s Office website

Further Information

If you have any further questions about how the data provided will be used by the Welsh Government or wish to exercise your rights using the General Data Protection Regulation, please contact the Welsh Government’s Data Protection Officer at:

Welsh Government
Cathays Park
Cardiff
CF10 3NQ

Email: DataProtectionOfficer@gov.wales