Privacy policy

Background and who is the data controller for the information we collect

Migration Yorkshire supports people and organisations to achieve the most positive outcomes of migration for everyone in the Yorkshire and Humber region. We provide leadership and coordination, evidence, and practical assistance to organisations from all sectors at local, regional and national level. We believe in improving understanding, supporting the integration of migrants and maximising opportunities for all to create a more equal and enriched society. Migration Yorkshire is a partnership of councils working across the whole of the Yorkshire and Humber region and we are based in Leeds. 

The purpose of this privacy notice is to tell you about what information we collect about you when you use our service, how we use that information and who we may share it with. It is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) to explain how Migration Yorkshire process your personal data to deliver its services.

Leeds City Council is the data controller for the purposes of the Data Protection Act 2018 and other regulations including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. The contact details of the data controller are Leeds City Council, Merrion House, 110 Merrion Way, Leeds, LS2 8BB.

The data we will collect

To deliver our services to you, we will process some or all of the following data:

• Name
• Date of birth
• Gender
• Nationality
• Address
• Telephone number
• Email address
• Languages spoken
• Information on family/dependents
• Education and/or employment information
• Financial information
• Recordings of meetings, focus group sessions etc.

We may also process some or all of the following Special Category data:

• Ethnicity (including immigration data)
• Religion
• Disability/health information
• Sexual orientation

Criminal offence data:

• details of offences (alleged or committed)
• convictions
• related security measures

The processing of special category data under Article 9 and criminal offence data under Article 10 are further supported by the following conditions in Schedule 1, Parts 1, 2 and 3:

• 1. Employment, social security and social protection
• 6. Statutory and government purposes
• 10. Preventing or detecting unlawful acts
• 11. Protecting the public
• 18. Safeguarding of children and individuals at risk

Some of the Schedule 1 conditions for processing special category and criminal offence data require an Appropriate Policy Document (APD) to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice.

How do we collect information about you

We collect information about you from you directly (e.g. by asking you to complete one of our forms, via emails or telephone calls, or via face-to-face meetings).

We may also obtain your information from other sources such as:

• Government departments
• Local authorities
• Voluntary sector partners
• Health providers
• Third party service providers i.e. Eventbrite, MS Forms etc
• Other relevant organisations

Why we process your data

We use your information:

• To provide you with the relevant service, for example refugee resettlement, events etc
• To better understand the needs and characteristics of the enquirer to ensure effective delivery of projects.
• To respond to your enquiry efficiently.
• To share relevant information with other local authorities, supporting organisations and partners where required (e.g. offers of help, or service delivery).
• To enable us to get in touch and provide you with up to date news and information.
• To gather and analyse data so we can plan how we provide services, and about participation and experience in relation to specific projects. Any data provided by you in relation to specific projects may be used to prepare a final report, which may be shared publicly. Data within these reports will be anonymised and will not contain any identifiable data.
• To check eligibility for specific services
• To make payments (e.g. expenses payments)

All the data collected will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). The data provided by you will only be used for the purpose(s) specified.

Lawful basis for processing

We will process your personal data in accordance with UK GDPR Article 6(1). The processing shall be lawful only if and to the extent that the following applies:

• Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject;
• Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) shall not apply to processing carried out by public authorities in the performance of their tasks.

We will process your special category data in accordance with UK GDPR Article9(2). The processing shall be lawful only if and to the extent that the following applies:

• Article 9(2)(a) – the data subject has given explicit consent to the processing of those personal data for one or more specific purposes;
• Article 9(2)(g) – processing is necessary for reasons of substantial public interest. This legal basis is underpinned by acts of legislation relevant to this processing.

This lawful basis is underpinned by acts of legislation listed below which set out functions and duties of local authorities relevant to this processing:

• Immigration and Asylum Act 1999
• Welfare Reform and Work Act 2016
• Children and Families Act 2014
• Children and Social Work Act 2017
• Children Act 1989
• Safeguarding Vulnerable Groups Act 2006
• Health and Social Care Act 2012

Withdrawing your consent

You have the right to withdraw your consent at any time. If you decide that you no longer wish to participate, please email admin@migrationyorkshire.org.uk.

When we receive a request to delete your personal data, it will be actioned within 7 days. Whilst we will aim to delete all your personal data, please be aware that we may not be able to remove data retrospectively that has already been used within analysis and reports.

Data retention, storage and destruction

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention. This means that your information will be kept for up to 12 months after we cease to provide a service to you unless the law says that we need to hold it for longer or if there is a business or contractual requirement to do so (e.g. project records for auditing purposes). After this, your information will be deleted or archived.

Who can we share your data with

We may share your data with individuals and agencies some of which are shown below:

• Internal Leeds City Council departments
• Project partners
• Service providers
• Health providers
• Other local authorities
• Education/training providers
• Government departments e.g. Home Office, DWP etc.

In addition, we will share your personal data:

• where such disclosure is necessary for compliance with a legal obligation to which we are subject;
• in order to protect your vital interests or the vital interests of another natural person;
• for the purposes of security and prevention of fraud and other criminal activity;
• where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

Automated decision making

Your data will not be used for any automated decision making, including profiling.

Your rights

The following rights under data protection law are available under the UK GDPR:

• the right to access – you can ask for copies of your personal data;
• the right to rectification – you can ask us to rectify inaccurate personal data and to complete incomplete personal data;
• the right to erasure - where you can ask us to erase your personal data;
• the right to restrict processing – you can ask us to restrict the processing of your personal data;
• the right to data portability - where you can ask that we transfer your personal data to another organisation or to you;
• the right to object to processing - where you can object to the processing of your personal data; and
• the right to complain to a supervisory authority – you can complain about our processing of your personal data

All data rights apply where we process your information based on your consent.

Where we process your information under legal obligation certain rights to do not apply, such as erasure, data portability, objection to processing and the right to withdraw consent.

Where we process your data under the performance of a contract basis, the right to object to processing following data rights does not apply. You can object to processing of your personal data by withdrawing your consent.

Where we process your data under the public task basis, the following data rights do not apply: the right to erasure, the right to portability and the right to withdraw consent.

These rights are subject to certain limitations and exceptions. You can learn more about your rights through the ‘Your individual rights page’, and the Information Commissioner's Office external link.

You may exercise any of the above rights in relation to your personal data by writing to us, using the contact details provided below.

When your data gets sent to other countries

The information you provide will not be transferred to another country outside of the EU.

Contact us

Any queries in relation to this Privacy Notice should be forwarded to:

Phone: 0113 37 88188
Email: admin@migrationyorkshire.org.uk

Migration Yorkshire

4th Floor West

Merrion House

110 Merrion Centre

Leeds

LS2 8BB

Data Protection Officer

Aaron Linden
Head of Information Management and Governance - Data Protection Officer
Leeds City Council
Merrion House
110 Merrion Way
Leeds
LS2 8BB
DPO@leeds.gov.uk

The Council privacy notice is available to view.

Complaints

If you are unhappy with the way in which your information has been handled, you should speak with Migration Yorkshire in the first instance.

Any data protection complaints about how Migration Yorkshire has processed your personal data, will be handled in accordance with the Leeds City Council’s Complaints Policy. You can find out how to submit a complaint by visiting this link.

If we cannot resolve your complaint, you can refer to the Information Commissioner if you consider that there has been an infringement of data protection legislation. Further details can be found on the Information Commissioner’s website.

Changes to this policy

We keep this privacy policy under regular review and we may update it from time to time. We will post any changes here, so be sure to check back periodically.

This policy was last updated in February 2026.