Privacy NOTICE
This is a privacy notice of Ward Immigration Ltd, pursuant to the UK’s General Data Protection Regulation (GDPR), when applicable, with regard to personal data that we obtained by reason of the contact initiated by you or on your behalf and by reason of the engagement or possible engagement of our firm.
Please note that if you share data of other people with us, it is your responsibility to collect such data in compliance with local legal requirements. For instance, you should inform such other people whose data you provide to us about the content of this notice and obtain their consent, if necessary.
We take your privacy very seriously and are determined to protect your personal data. The purpose of this notice is to inform you how we look after your data. We’ll also tell you about your privacy rights and how the data protection law protects you.
Data Controller
The controller is Ward Immigration Ltd represented by Oliver Ward, Esq., with headquarters at 36-37 Albert Embankment, London, SE1 7TL (hereinafter also referred to as “Law Firm”). The controller can be contacted by email at the following address: oliver@wardimmigrationlaw.com or by phone at (+44) (0)203 579 8525.
Ward Immigration Ltd is registered with the Information Commissioners Office as a Data Controller. The company’s registration number is ZB541715. A copy of our registration certificate is available for download on the ICO website.
Types of personal data that we process
We may collect, use, store and transfer, the following kinds of data about you:
Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
Date of birth, gender and/or age, your nationality and/or citizenship status
Bank account details and tax status information
National Insurance number
Copies of passports and visas
Photographs
Client engagement information
Career history, job titles, work history, working hours, holidays, training records and professional memberships
Details of professional projects/engagements
Health information (including mental health)
Details of your assets and beneficiaries
Your marital status, family, lifestyle or social circumstances and other affairs, if relevant to the attorney-client relationship
Information about criminal convictions or offences.
We may collect, use, store and transfer, the following kinds of data about you:
necessary for the performance of the engagement agreement or for the taking of steps at your request prior to possibly entering into an engagement agreement;
necessary to fulfil a legal obligation incumbent on Ward Immigration Ltd (e.g., the duty of keeping tax and accounting records);
necessary for the legitimate interests (professional, corporate, organisational, and business) pursued by Ward Immigration Ltd or by a third party;
based on the legitimate interest of keeping contact with you and to inform you of important legal developments and news about our firm.
Some of the legal grounds for processing will overlap; several legal grounds may justify our use of your personal data.
The processing of data will be carried out to answer your inquiry and/or to be able to perform our professional engagement (preparation of petitions, visa applications). The data will also be processed for the following purposes:
To comply with tax, accounting, ethical obligations, or with other legal obligations imposed on us;
To obtain and maintain insurance coverage (in the unlikely case that the insurer requires a list of our clients or in other cases where the disclosure of client data to the insurer is required);
For Ward Immigration Ltd to be able to establish, exercise, or defend legal claims if necessary;
To analyse the profitability of our practice or one of more areas of practice;
To improve our services with the use of technology (e.g., cloud computing, electronic databases, etc.);
To process personal data when that processing is strictly necessary for the purposes of preventing fraud;
To maintain contacts with you and to inform you of important legal developments and news about our firm.
Personal data is processed in a variety of paper and electronic formats, including databases, and will be processed only insofar as it is necessary to carry out the above-mentioned purposes.
Special categories of personal data: legal grounds
We process special categories of personal data only when necessary for the establishment, exercise, or defence of legal claims in your interest or when authorised by you. We may process personal data relating to criminal convictions and offences or related security measures but only when the processing is authorised by law in compliance with Article 10 of the GDPR.
We may process special categories of personal data in the following circumstances:
Explicit consent;
To collect, hold and disclose data concerning your health to third parties, e.g. where disclosure of your health records or a medical examination is a condition of your engagement on a project.
To hold and disclose any criminal records information relating to you (including alleged offences) e.g., where disclosure of such information to a third party is a condition of your engagement on a project.
To create a client profile on our database to enable us to schedule US visa appointments and prepare US visa applications and petitions.
Processing is necessary to protect your vital interests or those of another natural person;
To collect, hold and disclose data concerning your health to third parties (e.g., where disclosure of your health records is necessary for a medical emergency).
The personal data we wish to process has manifestly been made public by you;
Processing is necessary for the establishment, exercise or defense of legal claims or whenever Courts are acting in their judicial capacity;
Processing is necessary for reasons of substantial public interest.
Consequences of The Failure to Communicate Personal Data
Regarding personal data necessary for the performance of the engagement agreement or the taking of steps at your request prior to entering into such contract, the failure to disclose personal data prevents the execution and the performance of the contractual relationship itself. In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.
Data security measures
We have put in place a range of security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
The specific measures we implement are as follows:
Antivirus software to scan files and processes looking for malicious software which it can then quarantine and delete.
Encryption – Data is encrypted. If lost or stolen, the data is unreadable.
Two Factor Authentication – This ensures no one can access our emails or files even if they have our password.
External Third Parties Service
G Suite. We use G Suite for our data storage and management, including email and calendaring, as well as website hosting and maintenance. Find out more about Google's GDPR compliance here: https://cloud.google.com/security/gdpr.
Calendly. We use Calendly for calendaring appointments and consultations. See more about the company’s GDPR policy here: https://help.calendly.com/hc/en-us/articles/360007032633-GDPR-FAQs
Monday. We use Monday.com for project management. Find out more about the company’s GDPR compliance here: https://support.monday.com/hc/en-us/articles/360000733949-monday-com-and-GDPR.
Slack. We use Slack for internal communications. Find out more about Slack’s GDPR commitments here: https://slack.com/intl/en-gb/trust/compliance/gdpr.
Zapier. We use this tool to help link certain programs and products together. Their GDPR compliance is here: https://zapier.com/legal/data-privacy.
ChatGPT. We never insert personal identifiable information into OpenAI’s ChatGPT software. For clients of our firm, we seek consent to the use of ChatGPT and other similar AI software for other purposes relating to your case.
HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
Accountancy. We contract with an accounting firm who assures us of their GDPR compliance and securing policies. If you require additional information about this, please contact us.
Data Retention
Personal data will be stored for the duration of the engagement agreement and, subsequently (and also if no engagement agreement is concluded) for the period that Ward Immigration Ltd is subject to a duty to keep data for tax, accounting, and ethical purposes or for other purposes provided by law or necessary for the purposes of the legitimate interests pursued by Ward Immigration Ltd or by a third party.
In determining the appropriate retention period for personal data, we consider (a) the amount, nature, and sensitivity of the personal data (b) the potential risk of harm from unauthorized use or disclosure of your personal data (c) the purposes for which we process your personal data and (d) whether we can achieve those purposes through other means, and the applicable legal requirements.
In certain circumstances, we may anonymize your personal data so that you cannot be identified by it. In these cases, we may use such information without providing additional notice to you.
Communication of Personal Data
In the limit permitted by our ethics rules, your personal data may be transmitted to:
Consultants (e.g., accountants) or other third parties that provide services functional to the purposes above indicated (e.g., developers);
Banks and insurers that provide services functional for the purposes above indicated;
Other subjects that process data due to specific legal obligations;
Judicial, governmental and administrative authorities, for the fulfillment of legal and ethical obligations. This includes the US Department of Homeland Security, US Citizenship & Immigration Services, US Embassies and the US Department of State.
Occasionally, it will be necessary, in the course of the performance of our engagement agreement with you, that certain categories of your personal data are required by a third party in order to process certain data for your application (for example, foreign language translations). We require all third parties to respect the integrity and security of your data, and to treat it in accordance with data protection legislation.
Profiling and data dissemination
Your personal data is not subject to fully automated decision-making processing, including profiling. Your data is not subject to dissemination and we do not sell your data to third parties.
Processing of data in the United Kingdom/Transfer
You acknowledge that Ward Immigration Ltd is based in the United Kingdom and that personal data provided to us by you will be processed in the United Kingdom. Some of the personal data that we process may be transferred to and stored in another country, including outside of the EU (e.g., when we provide your personal data to a US government agency). In these circumstances, the Personal Data will only be transferred on one of the following bases:
where the transfer is subject to one or more of the “appropriate safeguards” for international transfers (e.g. standard data protection clauses adopted by the European Commission);
the country or territory to which the transfer is made ensures an adequate level of protection; or
there is another situation where the transfer is permitted (e.g., where we have your explicit consent or one of the other exceptions provided in Article 49 of the GDPR applies).
We will require your explicit consent for transferring your personal data outside the EU in circumstances where:
(a) the transfer is not necessary for the attorney-client agreement
(b) the EU Commission has not made an adequacy decision in respect of the country in which the recipient of the personal data is based
(c) the transfer of the personal data is not subject to appropriate safeguards as set out in Article 46 of the GDPR
(d) there are no binding corporate rules in place
(e) no other derogation is applicable.
Right of The Data Subject
Data subjects have the following rights:
Right of access, i.e. the right to obtain confirmation as to whether we process personal data concerning the data subject, and, where that is the case, access to the personal data and the other information provided in Article 15 of the GDPR;
Right to rectification (Article 16 of the GDPR), i.e. to have inaccurate data rectified or to have incomplete data completed;
Right to erasure, i.e. the right to have your personal data deleted. Right to erasure is only upon the occurrence of one of the conditions indicated in Article 17(1) of the GDPR and in compliance with the exceptions provided for by 17(3));
Right to restriction of processing, i.e. the right to obtain the restriction of processing of your personal data. Right to restriction of processing applies only if one of the situations indicated in Article 18(1) of the GDPR arises;
Where applicable, right of portability, i.e., where the processing takes place on the basis of contract or consent and it is carried out by automated means. The right of portability is the right to obtain from Ward Immigration Ltd your personal data in a machine-readable format, also in order to communicate such data to another data controller. Read GDPR Article 20 for more information.
Right to object at any time to the processing of your personal data in certain specific situations as provided in Article 21. In particular, for communications from us with which we inform you of important legal developments and news about our firm, you have the right to object at any time to processing of personal data concerning you pursuant to Article 21(2).
Withdrawal of consent at any time (if processing is based on consent). The processing based on consent and carried out prior to the withdrawal of the consent remains lawful.
Right to lodge a complaint with a supervisory authority.
If you have any doubts or questions, please contact:
Oliver Ward, Esq.
oliver@wardimmigrationlaw.com