OISC Privacy Notice for Applicants, Advisers and Complainants

1. Applications

1.1 Application for Registration

IfTo process your application, we must process your personal data. When you wantapply for registration you must complete the relevant forms:

• Application for Registration
• New Adviser Application and Competence Statement

What personal data do we process?

When applying for registration you must provide us with:

• data relating to submitthe anorganisation
• data applicationrelating to the OISC,individual youadvisers

To willfind needout more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do thisso.

Under onlineSchedule using6, paragraph 2 of the OISC’sImmigration Webforms.and Asylum Act 1999 (as amended), you must be registered if we consider you are fit and competent to provide immigration advice and/or services.

InWe ordermust accesstherefore theseprocess forms,your data in the following ways to determine and ensure that you willare firstfit needand competent to createprovide immigration advice and/or services.

Therefore, as a Governmentpublic Onebody, Log-Init Account.is Thisnecessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a systemstatutory duty on us to ensure that isthose administeredwho byprovide theimmigration Cabinetadvice Officeand/or services are fit and actscompetent to do so.

Processing this data forms part of our assessment as ato gatewaywhether you are fit and competent to provide immigration advice and/or services.

Some declarations in the OISCapplication Webforms.form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

CreatingWe also require a GovernmentDBS Onecheck Log-Infor Accountevery adviser as part of the application. As such, this is aalso separateconsidered process.processing Detailspersonal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of howthis data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process worksyour personal data?

Your data is provided to us when you submit your completed application form. Once you submit the completed form to us, we update our case management system accordingly and store any hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data isoutside usedthe OISC:

HJT Training Limited

Adviser’s name, date of birth and email address are shared with HJT Training Limited who administer the OISC competence assessments.

Your data will be shared with them so that they can enter you into the relevant OISC competence assessment, issue you with your candidate number and issue you with your assessment results.

The purpose for sharing this data is into enter you into our competence assessments process. Sitting the Cabinetcompetence Office’sassessments privacyare noticea way in which we assess your competence to provide immigration advice and/or services at the level you have applied for.

Disclosure and Barring Service

Your personal data will be shared with DBS so that they can do the necessary checks on you to verify whether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your application form is true and to ensure that you are fit to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on advisers/organisations to ensure they are fit and competent to provide immigration advice and/or services.

As part of this the organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be foundshared atwith Privacythe noticeHome -Office.

This GOV.UKwill Onealso Logininclude (account.gov.uk)the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about what data the OISC Intelligence team processes please click here.

Other organisations

WhenIf loggingyou inare declaring to accessbe a solicitor, barrister and/or member of CILEx, your personal data will be shared with the OISCSRA, Webforms,BSB weand CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your identityanswer.

An usingexample of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your name.answer.

Section If93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are notfit ableand competent).

Therefore, when we request information from other organisations to logdetermine inwhether afteryou are fit and competent, they can give us any information that thenis necessary for us to do so.

1.2 Application for Continued Registration

To process your application, we willmust askprocess your personal data. When you apply for continued registration you must complete the relevant form:

• Application for Continued Registration (Repeat Registration)

What personal data do we process?

As you are applying for continued registration, we would already hold data from your dateinitial application for registration.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of birth.the IfImmigration thisand alsoAsylum fails,Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Under Schedule 6, paragraph 3 of the Immigration and Asylum Act 1999 (as amended), we determine intervals where a person must submit an application for their registration to be continued.

We will askcontinue your registration only if you are fit and competent to provide immigration advice and/or services.

We must therefore process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your Nationaldata Insurancein Number.the following ways for the exercise of official authority vested in us (Article 5 GDPR).

AllAs part of your application, we will process special category data (Article 9 GDPR). The processing of this informationdata is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

How do we process your personal data?

As you are applying for continued registration, you would have alreadyprovided beenus providedwith your personal data when you initially signedapplied upfor registration.

When you submit the completed form to us we update our case management system accordingly and store any hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Multiple Applications

You may need to submit multiple applications at the same time depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for afurther Governmentguidance Oneon Log-Inwhat Account.forms need to be submitted.

OnceIf you haveare loggedmaking multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

Some examples are listed below to help you understand what we mean:

• If you are applying for continued registration and to add a new adviser at the same time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and selectedAdding a New Adviser.

• If you are applying for continued registration and to register a new legal entity at the correctsame OISCtime, Webformyour personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Application for Registration of a New Legal Entity.

• If you are applying for continued registration and to raise levels at the same time, your purposes,personal pleasedata completewill be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Applications to Raise Levels.

1.3 Adding a New Adviser

To process your application, we must process your personal data. When you apply for this you must submit the form.relevant form:

• New Adviser Application and Competence Statement

What personal data do we process?

YouAs willthis needis an application to makeadd an onlineadviser paymentto an existing organisation, we would already hold data relating to the organisation.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the OISCImmigration applicationand fee(s)Asylum asAct part1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Under Schedule 6, paragraph 2 of completingthe Immigration and Asylum Act 1999 (as amended), you must be registered if we consider you are fit and competent to provide immigration advice and/or services.

We must therefore process your OISCdata Webform.in Thisthe following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will beprocess donespecial usingcategory data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a servicestatutory knownduty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as GOV.UKto Pay.whether Thisyou are fit and competent to provide immigration advice and/or services.

Some declarations in the application form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

We also require a DBS check for every adviser as part of the application. As such, this is also considered processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a separatestatutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process fromyour personal data?

When you submit your completed application form to us we update our case management system accordingly and store any hard copy application forms in secure lockable cabinets in the OISCoffice.

Hard Webforms.copy Forapplication furtherforms detailare asthen scanned into our case management system. They are then securely destroyed.

To find out more about how thiswe works,retain data please click here.

Sharing your data outside the OISC:

HJT Training Limited

ForAdviser’s furthername, informationdate of birth and email address are shared with HJT Training Limited who administer the OISC competence assessments.

Your data will be shared with them so that they can enter you into the relevant OISC competence assessment, issue you with your candidate number and issue you with your assessment results.

The purpose for sharing this data is to enter you into our competence assessments process. Sitting the competence assessments are a way in which we assess your competence to provide immigration advice and/or services at the level you have applied for.

Disclosure and Barring Service

Your personal data will be shared with DBS so that they can do the necessary checks on howyou GOV.UKto Payverify usewhether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your data,application pleaseform gois true and to Privacyensure noticethat –you GOV.UKare Payfit (payments.service.gov.uk)to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on advisers/organisations to ensure they are fit and competent to provide immigration advice and/or services.

As part of this the organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with the Home Office.

This will also include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about what data the OISC Intelligence team processes please click here.

WhatOther organisations

If you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data dowill be shared with the SRA, BSB and CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we process?will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

WhenThere applyingis nothing preventing a person from giving us information that is necessary for registrationthe discharge of our functions (i.e. to determine whether you mustare providefit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can give us with:any information that is necessary for us to do so.

Multiple Applications

You may need to submit multiple applications at the same time depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for further guidance on what forms need to be submitted.

If you are making multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

Some examples are listed below to help you understand what we mean:

• If you are applying for continued registration and to add a new adviser at the same time, your personal data relatingwill be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Adding a New Adviser.

• If you are applying for continued registration and to register a new legal entity at the organisationsame time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Application for Registration of a New Legal Entity.

• If you are applying for continued registration and to raise levels at the same time, your personal data relatingwill be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Applications to Raise Levels.

1.4 Application for Registration of a New Legal Entity

To process your application, we must process your personal data. When you apply for this you must submit the individualrelevant advisersform:

• Application for Registration of a New Legal Entity

What personal data do we process?

As you are applying for registration of a new legal entity, we would already hold data from your initial application for registration.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under sectionSchedule 83(5)(a)6, paragraph 6 of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to keep an open register listing every immigration adviser registered with the OISC. This register must be available to members of the public for inspection.

We must process your data in the following ways to ensure that thoseour register is accurate and up to date.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

Additionally, we process this data to ensure that any decisions we make in respect of any application you submit to us are addressed to the correct legal person.

Some declarations in the application form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to keep an open register listing every immigration adviser registered with the OISC.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services. If you are considered unfit you cannot be registered with the OISC. As such, your registration will be cancelled and you will be removed from the open register.

How do we process your personal data?

When you submit the completed form to us we update our case management system accordingly and store hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data outside the OISC:

You would have provided us with your personal data when you initially applied for registration. As such, all the necessary background checks would have been done.

However, if changing your legal entity involves the adding new advisers, then their personal data will be shared outside of the OISC in accordance with the section of our privacy notice titled Adding a New Adviser.

HJT Training Limited

Adviser’s name, date of birth and email address are shared with HJT Training Limited who administer the OISC competence assessments.

Your data will be shared with them so that they can enter you into the relevant OISC competence assessment, issue you with your candidate number and issue you with your assessment results.

The purpose for sharing this data is to enter you into our competence assessments process. Sitting the competence assessments are a way in which we assess your competence to provide immigration advice and/or services at the level you have applied for.

Disclosure and Barring Service

Your personal data will be shared with DBS so that they can do the necessary checks on you to verify whether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your application form is true and to ensure that you are fit to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on advisers/organisations to ensure they are fit and competent to provide immigration advice and/or services.

As part of this the organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with the Home Office.

This will also include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about what data the OISC Intelligence team processes please click here.

Other organisations

If you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data will be shared with the SRA, BSB and CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

Multiple Applications

Therefore,You ifmay need to submit multiple applications at the same time depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for further guidance on what forms need to be submitted.

If you are making multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

Some examples are listed below to help you understand what we mean:

• If you are applying for initialcontinued registration,registration addingand to add a new adviser,adviser at the same time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Adding a New Adviser.

• If you are applying for continued registration and to changeregister a new legal entity at the same time, your levelpersonal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Application for Registration of registration,a weNew mustLegal assessEntity.

• If you are applying for continued registration and to raise levels at the same time, your fitnesspersonal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and competenceApplications to Raise Levels.

1.5 Application for Raising Levels

Use these application forms when you are applying to raise the levels of an adviser at the levelorganisation:

• Application to Raise Levels
• Adviser Raising Levels Competence Statement

If you are also adding a new adviser to your organisation you must use the adding a new adviser application form.

When doing so, your personal data will also be processed in accordance with the section of our privacy notice regarding Adding a New Adviser.

What personal data do we process?

As you are applying to raise levels, we would already hold data from your initial application for registration.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have applieda for.statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Under Schedule 6, paragraph 2 of the Immigration and Asylum Act 1999 (as amended), you must be registered if we consider you are fit and competent to provide immigration advice and/or services.

Also,We undermust Scheduletherefore 6,process paragraphyour 3data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended),amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

Some declarations in the application form relate to criminal convictions. As such, we determineare intervalseffectively whereprocessing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a personstatutory mustduty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process your personal data?

When you submit anyour completed application forforms theirto registrationus we update our case management system accordingly and store hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data outside the OISC:

If you are also adding a new adviser to beyour continued.organisation Youyou must applyuse everythe yearadding a new adviser application form.

When doing so, your personal data will also be processed in accordance with the section of our privacy notice regarding Adding a New Adviser.

HJT Training Limited

Adviser’s name, date of birth and email address are shared with HJT Training Limited who administer the OISC competence assessments.

Your data will be shared with them so that they can enter you into the relevant OISC competence assessment, issue you with your candidate number and issue you with your assessment results.

The purpose for ussharing this data is to continueenter you into our competence assessments process. Sitting the competence assessments are a way in which we assess your registration.competence Youto provide immigration advice and/or services at the level you have applied for.

Disclosure and Barring Service

Your personal data will be remindedshared with DBS so that they can do the necessary checks on you to verify whether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your application form is true and to ensure that you are fit to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on advisers/organisations to ensure they are fit and competent to provide immigration advice and/or services.

As part of this the organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with the Home Office.

This will also include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about what data the OISC Intelligence team processes please click here.

Other organisations

If you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data will be shared with the SRA, BSB and CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the timedischarge asof our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you mustare fit and competent, they can give us any information that is necessary for us to do so.

Multiple Applications

You may need to submit amultiple continuingapplications registrationat application.the same time depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for further guidance on what forms need to be submitted.

WeIf you are making multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

Some examples are listed below to help you understand what we mean:

• If you are applying for continued registration and to add a new adviser at the same time, your personal data will continuebe processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Adding a New Adviser.

• If you are applying for continued registration and to register a new legal entity at the same time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Application for Registration of a New Legal Entity.

• If you are applying for continued registration and to raise levels at the same time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration and Applications to Raise Levels.

1.6 Application for Judicial Review Case Management

This application can only ifbe made by advisers already registered at Level 3. The relevant form to complete is:

• Judicial Review Case Management Application and Competence Statement

What personal data do we process?

As you are applying for JRCM, we would already hold data from your initial application for registration.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

When you apply for JRCM, we must assess whether you are fit and competent to provide immigration advice and/or services.services, in particular advice about JRCM, to the necessary standard.

We must therefore process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 65 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

Some declarations in the application form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

SomeThe applicationsprocessing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process your personal data?

When you submit your completed application form to us we update our case management system accordingly and store hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data outside the OISC:

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

1.7 Application for Registration (N&SCS)

To process your application, we must process your personal data. When you apply for registration you must complete the relevant forms:

• Application for Registration (Local Authority Nationality & Settlement Checking Services)

• Nationality & Settlement Checking Services Adviser Competence Statement

What personal data do we process?

To process your application, we must process your personal data. When applying for registration you must provide us with:

• data relating to the organisation

• data relating to the individual advisers

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Under Schedule 6, paragraph 2 of the Immigration and Asylum Act 1999 (as amended), you must be registered if we consider you are fit and competent to provide immigration advice and/or services.

We must therefore process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

We also require a DBS check for every applicantadviser as part of the applicationapplication. process. As such, this is also considered processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process your personal data?

Your data is provided to us when you submit your completed application form. Once you submit the completed form to us, we update our case management system isaccordingly updatedand accordingly.store any hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data outside the OISC:

HJTDisclosure Trainingand LimitedBarring Service

IfYour personal data will be shared with DBS so that they can do the necessary checks on you areto applyingverify forwhether initialyou registration,have applicantany names,unspent datesconvictions, cautions, reprimands, warnings, etc.

The purpose of birththis is to verify that what you have declared in your application form is true and emailto addressesensure that you are fit to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on advisers/organisations to ensure they are fit and competent to provide immigration advice and/or services.

As part of this the organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with HJTthe TrainingHome LimitedOffice.

This whowill facilitatealso include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about what data the OISC competenceIntelligence assessments.team processes please click here.

Other organisations

YourIf you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data will be shared with themthe soSRA, BSB and CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can entergive us any information that is necessary for us to do so.

1.8 Application for Continued Registration (N&SCS)

To process your application, we must process your personal data. When you intoapply for continued registration you must complete the relevant OISCform:

• Application competencefor assessment,Continued issueRegistration (Local Authority Nationality & Settlement Checking Services)

What personal data do we process?

As you withare applying for continued registration, we would already hold data from your candidateinitial numberapplication for registration.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and issuetrustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Under Schedule 6, paragraph 3 of the Immigration and Asylum Act 1999 (as amended), we determine intervals where a person must submit an application for their registration to be continued.

We will continue your registration only if you withare fit and competent to provide immigration advice and/or services.

We must process your assessmentdata results.in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

TheTherefore, purposeas a public body, it is necessary for sharingus to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to enterensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

How do we process your personal data?

When you submit your completed form to us we update our case management system accordingly and store any hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our competencecase assessmentsmanagement process.system. SittingThey are then securely destroyed.

To find out more about how we retain data please click here.

Multiple Applications

You may need to submit multiple applications at the competencesame assessmentstime depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for further guidance on what forms need to be submitted.

If you are making multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

An example is listed below to help you understand what we mean:

If you are applying for continued registration and to add a waynew adviser to the N&SCS at the same time, your personal data will be processed in whichaccordance with our privacy notice sections regarding Applications for Continued Registration for Nationality & Checking Services and Adding a New Adviser for Nationality & Checking Services.

1.9 Adding a New Adviser (N&SCS)

To process your application, we assessmust process your competencepersonal data. When you apply for this you must submit the relevant form:

• Nationality & Settlement Checking Services Adviser Competence Statement

What personal data do we process?

As this is an application to add an adviser to an existing organisation, we would already hold data relating to the organisation.

To find out more about what data we process about organisations please click here.

To find out more about what data we process about advisers please click here.

To find out more about what data we process about owners and trustees please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services atare fit and competent to do so.

Under Schedule 6, paragraph 2 of the levelImmigration and Asylum Act 1999 (as amended), you havemust appliedbe for.registered if we consider you are fit and competent to provide immigration advice and/or services.

We must therefore process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 5 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

Some declarations in the application form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

We also require a DBS check for every adviser as part of the application. As such, this is also considered processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process your personal data?

When you submit the completed form to us we update our case management system accordingly and store hard copy application forms in secure lockable cabinets in the office.

Hard copy application forms are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

Sharing your data outside the OISC:

Disclosure and Barring Service

Your personal data will be shared with DBS so that they can do the necessary checks on you to verify whether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your application form is true and to ensure that you are fit to provide immigration advice and/or services.

Home Office

The OISC Intelligence team will conduct vetting checks on youadvisers/organisations and your organisation to ensure youthey are fit and competent to provide immigration advice and/or services.

As part of this yourthe name, organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with the Home Office.

This will also include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about howwhat we handle data within the OISC Intelligence team processes please click here.

Other organisations

If you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data will be shared with the SRA, BSB and CILEx to verify this.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

Multiple Applications

You may need to submit multiple applications at the same time depending on your circumstances. Please read the relevant guidance notes to the application form you are submitting for further guidance on what forms need to be submitted.

If you are making multiple applications at the same time, please refer to the relevant sections of this privacy notice to find out how we process personal data.

An example is listed below to help you understand what we mean:

• If you are applying for continued registration and to add a new adviser to the N&SCS at the same time, your personal data will be processed in accordance with our privacy notice sections regarding Applications for Continued Registration for Nationality & Checking Services and Adding a New Adviser for Nationality & Checking Services.

2. Complaints

When you send us a compliant about an adviser and/or organisation you should use our complaints form.

What personal data do we process?

To find out more about what data we process about complaints please click here.

Why do we process your personal data?

Under Schedule 5, paragraph 5(1) of the Immigration and Asylum Act 1999 (as amended), we must have a complaints scheme to investigate complaints. We must investigate complaints regarding:

• an adviser’s/organisation’s fitness or competence

• an alleged breach of the Code of Standards

Members of the public can also make a complaint about unregistered people/organisations providing or advertising the provision of immigration advice and/or services unlawfully. These complaints will be passed on to the relevantIntelligence OISCand Investigations team who will process the data for the prevention, investigation, detection or prosecution of criminal offences.

As part of our complaint investigation, we will consider all the evidence available to us to reach an informed decision as to whether the complaint has been substantiated.

Therefore, as part of our investigation, we must process your personal data and the personal data of third parties.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 65 GDPR).

As part of the complaint investigation, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to investigate relevant complaints, such as those listed above.

Processing your data forms part of our assessment as to whether the complaint is substantiated.

We will also process data relating to criminal convictions, but only if the complaint case file states that a party involved in the case has a criminal conviction(s), warning(s), reprimand(s), etc. This would be considered as processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to investigate relevant complaints, such as those listed above.

How do we process your personal data and third-partythird party personal data?

Your data and third-partythird party data is provided to us whenever you provide us with information about your complaint or when evidence is provided to us.

Your complaint form and any evidence in relation to the complaint will be stored on our case management system accordingly. Any hard copy documents we receive will be stored in secure lockable cabinets in the office.

Hard copy documents are then scanned into our case management system. They are then securely destroyed.

To find out more about how we retain data please click here.

If you or the adviser/organisation provide us with original documents, they will be returned once the complaint investigation has finished.

Data will also be collected and processed from the complainant’s file. This is the file that the adviser has on the complainant.

To find out more about what data we process from the complainant’s case file please click here.

Sharing your data outside the OISC:

Home Office

• Your name, date of birth and Home Office reference number will be shared with the Home Office if part of the complaint requests us to check the status of your immigration application.

• The Home Office provides us with information regarding whether an adviser/organisation is regulated to provide immigration advice and/or services.

3. Audits

We conduct audits to regularly assess whether the work being done by the adviser/organisation is fit and competent.

What personal data do we process?

We examine case files selected by us to assess the quality of work being done. We determine whether the work that has been done is to a fit and competent standard. We also make any suggestions for improvement.

To find out more about data we process from audits please click here.

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Our audits procedure allows us to inspect the work being done by advisers/organisations and make an informed decision as to whether an adviser/organisation is fit and competent to provide immigration advice and/or services.

We must process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services to the necessary standard.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 65 GDPR).

As part of the audit, we will process special category data by conducting the case file reviews (Article 9 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice or immigration services are fit and competent.

Processing your data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

We will also process data relating to criminal convictions when we audit case files, but only if the audit case file states that a party involved in the case has a criminal conviction(s), warning(s), reprimand(s), etc. This would be considered as processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice or immigration services are fit and competent.

How do we process your personal data and third-partythird party personal data?

When we arrange an audit we use the personal data we store about you to schedule an audit. For example, we contact you using the email address and contact number you have provided to us and schedule the audit to take place either remotely or at your businessoffice address.

Personal data is also collected when auditing case files. We process personal data contained in those case files. This is the data you have on your client.

In somealmost cases,every case, this will also include the personal data of third parties, such as your client’s family members.

The facts of every case will be different, so the personal data that will be on the file will be different. As such, the personal data we process will be different for every case file we audit.

For further detail on what data we process from a case file please click here.

Our findings from an audit will be consolidated into an Identified Issues Report. This will be stored on our case management system.system and securely destroyed.

To find out more about how we retain data please click here.

4. Data Inside the OISC

Knowledge & Intelligence:

Your personal data will be shared with the relevantOISC Intelligence team inside the OISC so that they can do anyan necessaryintelligence checkscheck to verify whether there are any concerns with your fitness to provide immigration advice, namely your character.

The relevant team will record, task and disseminate any dataintelligence gathered to selectcaseworkers, teamsinvestigators and individualsLegal withinteam. the OISC. Information shared internallywith caseworkers will be used to help caseworkers identify any issue(s) or potential issue(s) with the adviser’s/organisation’s fitness and competence.

The relevantIntelligence team will request an applications list from the Home Office. This is a complete list of all the applications you/your organisation has submitted to the Home Office.

The relevantIntelligence team will process your data, including sharing your data with other law enforcement agencies, such as the police, for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

Data that will be shared with other law enforcement agencies include your name, your organisation’s name, your address and post code, your organisation’s address and post code, your date of birth, any Home Office reference numbers and any information given to us from the declarations in your past application forms.

Under section 93 of the Immigration and Asylum Act 1999 (as amended), there is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request intelligence from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

Investigations:

The relevantInvestigations team will process personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences.

Legal:

The relevantLegal team will have regular access to your personal data on the case management system and will process your personal data for the purpose and in connection with any legal proceedings or prospective legal proceedings.

Under section 93 of the Immigration and Asylum Act 1999 (as amended), there is nothing preventing a person from giving the First-tier Tribunal information which is necessary for the discharge of its functions (i.e. making decisions of any appeals lodged).

As such, if you decide to appeal a decision made against you, the relevantLegal team will disclose your personal data to the Tribunal over the course of the legal proceedings.

The relevantLegal team will only process personal data that is relevant to the proceedings, such as the data regarding an application, audit and/or complaint.

The relevantLegal team also provide overall support to caseworkers and advise them whenever their advice is sought on whether an adviser is fit and competent to provide immigration advice and/or services. To do this, the relevantLegal teamTeam will process your data (examine the data) to help them form their advice.

Finance:

WhenPayments youof makeregistration paymentfees onand ourrequests Webformsfor usingrefunds GOV.UKare Pay,processed all transactions will be facilitated by GOV.UK Pay. This is a separate process from the OISC.finance Theteam.

We onlywill datashare storedyour onorganisation’s ourbank casedetails managementwith system from the transactionFinance is the card type and card brand that was used. The relevant team willfor havepayments accessof toregistration thefees informationor thyif need in order to issue you withrequest a refund ifof necessary.

Fora furtherregistration information on how GOV.UK Pay use your data, please go to Privacy notice – GOV.UK Pay (payments.service.gov.uk).fee.

HR:

If you make a complaint against a member of OISC staff, it will be investigated by the HR department.

HR have regular access to our case management system. If you are an adviser or an applicant adviser and make a complaint against a member of OISC staff, HR will have access to your personal file on our case management system.

IT:

OISCThe data,IT includingteam backup all data stored on our caseservers managementfor systemthe purposes of disaster resilience.

This is backeddone on a daily basis. All backup tapes are encrypted. Back up fortapes are stored in our office with one tape being stored at a secure offsite location.

The data contained on the purposesbackup oftape disasteris resilience.not processed at the offsite location.

Backup tapes are securely destroyed once they are no longer fit for purpose.

5. Retention

We hold personal data for a period of six years. After this the personal data is securely destroyed.

We only store data for longer than this:

• for the prevention, investigation, detection or prosecution of criminal offences

• for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings)

• for the purpose of obtaining legal advice or otherwise establishing, exercising or defending legal rights

When deciding whether to retain the data for the above purposes, we consider all the circumstances and evidence before us.

This includes the case history between thea OISCcaseworker and an adviser/organisation.

6. Your Rights

As a data subject, you have the following rights:

• to be informed of how we process your personal data

• subject access

• rectification

• erasure

• restriction

• portability

• objection

Under GDPR there are also rights attached to the automated individual decision-making (i.e. profiling). However, we do not process your data using automated decision-making means.

Exercise Your Rights

If you choose to exercise your rights, please contact the OISC Information Officers who will take the necessary steps. They can be contacted on foi.dpa@oisc.gov.uklegalteam@oisc.gov.uk.

Rights You Cannot Exercise

The reason we process personal data, as explained in this notice,document, is because it is necessary for the exercise of official authority vested in us. This is our lawful basis.

Our lawful basis affects certain rights that you can exercise.

If you have applied for any of the following, you cannot exercise your right to erasure or data portability:

• Application for Registration

• Application for Continued Registration

• Adding a New Adviser

• Application for Registration of a New Legal Entity

• Application for Raising Levels

• Application for Judicial Review Case Management

• Any of our N&SCS applications

You can exercise every other right, however, if you want to restrict or object to how we process your data, we will not be able to consider your application, as all of our processing activities are done to ensure you are fit and competent to provide immigration advice and/or services.

How do I complain about information security?

In the first instance, you can email the Data Protection Officers to submit a complaint. The DPOs will investigate the matter and respond to you by email.

If you are not satisfied with the response, you can submit a complaint to the ICO on their website.

7. Who is the Data Controller?

The Data Controller is the OISC:

Office of the Immigration Services Commissioner

Email: info@oisc.gov.uk

Telephone: 0345 000 0046

8. Who are the Data Protection Officers?

Information relating to the OISC Data Protection Officers isare available upon request at info@oisc.gov.uk

9. Publishing

Under section 83(6)(a) of the Immigration and Asylum Act 1999 (as amended), we must arrange for the publication, in such form and manner and to such extent as we consider appropriate, of information about our functions and about the matters falling within the scope of our functions. functions.

Under sections 91 and 92 of the Immigration and Asylum Act 1999 (as amended), it is a criminal offence to offer, advertise and/or provide unregulated immigration advice and/or services. services.

As part of our functions, we investigate and prosecute these offences. Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR). GDPR).

We will publish details of ongoing criminal prosecutions and warrants on our website, including information relating to:

• The defendant’s name, age and regional location

• An update on the criminal proceedings

The purpose for publishing this data are for statutory purposes, to safeguard vulnerable advice-seekers and to prevent any further provision of unregulated immigration advice and/or services.

Under section 85 of the Immigration and Asylum Act 1999 (as amended), the OISC is required to prepare and maintain a register of registered OISC immigration advisers. Pursuant to paragraph 6 of Schedule 6 to the Immigration and Asylum Act 1999 (as amended), this register must be available for inspection by members of the public. This register will contain names of registered advisers, organisations, OISC reference numbers, level of registration, the organisation’s website and whether it is a fee charging or non-fee charging organisation. As this register is required by statute, it is necessary for us, as a public authority to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

The OISC also has a tool known as Adviser Finder. This will contain organisation names, its website, email address and contact number, and whether it is a fee charging or non-fee charging organisation. We will only publish your data on Adviser Finder if you have given us your consent to do so (Article 6 GDPR).

Under section 89(9) of the Immigration and Asylum Act 1999 (as amended), the OISC must keep a public register of individuals who are subject to a direction issued by the Tribunal under section 89(8) of the Immigration and Asylum Act 1999 (as amended).

ANNEX A: Data we process about organisations

We process data relating to the organisation. This includes:

• the organisation’s name, address and contact details

• the organisation’s legal status

• the organisation’s Companies House/charity registration number

• the organisation’s bank details

• the organisation’s OISC registration number

• what OISC Level the organisation are registered at and permitted to work at

• the OISC categories they are permitted to work at (i.e. Immigration and/or Asylum & Protection)

• whether the organisation is a fee charging organisation or a non-fee charging organisation

• the name(s) of the advisers working at the organisation

• data of advisers working or who have worked at the organisation. For more detail on what data we process relating to adviser please click here.

ANNEX B: Data we process about advisers

We process data relating to the advisers of the organisation. This data includes:

Adviser details:

• their name, previous name(s), title, gender, date and place of birth, nationality and contact details

• their employment status at the organisation

• their NI number

• their employment history

• their previous employer’s details which includes:

• the organisation’s name, address and contact details

• their job title whilst employed there

• the organisation’s overseeing regulatory body

• the dates they were employed by the organisation

• details of their training and qualifications

• whether they currently employed or own/work in any other business

• copies of their identity (such as passports, identity cards, etc.)

Information about an adviser’s ability to work in the UK:

• whether they are subject to restrictions on their residence in the UK or permission to work in the UK

Information about an adviser’s financial background:

• whether they have ever been declared bankrupt

• whether they have been disqualified or banned from being a director of a company

• whether they have ever been disqualified as acting as a charity trustee

Information about an adviser’s OISC registration:

• their OISC registration number

• what OISC Level they are registered at

• the OISC categories they are permitted to work at (i.e. Immigration and/or Asylum & Protection)

• whether you work for a fee charging organisation or a non-fee charging organisation

• the name(s) of the organisation(s) the adviser works for and has worked at

• address of the organisation(s) the adviser works at or has worked at

Data we already have on you:

If you are or have been in the OISC scheme before and we hold data on you. That data will be used to consider whether you are fit and competent to provide immigration advice and/or services, along with any new data you have provided to us.

This includes data collected from previous audits and any investigated complaints made against you.

To find out more about what data we process from audits please click here.

To find out more about what data we process about complaints please click here.

If the organisation is an N&SCS:

• whether the adviser is part of the nationality checking service and/or settlement checking service
• what organisation they are part of

Information about an adviser’s character:

• whether they have convictions, cautions, reprimands or final warnings that are not “protected” as defined by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (as amended in 2013)

• whether they have been or currently are subject to any criminal proceedings in the UK or abroad

• information contained on an adviser’s DBS Disclosure Certificate (standard check)

• whether they have been subject to any adverse finding or settlement in civil proceedings

• whether they have been dismissed or asked to resign and resigned from employment or from a position of trust, fiduciary appointment or similar position

• whether they have traded under a different name or been known by a different name in the last 5 years

• whether they are currently regulated by or have previously been regulated by the OISC

• whether they have/are a member of a professional body in the UK or abroad

• whether they have been or are subject to any existing/previous disciplinary proceedings by other regulatory authorities or professional bodies in the UK or abroad

• whether they or any business with which they have been an owner or manager has been subject to any substantiated complaint relating to regulated activities

• whether they or any business with which they have been involved have ever been refused the right to carry out a trade, business or profession requiring a licence or other authority

• whether they or any business with which they have been involved have ever had this authorisation revoked, withdrawn or terminated, or have been expelled by a regulatory or government body

• whether they or any business that they have been involved has been investigated, disciplined, censured or suspended or criticised by a regulatory or professional body, a Court or Tribunal (publicly or privately)

• whether they have been a barrister, solicitor, advocate or a member of CILEx, or supervised by one of the above

• whether they have ever been subject to disciplinary action or intervention by a Designated Professional Body or Designated Qualifying Regulator or overseas body equivalent

• whether they are prohibited by The Law Society’s Rules or equivalent from being employed as a solicitor’s clerk

• whether they have been sued by a client or made a claim on their Professional Indemnity Insurance in the last 5 years

• whether they have ever been involved in any conduct that may call into question their honesty, integrity or respect for the law

ANNEX C: Data we process about owners and trustees

We process data relating to the owner(s)/manager(s) or trustees of the organisation or charity. This includes:

• their name(s)

• their date(s) of birth

• their title(s)

• their nationality

• their role(s) and position(s) within the organisation

• details of any shares held

• whether they have traded under a different name or been known by a different name in the last 5 years

• whether they are involved in the running of any other business or employed at any other organisation

• whether they have ever been involved in any conduct that may call their honesty, integrity or respect for the law into question

Owners’ character:

• whether they have any unspent criminal convictions in the UK or abroad

• whether they are currently subject to any criminal proceedings in the UK or abroad

• whether they are subject to, or ever been, subject to disciplinary proceedings by regulatory/professional bodies in the UK or abroad

Owners’ financial background:

• whether they have been a director of a company or member of an LLP that has been subject to a winding up order, an administrative order or administrative receivership, or entered into a voluntary arrangement under the Insolvency Act 1986, or whether the company has been wound up or put into administration in circumstances of insolvency

• whether they have been declared bankrupt or entered into an individual voluntary arrangement or a partnership voluntary arrangement under the Insolvency Act 1986

• whether they have ever been disqualified or banned from being a director of a company or from acting as a charity trustee

ANNEX D: Data we process about complaints

When submitting a formal complaint, the complainant must provide us with their personal data in accordance with our complaints scheme.

Details of the complainant:

• their name, date of birth, address, email address and contact numbers

• name, date of birth, address, email address and contact numbers of person who submits the complaint on behalf of the complainant

Details of adviser and/or organisation they are complaining about:

• adviser and/or organisation’s name, address, email address and contact numbers

Details of the complaint:

• whether the complaint has been reported to any other agencies and details of the other agencies’ investigation

• facts of the complaint, including information from any work undertaken by the adviser/organisation (i.e. the complainant’s case file)

For further detail on what data we process from the complainant’s case file please click here.

ANNEX E: Data we process from a complainant’s case file

If you make a complaint about the work undertaken by an adviser/organisation, as part of our investigation, we will request your case file(s) from the adviser/organisation to examine the work done on the file.

For example, if your complaint is about an adviser who did work on your asylum application and you allege that they did this work incompetently, we will request your case file. A complaints caseworker will then review the file and determine whether the work was done incompetently.

By doing this we are processing the data contained in your case file.

Your case file will in most cases contain personal information relating to third parties. This can be family members, witnesses or unmarried partners.

Every case file is different and the data processed from a case file will be different in every investigation.

Below is a list of all the data that we can process from a case file (your data and third party data).

Data from case file (yours and third parties):

This data will mainly come from any attendance notes, applications, submissions or representations contained in the case file.

• facts of the case

• date and place of births

• names and previous names/identities

• addresses and previous addresses

• gender and sexual orientation

• nationality and any other nationality/citizenships held

• addresses and contact numbers

• passport number, place of issue, issuing authority, date of issue, date of expiry

• language(s) familiar with

• NI numbers

• BRP numbers

• Home Office and/or Case ID reference numbers

• immigration history

• details of education, employment history and tax history (including details of payments made to HMRC)

• relationship history including details of previous partners (name and date of birth), date and place of marriage and date of divorce

• details of any children and/or parental responsibility arrangements

• details of nature and dependency child has on client

• details any visits to any other countries and time spent outside of UK

• details of residency outside of UK

• history relating to claiming any welfare benefit

• details of living arrangements including number of rooms, people living there and whether it is rented or mortgaged

• details of any business interests outside of the UK

• details of any property owned in and outside of the UK

• details regarding annual/monthly income

• details of any employment benefits/arrangements

• details of any court judgments/civil penalties

• details of registered GP

• bank details contained in application forms (business accounts and individuals’ accounts and any joint holder accounts)

• name and address of any joint account holders

• name and address of any person providing financial support

• information relating to the complainant’s racial/ethnic origins, political opinions, religious beliefs, trade union membership(s), physical/mental conditions, sexual life

• information relating to the commission or alleged commission of any criminal offence, the proceedings for the commission or alleged commission of a criminal offence

• information (as above) relating to children

• information (as above) relating to family members, unmarried partners, dependents (adult or child), sponsors, or anyone else mentioned in the complainant’s case file(s)

• copies of any documents that are held on the case file. This can include copies of:

• photographs

• passports

• BRPs

• driving licences

• national ID cards

• travel documents

• bank statements

• payslips

• certificates

• marriage certificates

• correspondence (emails, letters, attendance notes/minutes)

• mortgage/rent agreements and other financial agreements

• contracts

• birth certificates

• bills and invoices

• police registration certificates

Under Code 26(k) of the OISC Code of Standards,Standards 2016, in the client care letter, advisers usuallymust confirm to their clients that they are regulated by us and that we have the power to examine the client’s file.

ANNEX F: Data we process from an audit

Data processed from case file (yours and third parties):

This data will mainly come from any attendance notes, applications, submissions or representations contained in the case file.

• facts of the case

• date and place of births

• names and previous names/identities

• addresses and previous addresses

• gender and sexual orientation

• nationality and any other nationality/citizenships held

• addresses and contact numbers

• passport number, place of issue, issuing authority, date of issue, date of expiry

• language(s) familiar with

• NI numbers

• BRP numbers

• Home Office and/or Case ID reference numbers

• immigration history

• details of education, employment history and tax history (including details of payments made to HMRC)

• relationship history including details of previous partners (name and date of birth), date and place of marriage and date of divorce

• details of any children and/or parental responsibility arrangements

• details of nature and dependency child has on client

• details any visits to any other countries and time spent outside of UK

• details of residency outside of UK

• history relating to claiming any welfare benefit

• details of living arrangements including number of rooms, people living there and whether it is rented or mortgaged

• details of any business interests outside of the UK

• details of any property owned in and outside of the UK

• details regarding annual/monthly income

• details of any employment benefits/arrangements

• details of any court judgments/civil penalties

• details of registered GP

• bank details contained in application forms (business accounts and individuals’ accounts and any joint holder accounts)

• name and address of any joint account holders

• name and address of any person providing financial support

• information relating to the complainant’s racial/ethnic origins, political opinions, religious beliefs, trade union membership(s), physical/mental conditions, sexual life

• information relating to the commission or alleged commission of any criminal offence, the proceedings for the commission or alleged commission of a criminal offence

• information (as above) relating to children

• information (as above) relating to family members, unmarried partners, dependents (adult or child), sponsors, or anyone else mentioned in the complainant’s case file(s)

• copies of any documents that are held on the case file. This can include copies of:

• photographs

• passports

• BRPs

• driving licences

• national ID cards

• travel documents

• bank statements

• payslips

• certificates

• marriage certificates

• correspondence (emails, letters, attendance notes/minutes)

• mortgage/rent agreements and other financial agreements

• contracts

• birth certificates

• bills and invoices

• police registration certificates

Under Code 26(k) of the OISC Code of Standards,Standards 2016, in the client care letter, advisers usuallymust confirm to their clients that they are regulated by us and that we have the power to examine the client’s file.