Mosley Yu Immigration Ltd
Registered name: 14348183
IAA regulatory number: F202200084
We are the controller of your personal data. For more information on controllers and their responsibilities please see ICO’s guidance on data protection principles, definitions, and key terms.
This privacy notice tells you what to expect us to do with your personal information.
Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
Sharing information outside the UK.
How to complain
Contact details
Telephone: 07732034905
Email: lara@mosleyyu.com
What information we collect, use, and why
a) We collect or use the following information to provide and improve products and services for clients:
Names and contact details
Addresses
Gender
Pronoun preferences
Occupation
Date of birth
Marital status
Third party information (such as family members or other relevant parties)
Payment details (including card or bank information for transfers and direct debits)
Financial data (including income and expenditure)
Transaction data (including details about payments to and from you and details of products and services you have purchased)
Usage data (including information about how you interact with and use our website, products and services)
Employment details (including salary, sick pay and length of service)
Health information (such as medical records or health conditions)
Criminal records data (including driving or other convictions)
Information relating to compliments or complaints
Account access information
Website user information
b) We also collect or use the following special category information to provide and improve products and services for clients. This information is subject to additional protection due to its sensitive nature:
Racial or ethnic origin
Religious or philosophical beliefs
Health information
Sexual orientation information
c) We collect or use the following personal information for the operation of client or customer accounts:
Names and contact details
Addresses
Purchase or service history
Account information, including registration details
Information used for security purposes
Marketing preferences
Technical data, including information about browser and operating systems
d) We collect or use the following personal information for information updates or marketing purposes:
Names and contact details
Addresses
Marketing preferences
Website and app user journey information
IP addresses
e) We collect or use the following personal information to comply with legal requirements:
Name
Contact information
Identification documents
Client account information
Criminal offence data
Personal data required to comply with statutory duties and regulatory standards set by the Immigration Advice Authority (IAA), including client care agreements, client identity verification (KYC), consultation and attendance notes, casework records, accounting and payment ledgers, and records retained for complaints handling or IAA regulatory audits.
f) We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Addresses
Payment details
Account information
Witness statements and contact details
Relevant information from previous investigations
Customer or client accounts and records
Financial transaction information
Correspondence
g) We also collect or use the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:
Racial or ethnic origin
Religious or philosophical beliefs
Health information
Sexual orientation information
Lawful bases and data protection rights
a) Introduction
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
b) Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
We use personal information to carry out immigration casework and build our professional experience, which helps us refine how we support clients over time. This approach allows us to develop our practice knowledge and offer relevant guidance. Personal information stays private within each client\'s file and is not shared with outside parties for commercial gain, meaning the privacy impact on individuals remains low.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
c) Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
We use paid accounting software linked to our business bank account to record financial transactions, and we work with an external accounting firm to handle our tax returns. We record details such as client names, addresses, reference numbers, and payment details to maintain clear records for tax purposes. Access is limited to our external accountants, and we avoid changing software providers or accounting firms unnecessarily to keep data exposure to a minimum.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
d) Our lawful bases for collecting or using personal information for information updates or marketing purposes are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information to comply with legal requirements:
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
e) Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
We process details provided in queries, complaints, or claims to review and respond to the issue. This helps individuals receive answers and allows us to address legal or insurance matters if needed. We aim to use only details relevant to the issue and keep them within our internal files, sharing with professional advisers or regulators only when required for a dispute. Since individuals expect us to handle their details when raising a concern, the privacy impact remains limited.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Where we get personal information from
Directly from you
Regulatory authorities
Legal bodies or professionals (such as courts or solicitors)
Third parties:
For individuals under 18, we receive personal information from third parties acting on their behalf or involved in their case. This includes: a) Parents or legal guardians providing birth certificates, passports, and relationship evidence; b) Schools or educational providers providing confirmation of attendance, enrollment, or reports; and c) Previous legal representatives or tribunals transferring case files involving the minor.
How long we keep information
In accordance with regulatory requirements, client files and financial records are retained for a minimum of 6 years following the completion of your case. Thereafter, files are kept in archive until destruction is requested or legally required.
For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.
Who we share information with
a) Joint data controllers
We have a joint controller relationship with Meta (Facebook Page). We process your personal information with that joint controller for the following reason: We write articles on the Facebook page - immigrateuk. The Facebook page tracks where people visits the page from, their gender, age group etc. If someone \'liked\' or \'followed\' our page or communicated with us via the page, their data would be kept there. We typically communicate with individuals about sensitive and personal issues by email soon after being contacted on the Facebook page.
b) Data processors
IT & Cloud Storage Services
This data processor does the following activities for us: Information Technology sector (Cloud Data Hosting, Email Hosting & Backup) – located in the UK, EEA, US, or internationally using approved UK GDPR transfer mechanisms (such as Adequacy Decisions, the UK-US Data Bridge, or Standard Contractual Clauses).
Accounting & Financial Software
This data processor does the following activities for us: Financial Technology sector (Bookkeeping, Invoicing, and Payment Processing Services) – located in the UK, EEA, US, or internationally using approved UK GDPR transfer mechanisms.
c) Others we share personal information with
Insurance companies, brokers or other intermediaries
Regulatory authorities
Organisations we’re legally obliged to share personal information with
Professional consultants
Third parties:
Website & Web Hosting Providers, Web Services sector (Website Hosting, Web Application Firewalls, and Contact Form Processors) – located in the UK, EEA, US, or internationally using approved UK GDPR transfer mechanisms.
Sharing information outside the UK
Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.
For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.
a) Overseas Clients, Sponsors, and Visa Application Centres
Category of recipient: Individual clients, family sponsors, overseas employers, and visa application processing centres
Country the personal information is sent to: Worldwide / Various countries
How the transfer complies with UK data protection law: Where we transfer personal information to overseas clients, family sponsors, overseas employers, or visa application processing centres in countries that do not benefit from a UK adequacy decision or appropriate safeguards (such as Standard Contractual Clauses), we rely on one or more of the specific derogations (exceptions) under Article 49(1) of the UK GDPR:
Article 49(1)(b) - Performance of a Contract with You: The transfer is necessary for the performance of a contract between you and us (for example, to process, manage, and submit your visa application or carry out immigration services requested by you).
Article 49(1)(c) - Contract Concluded in Your Interest: Where our agreement is with a third party (such as your overseas employer or sponsor), the transfer is necessary to perform or conclude that contract, which is established in your interest.
Article 49(1)(a) - Explicit Consent: In circumstances where a contractual necessity does not apply, we will obtain your explicit consent before transferring your personal data, after informing you of the potential risks of such transfers to countries without equivalent data protection laws.
b) Cloud IT, Storage, and Software Providers
Category of recipient: Information Technology and Cloud Storage
Country the personal information is sent to: United States and European Economic Area (EEA)
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge). Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.
c) Sub-processors of Cloud IT and Hosting Providers
Category of recipient: Cloud Infrastructure, Data Hosting, Security, and Storage Providers (e.g., Microsoft, Google Workspace, AWS)
Country the personal information is sent to: European Economic Area (EEA) and United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)
d) Sub-processors of Accounting and Financial Software Providers
Category of recipient: Financial Technology, Invoicing, and Payment Processing Infrastructure
Country the personal information is sent to: European Economic Area (EEA) and United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)
e) Sub-processors of Business Communication Platforms (Meta Platforms Ireland \/ Meta Platforms, Inc.)
Category of recipient: Digital Messaging, Social Media Infrastructure, and Communication Networks
Country the personal information is sent to: Ireland (EEA) and United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Email:lara@mosleyyu.com
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint