Privacy Notice for Greater Manchester Victims’ Services website (Victims’ Gateway) (August 2024 onwards)

If user data only stored on Greater Manchester Victims’ Services website (personal data retained solely by GMCA):

Data controller Greater Manchester Combined Authority, Churchgate House, 56 Oxford Street, Manchester M1 6EU
ICO registration reference Z5119967
Customer enquiries contact details officeofdpo@greatermanchester-ca.gov.uk

If user data shared with Greater Manchester Victims’ Services (GMVS) case management system (personal data held on GMVS website hosted by GMCA and shared with Catch22 for them to use for their own purposes):

Data controller GMVS (Catch22)
ICO registration reference Z1473239
Customer enquiries contact details Dpo@catch-22.org.uk

  1. Who we are

    2. The Greater Manchester Combined Authority (GMCA) is made up of the ten Greater Manchester councils, the Greater Manchester Fire and Rescue Service, and the Mayor of Greater Manchester. We work with other local services, businesses, communities, and other partners to improve the city-region.

    Catch22 provides needs-focused services to empower victims and witnesses to cope and recover from the impact of crime and anti-social behaviour, by providing a range of support including emotional and practical guidance, advocacy, and advice. Victim services | Catch22 (catch-22.org.uk)

  2. Summary of the use of the Database

    3. The GMVS website allows users to create an account and complete a self-referral to request support from the GMVS (Catch22).

    The website aims to empower victims of crime to be able to access information and request support, in a way that suits them.

  3. What information we will collect from you (the purpose and legal basis for processing information)

    4. To allow you to create an account on the GMVS website, you will be asked:

    • For your Email address
    • To create a password
    • To create a user name

    If you wish to request support from the GMVS via the Self-referral form, you will be asked to complete the following information to allow a Victims Care Co-ordinator to create a case file for you and make contact with you to start your support journey:

    • User consent – disclaimer* (tick box to confirm you consent to sharing information with GMVS)
    • On behalf of consent – disclaimer (tick box to confirm permission has been provided to share info of another user with GMVS)*
    • Surname*
    • First Name*
    • Known as preferred name
    • Title
    • Address and postcode
    • Email Address
    • Phone number
    • Preferred Contact Method*
    • Preferred Contact Time (AM/PM)
    • Date of Birth*
    • Gender
    • Ethnicity
    • Religion
    • Disability
    • First Language Spoken (Maintained list)
    • English Speaker (Yes/No)
    • Crime Category (Drop down list)*
    • Description of Incident*
    • Crime Reference Number (if known)
    • Date Crime Committed
    • Date Crime Reported to Police (if applicable)
    • Police Contact (GMP Officers/Staff Name/Collar Number) (if applicable)

    *Those with an asterisk are those that would be mandatory with the view of making the self-referral approach as usable as possible, we need to stay away from the risk of service users feeling overwhelmed at the entry point and not engaging as a result.

    Self-assessment questions (part of the Self-referral form):

    1. Has your mental health been affected by the crime? (1-4, 1 being not affected, 4 being very affected)
    2. Has your support network been affected? (1-4, 1 being not affected, 4 being very affected)
    3. Do you feel safe in your home? (1-4, 1 being yes, I feel safe, and 4 being no, I do not feel safe at all)

    The legal basis for collecting and using your personal data will be:

    • Article 6 1(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

    The legal basis for collecting and using ‘special category data’ i.e. information relating to health, ethnicity, religion will be:

    • Article 9, 2(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

    Withdrawal of consent

    At any point, you can withdraw your consent. Please contact us via the email address below and we will take appropriate action:

    GMCA: officeofdpo@greatermanchester-ca.gov.uk

    Catch22: dpo@catch-22.org.uk

    Please keep a copy of this consent form so you have access to this information in the future.

  4. How we ensure the security of your data

    5. The data controllers are committed to providing the appropriate levels of security to the information we collect and use reasonable measures to prevent unauthorised access to that information.  They are required to demonstrate that their solutions meet the required levels of personal, procedural, policy, data, and technical security. They will only process personal information for the purposes it has been collected or subsequently authorised.

  5. Information retention

    6. From creation of your account, the GMCA will keep your information for 12 months after your last use of the GMVS website.

    User accounts will be disabled if they are dormant for 180 days / 6 months, and then deleted after a further 6 months if the account is not accessed. Or an account holder can email GMCA and request that their account be deleted.

    Any data shared with the GMVS (Catch22), will be held on their internal case management system in line with their retention schedule. This is typically for 6 years (informed by the Limitations Act 1980).

  6. Transferring data

    7. All data collected as part of this service will remain in UK.

  7. Data sharing

    8. If the account holder gives consent via the self-referral form, data will be shared from the GMVS website to the GMVS (Catch 22) case management system.

    No data will be shared with the GMVS unless the account holder has expressly given consent.

    Any findings/reports produced to assess the performance of the GMVS website would be anonymised.

  8. What rights do individuals have?

    9. The data controllers must comply with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.

    Under data protection law, your rights include:

    • Your right of access - You have the right to ask us for copies of your personal information.
    • Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
    • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
    • Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
    • Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
    • Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

    You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

    If you wish to make a request, please contact us at:

    Email GMCA: officeofdpo@greatermanchester-ca.gov.uk

    Post GMCA: Office of the DPO GMCA, Churchgate House, 56 Oxford Street, Manchester, M1 6EU

    Email Catch22: dpo@catch-22.org.uk

    Post Catch22: Data Protection Officer, 27 Pear Tree Street, London, EC1V 3AG

  9. How can I make a complaint?

    10. If you are not satisfied with how the data controllers are using the information we hold about you, please contact our Data Protection Officers by emailing:

    GMCA: officeofdpo@greatermanchester-ca.gov.uk

    Catch22: dpo@catch-22.org.uk

    If you are still not satisfied with the GMCA’s or Catch22’s response to any request to exercise your individual rights or if you believe that the GMCA or Catch22 is not processing your personal data in accordance with the law, you can contact the Information Commissioners’ Office:

    Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

    Telephone: 0303 123 1113