Privacy Policy

1. Scope

The Cayman Islands Government Office – United Kingdom (“CIGO-UK”) respects your privacy and takes care in protecting your personal data. As a data controller, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “CI DPA”), the United Kingdom General Data Protection Regulation (the “UK GDPR”) and the United Kingdom Data Protection Act 2018 (the “UK DPA”). This privacy notice (“Privacy Notice”) demonstrates our commitment to ensuring your personal data is handled responsibly.

This Privacy Notice does not apply to the CIGO-UK processing personal data relating to our employees, who are covered under our Employee Privacy Notice. This Privacy Notice also does not apply to personal data that may be processed by the Cayman Islands Government Cabinet Office or other agencies that are separate data controllers from the CIGO-UK, including if the personal data were lawfully disclosed to that data controller by the CIGO-UK.

2. What Personal Data We Collect

The CIGO-UK collects personal data, including sensitive personal data as defined in the CI DPA and special category and criminal offence data as provided for in the UK GDPR, directly from you. We may also collect your personal data indirectly from third-party sources. Personal data collected by the CIGO-UK is limited to what is necessary for our processing activities. In this Privacy Notice, personal data means any data relating to an identified or identifiable living individual and includes data required to provide you with consular and student services.

Personal data we collect directly from you

The CIGO-UK may collect the following information directly from you: a. Personal data you provide online, including through the CIGO-UK website, www.cigouk.ky, such as:

i. Your Internet Protocol (“IP”) address, details of which device or version of web browser you used to access our website content, and other information about how you used our website (see our Cookie Notice for more information: https://cigouk.ky/privacy-policy);

ii. Your email address, demographic data (e.g. place of residence, connection to the Cayman Islands, profession), and subscription preferences if you sign up for our newsletters, and how you utilise the emails you receive from us, including whether you open them and which links you click; and

iii. Your name and/or social media handle, public profile photo, and any other information you choose to provide when interacting with the CIGO-UK on various social media platforms, including Facebook, Instagram, X, LinkedIn and YouTube, whether you provide this information through public posts and comments or through direct messaging features;

b. Personal data you provide when you visit the CIGO-UK offices or interact with us at other locations, contact us by email or telephone, or access our programmes and services. If you ask questions about our programmes and services or provide information in order for us to provide you with relevant services or register you for our programmes, these questions or information may also reveal other personal data, e.g. your citizenship, immigration or residency status in the United Kingdom or in the Cayman Islands, employment or educational information, family status, health information, or property ownership;

c. Personal data you provide when you inquire about or apply for a job with the CIGO-UK. If you apply for a job with the CIGO-UK via the Cayman Islands Government e-recruitment platform, an additional privacy notice is available here: https://careers.gov.ky/application/custom/English/privacy-statement.html;

d. Personal data collected via CCTV at the CIGO-UK premises – including images collected via cameras located at the 4th Floor of 34 Dover Street, London, W1S4NG – and through any other lawful and appropriate security and monitoring systems; and

e. Any other personal data where the collection is necessary to achieve our lawful purpose(s).

Personal data collected from other sources

The CIGO-UK may collect the following personal data from other sources:

a. Personal data collected via CCTV at the CIGO-UK premises at 34 Dover Street, London, W1S4NG or other locations where we operate or provide programmes and services, if the images and/or images with audio are lawfully disclosed to the CIGO-UK by the property manager or other third party as the initial data controller that collected the footage at the premises or other location;

b. Personal data contained within publicly available sources of information, e.g. online biographies, public registers, government directories, employment directories and news media;

c. Personal data such as your name, contact details, employment details and potential areas of interest in the work of the CIGO-UK, which may be collected through our engagement and networking efforts;

d. Personal data provided by a family member or other close connection who is accessing a CIGO-UK programme or service, e.g. your parent may seek our advice on student visas or home fees and disclose your name and (intended) educational institution in the course of that interaction; and

e. Any other personal data where the collection is necessary to achieve our lawful purpose(s).

3. How We Use Your Personal Data

The CIGO-UK works to support the extension of all Cayman Islands Government activities in the United Kingdom and Europe. We develop and broaden the connection between the Cayman Islands and the United Kingdom, promote the Cayman Islands within the United Kingdom, create wider opportunities for Caymanian students, and identify synergies within the United Kingdom civil service for the benefit of the Cayman Islands.

The CIGO-UK may use your personal data for the following purposes:

a. Implementing policies, providing services and programmes, and managing your relationship with us;

b. Responding to your inquiries;

c. Verifying your identity;

d. Measuring how users interact with the CIGO-UK’s website and continually improving our communications channels (including by aggregating personal data collected using cookies);

e. Communicating and interacting with website visitors;

f. Communications and public relations activities;

g. Managing accounts payable and receivable, preventing fraud, and protecting public funds;

h. Statistical and other reporting, both internally and externally;

i. Seeking legal advice, and exercising or defending legal rights;

j. Complying with our legal obligations, including legislation that provides for records and information management, procurement, financial management, audit, and similar functions and activities; and

k. Communicating and interacting with job applicants and related third parties (e.g. references) and carrying out recruitment and selection processes.

4. How We Share Your Personal Data

The CIGO-UK may share your personal data as required, including under applicable legislation, with recipients that include other data controllers, our data processors, and third parties. We will only share your personal data as permitted by the CI DPA, UK GDPR and UK DPA.

Your personal data may be shared with the following recipients that support our public functions and operations:

a. With other Cayman Islands public authorities: Personal data may be shared with other Cayman Islands public authorities – here, “public authorities” is defined in the CI DPA and means Ministries, Portfolios, Offices, Departments, Statutory Authorities, Statutory Bodies and Government Companies – for the purposes set out in this Privacy Notice. These recipient public authorities may be separate data controllers (e.g. the Office of the Auditor General), may be assisting the CIGO-UK as a data controller (e.g. the Cabinet Office), or may serve as a data processor for the CIGO-UK (e.g. the Computer Services Department).

b. With data processors external to the Cayman Islands Government: Personal data may be shared with persons providing services to the CIGO-UK as a data processor. When they are acting as data processors, these service providers are only able to use personal data under our instructions. We engage data processors for a variety of processing activities, which may include:

i. Webhosting and Information Technology;

ii. Records and Information Management, including storage facilities;

iii. Communications and promotions;

iv. Events management; and

v. Security operations and fraud prevention.

In limited circumstances, service providers who act as data processors for the CIGO-UK may also act as a separate data controller in relation to their own purposes for processing your personal data, e.g. to provide customer support, or for analytics or machine learning in order to improve their services. These are unrelated to the purposes for which the CIGO-UK processes your personal data and should be clearly and directly disclosed to you by the service provider through their own separate privacy notice. However, you may contact us to ask about our current service providers and specific instances, if any, that we are aware of where your personal data may be processed for a service provider’s own purposes.

c. With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:

i. Seeking legal advice;

ii. Exercising or defending legal rights;

iii. Complying with internal and external audits or investigations by competent authorities; and

iv. Complying with information security policies or requirements.

d. With other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with relevant legislation.

5. Our Legal Bases for Processing Your Personal Data

Depending on applicable laws and other circumstances, the CIGO-UK will rely on specific legal bases under the UK GDPR and similar “conditions of processing” under the CI DPA, to process your personal data. These may include:

a. A legal obligation to which the CIGO-UK is subject, including various obligations under Cayman Islands legislation which regulates all public sector activities, such as the Procurement Act (2023 Revision) and Procurement Regulations (2022 Revision), the Public Management and Finance Act (2020 Revision) and Financial Regulations (2022 Revision), the Freedom of Information Act (2021 Revision) and Freedom of Information (General) Regulations (2021 Revision) and the National Archive and Public Records Act (2015 Revision) and National Archive and Public Records Regulations, 2007;

b. To perform a task carried out in the public interest, or to exercise our public functions or official authority vested in the CIGO-UK, including the functions of the CIGO-UK to provide consular services and student services to Caymanians and other stakeholders in the United Kingdom and to support the extension of all Cayman Islands Government activities in the United Kingdom;

c. To perform or enter into a contract with you, e.g. as a contractor providing services to the CIGO-UK;

d. To protect your vital interests, or the vital interests of another individual;

e. Consent, e.g. to send you our newsletter or to administer surveys and polls; and

f. For the purposes of legitimate interests pursued by the CIGO-UK or by a third party or parties to whom the personal data may be disclosed, e.g. when taking photographs and videos at our events and sharing them on our social media channels, or when disclosing records containing third party personal data in response to a request submitted under the Cayman Islands Freedom of Information Act (2021 Revision).

Where we process your “sensitive personal data” as defined in the CI DPA, we will also meet at least one second condition of processing under the CI DPA. These conditions may include:

a. To exercise our public functions, including under an enactment;

b. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights;

c. To protect your vital interests or those of another person, under relevant conditions; and

d. The personal data have been made public as a result of steps you have taken as the data subject.

We will only process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union members; genetic data; biometric data to uniquely identifying an individual; data concerning health; or data concerning an individual’s sex life or sexual orientation (together known as “special category data”), if at least one of the following exceptions applies:

a. You gave explicit consent to the processing of those personal data for one or more specified purposes;

b. To protect your vital interests or those of another individual, under conditions set out in the UK GDPR;

c. You have manifestly made public the personal data being processed;

d. The processing is necessary for the establishment, exercise or defence of legal claims;

e. The processing is necessary for reasons of substantial public interest, on the basis of UK law and under conditions set out in the UK GDPR; and

f. The processing is necessary for archiving purposes in the public interest or for statistical purposes, and it is carried out in line with conditions set out in the UK GDPR and UK DPA, which include the provision of suitable and specific measures to safeguard your rights and interests.