Privacy Policy — Centre for Migration Control

1. Who we are

The Centre for Migration Control ("CMC", "we", "us", "our") is an independent think tank focused on UK immigration policy. We are the data controller for personal data collected through this website (centreformigrationcontrol.com).

If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2. What data we collect

We collect personal data in the following circumstances:

Email newsletter sign-up — your email address and your postcode. We use your postcode to understand the geographic distribution of our supporters and to inform our policy work. It is never shared with third parties or used for any other purpose.
Contact form — your name, email address, and the content of your message.
Donations via Stripe — payment is processed directly by Stripe. We receive a transaction reference and donation amount; we do not store your card details.
Website analytics — anonymised usage data (pages visited, referrer, device type) to help us improve the site. No personally identifiable information is collected at this stage.

3. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

Consent — when you sign up to our newsletter.
Legitimate interests — when you submit a contact enquiry, we process your data to respond to your request.
Contract — when processing a donation, to fulfil the transaction.

4. How we use your data

We will never sell your personal data to third parties or use it for purposes incompatible with those stated above.

To send you our newsletter and policy updates (where you have subscribed).
To respond to contact enquiries.
To process donations securely via Stripe.
To improve the performance and content of this website.

5. Data sharing

We share your data only where necessary:

We do not transfer your data outside the UK or EEA without appropriate safeguards in place.

Stripe — for secure payment processing. Stripe's privacy policy is available at stripe.com/gb/privacy.
Hosting and infrastructure providers — our website is hosted on secure cloud infrastructure. Providers are contractually bound to process data only on our instructions.

6. Data retention

We retain personal data only for as long as necessary:

Newsletter subscribers — your email address and postcode are retained until you unsubscribe or request deletion.
Contact enquiries — up to 2 years from the date of enquiry.
Donation records — 7 years for financial compliance purposes.

7. Cookies

This website uses a small number of essential cookies required for the site to function (for example, to maintain your session if you use the admin panel). We do not currently use advertising or tracking cookies. If this changes, we will update this policy and seek your consent where required.

8. Your rights

Under UK GDPR, you have the right to:

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Access — the personal data we hold about you.
Rectification — of inaccurate data.
Erasure — ("right to be forgotten") in certain circumstances.
Restriction — of processing in certain circumstances.
Data portability — where processing is based on consent or contract.
Object — to processing based on legitimate interests.
Withdraw consent — at any time where processing is consent-based.

9. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this page periodically.