How we handle your data.

A. Identity & contact: name, aliases, date and place of birth, nationality, passport or ID numbers, photos, signatures, addresses, phone numbers, email addresses.

B. Case & eligibility: CV/résumé, education, employment history, job offers and contracts, salary and tax data, licences, study offers and enrolment, sponsorship and invitations.

C. Family & relationships: marital or partnership status, spouse, partner, and children details, birth and marriage records, custody and consent documents.

D. Immigration & travel: prior visas and permits, refusals, travel history, entry and exit stamps, I-94 or equivalents, biometrics notices, case numbers, decision letters.

E. Finance & documents: bank statements, proof of funds, sponsorship declarations, company and ownership records, source of funds and wealth (e.g. for investor routes).

F. Sensitive data (special category / criminal): health information for medicals (e.g. TB tests), disability accommodations, police certificates, and data revealing racial, ethnic, or religious origin where present on official records. We collect this only where necessary and lawful.

G. Technical & usage: device identifiers, IP address, country inferred from IP, pages visited, referring URLs, timestamps, cookies, and pixels for analytics and session management.

H. Communications: emails, messages, call notes, WhatsApp or chat transcripts (if you choose to use them), and feedback.

We process personal data only where a lawful basis applies.

A. Providing services / contract: eligibility assessments, strategy, document preparation, bookings, submissions where permitted, status tracking, and guidance. Basis: performance of a contract or steps prior to a contract.

B. Compliance with law: record-keeping, tax and accounting, sanctions and identity checks, lawful requests. Basis: legal obligation.

C. Legitimate interests: client relationship management, improving services, preventing fraud and abuse, security of our systems, audits, business continuity. Basis: legitimate interests not overridden by your rights.

D. Consent: optional marketing, testimonials, and certain uses where required. Basis: your consent (you can withdraw at any time).

E. Vital interests: urgent circumstances affecting health or safety. Basis: vital interests.

We share data only for the purposes described and with appropriate safeguards:

• licensed local counsel where regulated representation is required;
• translation and legalisation providers and document couriers;
• medical panels and police certificate bodies at your instruction;
• government authorities and visa centres to submit and manage applications;
• technology vendors acting as processors (secure cloud storage, CRM, email, scheduling, e-signature, ticketing, accounting);
• payment processors for billing;
• professional advisers and auditors;
• successors in a merger, acquisition, or reorganisation, with safeguards.

We retain data only as long as necessary for the purposes in this policy and to meet legal and regulatory requirements. Typical periods:

• Client matter files: 6 years after case closure (longer if required for legal claims).
• Accounting and tax: 7 years from the end of the financial year.
• KYC and sanctions checks: 5 years from the end of the client relationship (or as required by law).
• Marketing contacts: until you opt out, then minimal suppression data for up to 2 years.
• Recruitment applications: 12 months if not hired (or as required by local law).
• Messaging transcripts: up to 2 years from case closure (longer if required for compliance).

If you request deletion, we'll comply subject to legal limits and explain any records we must retain.

Depending on your location, you may have rights to:

• access your data;
• rectify inaccurate or incomplete data;
• erase data in certain cases;
• restrict processing in certain cases;
• data portability (a machine-readable copy of data you provided);
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent where processing relies on consent;
• complain to a supervisory authority.

Supervisory authorities:

• UK: Information Commissioner's Office (ico.org.uk)
• EEA: your local Data Protection Authority (see edpb.europa.eu)
• US: your state attorney general or relevant federal agency