Privacy Policy

1. OVERVIEW AND SCOPE

Visa Appeal Platform (“Company”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use our website and online platform (collectively, the “Platform”). It also explains your rights regarding your personal information and how to contact our Privacy Officer.

This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal privacy law, which applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activities within Canada.To the extent applicable, this Policy also respects provincial privacy laws.

2. DEFINITION OF PERSONAL INFORMATION

Personal information means any information about an identifiable individual. This includes, but is not limited to:

• Full name

• Email address, phone number, and mailing address

• Date of birth

• Government-issued identification numbers (including passport numbers, permanent resident card numbers, or other immigration document numbers)

• Financial information (credit card details, billing address, payment history)

• Information related to your immigration case, including visa refusal decisions, supporting documents, and communications with legal professionals accessed through our Platform

• Technical data such as IP address, browser type, device identifiers, and usage information collected via cookies and similar technologies

Personal information does not include aggregated, anonymized, or de-identified information that cannot reasonably be used to identify an individual.

3. COLLECTION OF PERSONAL INFORMATION

We collect personal information by fair and lawful means, primarily directly from you. We collect the following categories of information:

3.1 Information You Provide to Us

• Account Registration: When you create a free account, you provide your name, email address, phone number, and a password.

• Order Form / Intake Forms: When you retain our legal services, you provide detailed personal and case-specific information, including information about your immigration history, visa refusal, and any supporting documentation.

• Payments: When you make a payment, our third-party payment processors collect your billing information (credit/debit card details, billing address). We do not store full payment card details on our own servers.

• Communications: When you contact us via email, our contact form, or telephone, we may collect the information you provide to respond to your inquiry.

3.2 Information Collected Automatically

When you visit our Platform, we automatically collect certain technical information through cookies, web beacons, log files, and similar technologies, including:

• IP address

• Browser type and version

• Operating system

• Referring website URLs

• Pages visited, time and date of visits, and time spent on pages

• Clickstream data

4. PURPOSES FOR COLLECTION AND USE

We collect, use, and disclose your personal information only for the following purposes:

• To create and manage your user account.

• To facilitate the delivery of legal services by connecting you with independent immigration lawyers and paralegals.

• To process your orders and payments.

• To communicate with you about your account, orders, case updates, and service notifications via email, including through our client portal.

• To respond to your inquiries and provide customer support.

• To comply with legal and regulatory obligations, including anti-spam legislation (CASL) and court-imposed deadlines.

• To improve our Platform, including analyzing usage patterns, troubleshooting technical issues, and enhancing security.

• To send you administrative emails, updates, or security alerts.

• For any other purpose for which you have provided consent.

Your personal information will not be used for any other purpose without your consent, unless required or permitted by law.

5. CONSENT

5.1 Obtaining Consent

We obtain your consent to collect, use, and disclose your personal information at the time of collection, except where otherwise permitted by law. By accessing the Platform, registering for an account, or submitting an order form, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

5.2 Express vs. Implied Consent

• Express Consent: We obtain your express (explicit) consent for the collection, use, or disclosure of sensitive personal information, including financial information, case-specific immigration details, and any information shared with legal professionals. Express consent is obtained in writing or through your affirmative action (e.g., checking a consent box or signing an engagement form).

• Implied Consent: We may rely on implied consent for non sensitive information when the purpose is obvious from the context or where we have an existing relationship with you (e.g., using your email address to send service-related notifications).

5.3 Withdrawal of Consent

You may withdraw your consent at any time, subject to legal or contractual restrictions. To withdraw your consent, please contact our Privacy Officer at [Insert Email Address]. If you withdraw your consent, we may no longer be able to provide certain services to you. We will inform you of the consequences of withdrawing your consent before acting on your request.

5.4 Consent for Commercial Electronic Messages (CASL Compliance)

We comply with Canada’s Anti-Spam Legislation (CASL). Before sending you any Commercial Electronic Message (CEM) for marketing or promotional purposes, we will obtain your express consent. Each such message will include:

• Clear identification of the sender.

• Our contact information.

• An unsubscribe mechanism allowing you to opt out of receiving future CEMs at no cost. You may opt out at any time by clicking the “unsubscribe” link provided in any such message.

Service-related messages (e.g., order confirmations, case updates, payment confirmations) are not CEMs and may be sent without your prior consent on the basis of our existing business relationship with you.

6. DISCLOSURE AND SHARING OF PERSONAL INFORMATION

We do not sell or rent your personal information to third parties. We may disclose your personal information only in the following circumstances:

• To Legal Professionals: When you retain legal services through our Platform, we share your personal information and case details with the independent immigration lawyers or paralegals you have selected. These professionals are independent contractors and are bound by their own professional obligations of confidentiality and privacy.

• To Third-Party Service Providers: We share your personal information with trusted third-party service providers who assist us in operating the Platform and delivering services to you, including: payment processors (e.g., Stripe, PayPal); cloud hosting and data storage providers; email service providers; analytics providers (e.g., Google Analytics); and customer support software providers. These service providers are contractually obligated to protect your information and use it only for the purposes for which it was disclosed.

• For Legal Compliance: We may disclose your personal information if required to do so by law, regulation, legal process, or a government request (e.g., a subpoena, court order, or search warrant). We may also disclose your information to enforce our Terms of Use or to protect the rights, property, or safety of the Company, our users, or others.

• With Your Consent: We may disclose your personal information for any other purpose for which we have obtained your express consent.

7. COOKIES AND TRACKING TECHNOLOGIES

Our Platform uses cookies and similar tracking technologies (including web beacons, pixels, and log files) to enhance user experience, analyze traffic, and improve our services.

7.1 Types of Cookies We Use

• Essential Cookies: These are necessary for the Platform to function properly (e.g., to maintain your session, remember login status, and support secure transactions). They do not require your consent as they are strictly necessary for the operation of the Platform.

• Functional Cookies: These allow the Platform to remember choices you make (such as language preferences) to provide enhanced functionality.

• Analytics/Performance Cookies: These help us understand how users interact with the Platform by collecting aggregated, anonymized information. We use services such as Google Analytics for this purpose.

• Marketing/Targeting Cookies: These track browsing habits to deliver targeted advertising. We only use such cookies with your express consent.

7.2 Consent to Non-Essential Cookies

For non essential cookies (e.g., analytics, marketing, functional cookies that are not strictly required), we rely on implied consent under PIPEDA, as the data collected is not sensitive and its use aligns with your reasonable expectations. However, where required by emerging privacy standards (including the anticipated CPPA framework), we may implement an explicit opt in mechanism. You may manage your cookie preferences through your browser settings.

7.3 Managing Cookies

Most browsers automatically accept cookies. You can modify your browser settings to reject cookies or notify you when a cookie is being placed. However, if you disable essential cookies, some features of the Platform may not function properly.

8. DATA SECURITY SAFEGUARDS

We take the security of your personal information seriously and have implemented physical, technical, and organizational safeguards appropriate to the sensitivity of the information we collect.These measures include:

• Encryption: Sensitive information (including payment information and case documents) is encrypted during transmission using Secure Socket Layer (SSL) technology.

• Access Controls: Access to personal information is restricted to employees, contractors, and service providers who require access to perform their duties. All such individuals are bound by confidentiality obligations.

• Secure Servers: Personal information is stored on secure servers with firewall protections and regular security monitoring.

• Security Assessments: We periodically review and update our security practices to protect against unauthorized access, use, alteration, or disclosure of personal information.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. DATA RETENTION

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required by law or professional standards.Our retention periods are as follows:

• Account Information: Retained for the duration of your account’s activity and for a reasonable period thereafter (e.g., 7 years) in the event you wish to reactivate your account or as required for legal or professional record keeping obligations (including law society requirements).

• Transaction and Case Records: Retained for a minimum of 7 years after the completion of your legal service, consistent with professional and legal obligations for client files.

• Technical Logs and Analytics Data: Retained for a period not exceeding 24 months, after which data is anonymized or deleted.

When personal information is no longer required, it is securely destroyed, erased, or anonymized.

10. CROSS BORDER DATA TRANSFERS

We may transfer and store your personal information on servers located outside of your province or territory of residence, including outside of Canada (e.g., in the United States). This may occur when we use third-party service providers (such as cloud hosting, email services, or payment processors) that are located in other jurisdictions.

Under PIPEDA, we remain accountable for your personal information even when it is transferred outside of Canada.The laws of the foreign jurisdiction in which your information is stored may differ from Canadian privacy laws, including granting access to your personal information by foreign courts, law enforcement, or national security authorities. By using our Platform, you acknowledge and consent to such cross-border transfers.

We ensure that any cross-border transfer of personal information is subject to appropriate contractual safeguards, including binding agreements that require the receiving party to protect your information to a standard comparable to PIPEDA. For more information about our cross border data practices, please contact our Privacy Officer.

11. YOUR RIGHTS: ACCESS, CORRECTION, AND COMPLAINTS

Under PIPEDA, you have the following rights regarding your personal information:

11.1 Right to Access

You have the right to request access to your personal information held by us. We will respond to your request within 30 days of receipt, providing you with a copy of your personal information in a readily understandable format, subject to certain exceptions permitted by law (e.g., information containing references to other individuals or information subject to solicitor client privilege).

11.2 Right to Correct

If you believe that any personal information we hold about you is inaccurate, incomplete, or outdated, you may request that we correct it. If we agree that the information is inaccurate, we will amend it. If we disagree, we will annotate the information with your requested correction.

11.3 Right to Challenge Compliance

You have the right to challenge our compliance with this Privacy Policy and applicable privacy laws.

11.4 How to Exercise Your Rights

To exercise any of these rights, please submit a written request to our Privacy Officer at the contact information provided in Section 14. We may require that you provide sufficient identification information to verify your identity before processing your request.

11.5 Complaints to the Privacy Commissioner

If you are not satisfied with our response to your access, correction, or compliance request, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at:

Email: info@visapeal.com

Address: Toronto, Ontario

Phone: +1 (416) 200-0131

12. BREACH NOTIFICATION PROCEDURES

In the event of a privacy breach involving your personal information that poses a real risk of significant harm (including identity theft, financial loss, or reputational damage), we will comply with PIPEDA’s mandatory breach notification requirements. Specifically, we will:

• Report the breach to the Office of the Privacy Commissioner of Canada.

• Notify affected individuals directly (via email or other appropriate means) without undue delay.

• Keep a record of the breach for a minimum of 24 months.

13. THIRD-PARTY WEBSITES AND LINKS

Our Platform may contain links to third-party websites, including those of independent legal professionals, payment processors, or government agencies (such as the Immigration and Refugee Board of Canada or the Federal Court). This Privacy Policy applies only to our Platform. We are not responsible for the privacy practices or content of any third-party websites. We encourage you to review the privacy policies of any third-party sites you visit.

14. CONTACT INFORMATION – PRIVACY OFFICER

Under PIPEDA, we have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws.

For any questions, concerns, access requests, corrections, or complaints regarding this Privacy Policy or our handling of your personal information, please contact our Privacy Officer at:

Visa Appeal Platform

Attn: Privacy Officer

Email: info@visapeal.com

Address: Toronto, Ontario

Phone: +1 (416) 200-0131

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The most current version of this Privacy Policy will be posted on our Platform, with the “Last Updated” date indicated at the top of this document. Your continued use of the Platform after any changes constitute your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Platform.

16. GOVERNING LAW

This Privacy Policy and our collection, use, and disclosure of your personal information shall be governed by and interpreted in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA.

17. INTERPRETATION

The headings in this Privacy Policy are inserted for convenience only and shall not affect its interpretation. References to “including” shall be interpreted as “including without limitation” unless otherwise expressly stated.