Privacy Policy

How VG Immigration Services Inc. handles your personal information.

Effective Date: April 25, 2026 | Last Updated: July 21, 2026
Compliance: PIPEDA (Canada) · Ontario PHIPA where applicable · Quebec Law 25 (Bill 64) · EU/UK GDPR · CICC Code of Professional Conduct · CASL · CRTC Unsolicited Telecommunications Rules · AODA

This Privacy Policy is a companion document to our Legal Disclaimer & Terms of Use. Please read both.

Quick Navigation: 1. Purpose · 2. Scope · 3. Information We Collect · 4. How We Use It · 5. Legal Basis · 6. Sharing & Disclosure · 7. AI Tools & Automated Decisions · 8. Client Portal · 9. Cookies & Tracking · 10. Retention · 11. Security · 12. International Transfers · 13. Your Rights · 14. CASL & Newsletter · 15. Do-Not-Call & Phone Outreach · 16. Quebec Law 25 · 17. AODA Accessibility · 18. Children · 19. Breach Notification · 20. CICC Confidentiality & Complaints · 21. Changes · 22. Contact

1. Purpose of this Policy

VG Immigration Services Inc. (“VGIS,” “we,” “our,” “us”) respects your privacy and protects your personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws — including Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25 — and, where you reside in the EU/UK, the General Data Protection Regulation (GDPR/UK-GDPR). As a CICC-regulated firm, we also follow the College of Immigration and Citizenship Consultants’ confidentiality requirements.

2. Scope

This Policy applies whenever you:

visit vgis.ca or any VGIS subdomain;
use our AI tools (CRS Calculator, NOC Finder AI, AI Letter Generator, OINP eligibility tools);
submit a contact form, lead form, or newsletter signup;
book a paid consultation through our Square-powered booking page;
upload documents to our Immiboard Client Portal;
communicate with us by email, WhatsApp, phone, or social media;
engage VGIS for paid immigration consulting services.

3. Information We Collect

Category	Examples	Source
Identity & Contact	Name, email, phone, country of residence, preferred language	You — forms, bookings, portal
Immigration Profile	Age, education, work experience, language scores, NOC, family composition, prior visa history	You — consultations, portal, retainer
Sensitive Data	Passport, biometrics, medical, criminal background, financial documents (only when needed for IRCC submission)	You — Client Portal upload
Payment Data	Last 4 digits of card, transaction ID — full card data is processed by Square and never stored by VGIS	Square (PCI-DSS Level 1)
Technical Data	IP address, browser, device type, referring URL, pages visited, time on site	Server logs, analytics
AI Tool Inputs	Job titles, education levels, language scores, draft letter prompts	You — when using free tools
Cookies & Tracking	Session, preference, analytics, advertising IDs (with consent)	Your browser
Communications	Email, WhatsApp, phone-call recordings where lawfully made and disclosed, social-media messages	You — direct contact

4. How We Use Your Information

Provide consultations, assess eligibility, and prepare IRCC / provincial submissions.
Operate the Client Portal and securely exchange documents.
Respond to enquiries, schedule appointments, and process payments.
Power free AI tools (CRS, NOC Finder, Letter Generator) — inputs may be sent to third-party AI providers under their own terms.
Send transactional emails (booking confirmations, document requests, retainer updates).
Send marketing newsletters and immigration updates (only with your consent — unsubscribe anytime).
Comply with legal, regulatory, and CICC obligations.
Detect, prevent, and respond to security incidents and fraud.

5. Legal Basis for Processing

We process your data on one or more of the following bases: (a) your consent; (b) contractual necessity (your retainer); (c) legal obligations (CICC, IRCC, anti-money-laundering); and (d) legitimate interests such as service improvement, security, and lead follow-up where you submit a form.

6. Sharing & Disclosure

We share personal information only as needed and with safeguards in place:

Government bodies: IRCC, CBSA, provincial PNP authorities, the Immigration and Refugee Board — to submit your application or as required by law.
Service providers (data processors): Immiboard (CRM & portal), Square (payments & bookings), Google Workspace (email & docs), Microsoft Outlook, Cloudflare (security & CDN), Google reCAPTCHA (bot protection), Google Analytics (analytics), Meta Pixel (marketing analytics — consent-gated), LinkedIn Insight Tag (marketing analytics — consent-gated), MailPoet (newsletter delivery), WordPress hosting, Perplexity AI / OpenAI / Anthropic (AI tools). Each is bound by data-processing or confidentiality agreements.
Professional advisors: lawyers, accountants, auditors — under confidentiality.
Legal disclosure: when required by law, court order, subpoena, warrant, or to defend our rights.
Business transfers: if VGIS is acquired, your data may transfer to the successor under equivalent protection; we will notify affected clients.

We do not sell personal information.

7. AI Tools & Automated Decisions — Important Notice

Our free CRS Calculator, NOC Finder AI, AI Letter Generator, OINP eligibility tools, and any similar AI-assisted features send certain inputs (e.g., job title, education, language scores, letter prompts) to third-party AI providers — which may include but are not limited to Perplexity AI, OpenAI, and Anthropic — to generate responses.

By using these tools you agree:

Inputs are subject to the third-party AI provider’s own privacy policy.
VGIS does not store your AI tool inputs against your identity unless you also submit a contact form.
Do not paste full passport numbers, SINs, banking details, or sensitive medical information into AI tool fields.
AI outputs are estimates and not legal advice. See our Legal Disclaimer §7.

Automated Decision-Making Disclosure (GDPR Art. 22, Quebec Law 25): Our AI tools use rule-based scoring (e.g., CRS points calculations) and language-model reasoning (NOC classification, letter drafting) to produce estimates. These tools do not make final immigration or legal decisions and do not produce legally binding outcomes; those decisions are made by IRCC, the provincial nomination programs, the Immigration and Refugee Board, or the Federal Court. You have the right at any time to request human review by Dimple Verma, RCIC-IRB, by booking a paid consultation.

8. Client Portal — Document Handling

The VGIS Client Portal (Immiboard) is hosted on Canadian/US infrastructure and used exclusively for active retainer clients.

Encryption: data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Access controls: per-client folders, role-based staff permissions, audit logging.
Authentication: unique credentials; we recommend enabling 2FA where offered.
Retention: documents retained for the duration of your file plus 7 years (CICC requirement) unless you request earlier deletion where legally permitted.
Backups: encrypted, geographically redundant, retained on a rolling 90-day cycle.
Report any suspected breach immediately to case@vg-immigration.com.

9. Cookies & Tracking Technologies

We use cookies and similar tools for:

(a) Essential: session, security, load balancing (WordPress core, Cloudflare, Google reCAPTCHA). These cannot be disabled without breaking the Site.
(b) Preference: language, cookie-consent choice.
(c) Analytics: Google Analytics (anonymized IPs, no cross-site tracking).
(d) Marketing: Meta Pixel (Facebook & Instagram) and LinkedIn Insight Tag — only fired after you grant explicit consent via the cookie banner. Denying consent disables these pixels.

You can manage cookies through your browser settings or our cookie banner. Disabling essential cookies may break booking and portal functionality.

10. Retention

Active client files: for the duration of your retainer.
Closed client files: 7 years from closure (CICC requirement).
Marketing/newsletter data: until you unsubscribe, then 30 days.
Lead form submissions (no engagement): 24 months, then deleted.
Server logs & analytics: 13 months.
AI tool transient inputs: not retained against identity by VGIS.

11. Security Safeguards

We use administrative, physical, and technical safeguards proportionate to the sensitivity of the data: TLS encryption, hardened WordPress with managed firewall, 2FA on staff accounts, least-privilege access, application password rotation, regular backups, and staff confidentiality training. No system is 100% secure — we cannot guarantee absolute security but follow industry best practices.

12. International Data Transfers

Your data may be processed in Canada, the United States, and the EU through our service providers. Where required, we use Standard Contractual Clauses or equivalent safeguards. Canadian data benefits from the Canada–EU adequacy decision. For clients residing in Quebec, we conduct a privacy impact assessment before transferring personal information outside Quebec, as required by Law 25.

13. Your Privacy Rights

Subject to applicable law you may:

Access — request a copy of personal information we hold about you.
Correct — request correction of inaccurate or outdated data.
Delete — request deletion (subject to CICC’s 7-year file retention).
Restrict / Object — to certain processing.
Portability — receive your data in a structured, machine-readable format.
Withdraw consent — for marketing or non-essential processing at any time.
Human review of automated decisions — request that any AI-tool output be reviewed by a human RCIC.
Lodge a complaint — with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec (for Quebec residents), your provincial commissioner, or your EU data protection authority.

Email case@vg-immigration.com with subject line “Privacy Request.” We acknowledge requests within 5 business days and respond substantively within 30 days, with a one-time 30-day extension where reasonable under PIPEDA s.31.

14. CASL & Newsletter Consent

Our marketing newsletters and promotional messages are sent only to recipients who have provided express consent (by checking a consent box or double-opt-in confirmation) or who fall within CASL’s implied-consent categories under Canada’s Anti-Spam Legislation (S.C. 2010, c. 23) — for example, an existing business relationship within the applicable two-year window, or a business-card exchange within two years.

Every marketing email includes:

VGIS’s identity, physical address, and contact information;
A functional one-click unsubscribe link that we honour within 10 business days.

To unsubscribe at any time, click the link in any newsletter or email immigration@vgis.ca with subject line “Unsubscribe.” We use MailPoet (delivering via SendGrid / Amazon SES infrastructure) as our newsletter service provider.

15. Do-Not-Call List & Phone Outreach

Where we make outbound telephone or SMS outreach, we do so only to individuals who have provided prior consent or who fall within the exemptions under the CRTC’s Unsolicited Telecommunications Rules and Canada’s National Do Not Call List (DNCL) framework. To opt out of VGIS phone or SMS outreach, email immigration@vgis.ca with subject line “Do Not Call.” You may also register with the National Do Not Call List.

16. Quebec Law 25 — Additional Rights for Quebec Residents

If you reside in Quebec, additional rights apply under the Act respecting the protection of personal information in the private sector, as amended by Law 25 (Bill 64):

Privacy Officer designation: Our Privacy Officer (see Section 22) is the person accountable for VGIS’s privacy compliance.
Privacy impact assessments: We conduct a privacy impact assessment before implementing any new project that involves personal information and before transferring personal information outside Quebec.
Right to data portability: You may request that your computerized personal information be communicated to you or, where technically feasible, to a third party you designate, in a structured, commonly used technological format.
Automated decision transparency: On request, we will inform you of the personal information used to render an automated decision that affects you, the principal factors and parameters used, and your right to have the decision reviewed by a person.
Complaints: You may file a complaint with the Commission d’accès à l’information du Québec (CAI).

17. AODA Accessibility Statement

VGIS is committed to providing an accessible digital experience for all users, in accordance with the Accessibility for Ontarians with Disabilities Act, 2005 (AODA) and the Integrated Accessibility Standards, O. Reg. 191/11. We work toward WCAG 2.0 Level AA conformance on public pages of the Site.

If you encounter an accessibility barrier, or if you require this Privacy Policy, the Legal Disclaimer, retainer documents, or any communication in an alternate format (large print, plain text, screen-reader-optimized, audio), please contact us at immigration@vgis.ca or WhatsApp +1 416-578-9269. We will respond within a reasonable timeframe and at no additional cost.

18. Children’s Privacy

Our services are not directed at children under 13 (or 16 in the EU/UK, or 14 in Quebec). We do not knowingly collect children’s data without verifiable parental consent. Where minors are dependents on a family immigration application, parents/guardians provide the data on their behalf.

19. Breach Notification

In the event of a personal-information breach posing real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA’s mandatory breach reporting rules, the Commission d’accès à l’information du Québec where Quebec residents are affected, and any other applicable regulators (e.g., GDPR Article 33/34) without undue delay and, where feasible, within 72 hours of becoming aware.

20. CICC Confidentiality & Complaints

Beyond statutory privacy law, VGIS is bound by the confidentiality provisions of the CICC Code of Professional Conduct. If you believe Dimple Verma, RCIC-IRB, or any VGIS staff has breached confidentiality or improperly handled your personal information, you may file a complaint with the CICC’s Investigations and Complaints Resolution Office in addition to any statutory privacy remedy:

Online: CICC — Make a Complaint
Email (ICRO): icro@college-ic.ca
Phone: 1-877-836-7543, extension 1119
Mail: ICRO, CICC, 1002-5500 North Service Road, Burlington, Ontario, L7L 6W6

21. Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. Material changes will be posted here with a revised “Last Updated” date and, where required, communicated by email. Continued use after the update constitutes acceptance.

22. Contact & Privacy Officer

Privacy Officer — VG Immigration Services Inc.
Brampton, Ontario, Canada
Email: case@vg-immigration.com
General: immigration@vgis.ca
WhatsApp: +1 416-578-9269
Website: vgis.ca
RCIC-IRB: Dimple Verma, licence R708308 (CICC)

Last Updated: July 21, 2026. This document supersedes all prior versions.