1. Purpose of this Policy

VG Immigration Services Inc. (“VGIS,” “we,” “our,” “us”) respects your privacy and protects your personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, and — where you reside in the EU/UK — the General Data Protection Regulation (GDPR/UK-GDPR). As a CICC-regulated firm, we also follow the College of Immigration and Citizenship Consultants’ confidentiality requirements.

2. Scope

This Policy applies whenever you:

• visit vgis.ca or any VGIS subdomain;
• use our AI tools (CRS Calculator, NOC Finder AI, AI Letter Generator, OINP eligibility tools);
• submit a contact form, lead form, or newsletter signup;
• book a paid consultation through our Square-powered booking page;
• upload documents to our Immiboard Client Portal;
• communicate with us by email, WhatsApp, phone, or social media;
• engage VGIS for paid immigration consulting services.

3. Information We Collect

4. How We Use Your Information

• Provide consultations, assess eligibility, and prepare IRCC / provincial submissions.
• Operate the Client Portal and securely exchange documents.
• Respond to enquiries, schedule appointments, and process payments.
• Power free AI tools (CRS, NOC Finder, Letter Generator) — inputs may be sent to third-party AI providers under their own terms.
• Send transactional emails (booking confirmations, document requests, retainer updates).
• Send marketing newsletters and immigration updates (only with your consent — unsubscribe anytime).
• Comply with legal, regulatory, and CICC obligations.
• Detect, prevent, and respond to security incidents and fraud.

5. Legal Basis for Processing

We process your data on one or more of the following bases: (a) your consent; (b) contractual necessity (your retainer); (c) legal obligations (CICC, IRCC, anti-money-laundering); and (d) legitimate interests such as service improvement, security, and lead follow-up where you submit a form.

6. Sharing & Disclosure

We share personal information only as needed and with safeguards in place:

• Government bodies: IRCC, CBSA, provincial PNP authorities — to submit your application.
• Service providers (data processors): Immiboard (CRM & portal), Square (payments), Google Workspace (email & docs), Microsoft Outlook, WordPress hosting, Cloudflare (security), Perplexity AI (AI tools), Mailchimp/Amazon SES (newsletters where applicable). Each is bound by data-processing or confidentiality agreements.
• Professional advisors: lawyers, accountants, auditors — under confidentiality.
• Legal disclosure: when required by law, court order, or to defend our rights.
• Business transfers: if VGIS is acquired, your data may transfer to the successor under equivalent protection.

We do not sell personal information.

7. AI Tools — Important Notice

Our free CRS Calculator, NOC Finder AI, AI Letter Generator, and OINP tools send certain inputs (e.g., job title, education, language scores, letter prompts) to third-party AI providers — currently Perplexity AI — to generate responses. By using these tools you agree:

• Inputs are subject to Perplexity AI’s own privacy policy.
• VGIS does not store your AI tool inputs against your identity unless you also submit a contact form.
• Do not paste full passport numbers, SINs, banking details, or sensitive medical information into AI tool fields.
• AI outputs are estimates and not legal advice.

8. Client Portal — Document Handling

The VGIS Client Portal (Immiboard) is hosted on Canadian/US infrastructure and used exclusively for active retainer clients.

• Encryption: data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access controls: per-client folders, role-based staff permissions, audit logging.
• Authentication: unique credentials; we recommend enabling 2FA where offered.
• Retention: documents retained for the duration of your file plus 7 years (CICC requirement) unless you request earlier deletion where legally permitted.
• Backups: encrypted, geographically redundant, retained on a rolling 90-day cycle.
• Report any suspected breach immediately to case@vg-immigration.com.

9. Cookies & Tracking Technologies

We use cookies and similar tools for (a) essential session functionality, (b) preference storage, (c) analytics (Google Analytics — anonymized IPs), and (d) marketing pixels (Meta, LinkedIn — only with consent). You can manage cookies through your browser settings or our cookie banner. Disabling essential cookies may break booking and portal functionality.

10. Retention

• Active client files: for the duration of your retainer.
• Closed client files: 7 years from closure (CICC requirement).
• Marketing/newsletter data: until you unsubscribe, then 30 days.
• Lead form submissions (no engagement): 24 months, then deleted.
• Server logs & analytics: 13 months.
• AI tool transient inputs: not retained against identity by VGIS.

11. Security Safeguards

We use administrative, physical, and technical safeguards proportionate to the sensitivity of the data: TLS encryption, hardened WordPress with managed firewall, 2FA on staff accounts, least-privilege access, application password rotation, regular backups, and staff confidentiality training. No system is 100% secure — we cannot guarantee absolute security but follow industry best practices.

12. International Data Transfers

Your data may be processed in Canada, the United States, and the EU through our service providers. Where required, we use Standard Contractual Clauses or equivalent safeguards. Canadian data benefits from the Canada–EU adequacy decision.

13. Your Privacy Rights

Subject to applicable law you may:

• Access — request a copy of personal information we hold about you.
• Correct — request correction of inaccurate or outdated data.
• Delete — request deletion (subject to CICC’s 7-year file retention).
• Restrict / Object — to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — for marketing or non-essential processing at any time.
• Lodge a complaint — with the Office of the Privacy Commissioner of Canada, your provincial commissioner, or your EU data protection authority.

Email case@vg-immigration.com with subject line “Privacy Request.” We respond within 30 days.

14. Children’s Privacy

Our services are not directed at children under 13 (or 16 in the EU/UK). We do not knowingly collect children’s data without verifiable parental consent. Where minors are dependents on a family immigration application, parents/guardians provide the data on their behalf.

15. Breach Notification

In the event of a personal-information breach posing real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA’s mandatory breach reporting rules, and any other applicable regulators (e.g., GDPR Article 33/34) without undue delay.

16. Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. Material changes will be posted here with a revised “Last Updated” date and, where required, communicated by email. Continued use after the update constitutes acceptance.

17. Contact & Privacy Officer

Privacy Officer — VG Immigration Services Inc.
Brampton, Ontario, Canada
Email: case@vg-immigration.com
WhatsApp: +1 416-578-9269
Website: vgis.ca
RCIC-IRB: Dimple Verma, #R708308 (CICC)