How we handle your personal information
immi.tv ("we", "us", "our") is an immigration advisory service covering Australia and Canada. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website at immi.tv, our calculators, our email communications, and our advisory services.
We are committed to complying with:
- The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) — Australia
- The Spam Act 2003 (Cth) — Australia
- The Canadian Anti-Spam Legislation (CASL) — Canada
- The Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada
- Québec's Law 25 (Act respecting the protection of personal information in the private sector) — Québec, Canada
- The General Data Protection Regulation (GDPR) (EU) 2016/679 — European Union
- The UK GDPR and the Data Protection Act 2018 — United Kingdom
If you are located in a jurisdiction not listed above, we apply the highest standard described in this policy to your personal information regardless.
Who We Are
For the purposes of GDPR, we act as a data controller for personal information collected through the website. For the purposes of PIPEDA and Law 25, we are the organisation responsible for personal information under our custody or control.
What Personal Information We Collect
2.1 Information you provide directly
| Category | Examples | Where collected |
|---|---|---|
| Identity | First name, last name | Calculator forms, contact forms, enquiry forms |
| Contact | Email address, phone number | Calculator forms, contact forms, newsletter sign-up |
| Professional profile | Occupation, years of experience, education level | Calculator inputs |
| Immigration profile | Jurisdiction of interest, migration timeline, visa category interest | Calculator inputs, enquiry forms |
| Calculator results | Points score (AU), CRS score (CA), visa pathway assessment | Generated from your inputs |
| Communication content | Message text in enquiry or contact forms | Contact/enquiry forms |
| Consent records | Whether you opted in to marketing communications, timestamp of consent | All forms with marketing opt-in |
2.2 Information collected automatically
| Category | Details |
|---|---|
| Usage data | Pages visited, time on page, links clicked |
| Device information | Browser type, operating system, screen resolution |
| Location (country-level only) | Country of origin, inferred from IP address via Cloudflare CDN (see Section 8 — Third Parties) |
| IP address (hashed) | Used for rate limiting and security purposes. Not stored in identifiable form. |
| Cookies and similar technologies | See Section 7 |
2.3 What we do NOT collect
- We do not collect passport numbers, visa application numbers, or immigration file references through the website
- We do not collect sensitive personal information (racial or ethnic origin, health information, political opinions, religious beliefs, criminal record) through automated means
- We do not collect payment information on this website (advisory fees are processed separately)
- We do not knowingly collect information from persons under 18 years of age
Why We Collect Your Information
We collect and use your personal information only for specific, legitimate purposes. Each purpose has its own legal basis, detailed below.
3.1 Delivering requested services
To deliver the lead magnet, score report, checklist, or guide you requested when completing a calculator or quiz.
- Australia (Privacy Act): Directly related to the primary purpose for which the information was collected
- GDPR/UK GDPR: Performance of a contract (or steps prior to entering a contract) — Article 6(1)(b)
- CASL: Transactional message — exempt from consent requirement as it delivers the specifically requested content
- PIPEDA: Consent implied by the voluntary act of submitting the form to receive the content
This is a transactional communication. You will receive it whether or not you opt in to our marketing list.
3.2 Marketing communications
To send you immigration news updates, visa round notifications, policy change alerts, expert tips, and service promotions.
- Australia (Spam Act 2003): Express consent — you explicitly checked the opt-in box
- GDPR/UK GDPR: Consent — Article 6(1)(a); you may withdraw at any time
- CASL: Express consent — you explicitly checked the opt-in box (pre-ticked boxes do not constitute valid consent under CASL)
- PIPEDA: Express consent
3.3 Improving our services
To understand how visitors use our calculators, identify technical errors, and improve the user experience.
- GDPR/UK GDPR: Legitimate interests — Article 6(1)(f); we have a legitimate interest in understanding service usage. This does not override your privacy rights.
- Australia: Legitimate business purpose consistent with primary collection purpose
- PIPEDA: Legitimate purpose
Analytics data is aggregated and does not identify individuals.
3.4 Security and fraud prevention
To detect, prevent, and investigate fraudulent submissions, bot activity, and abuse of our contact forms.
- GDPR/UK GDPR: Legitimate interests — Article 6(1)(f)
- All jurisdictions: Legitimate business purpose; necessary for the security of our services
3.5 Legal compliance
To comply with applicable laws, regulatory obligations, and professional registration requirements (MARA — Australia; RCIC — Canada).
- GDPR/UK GDPR: Legal obligation — Article 6(1)(c)
- All jurisdictions: Compliance with applicable law
How We Use Calculator Data
When you use our Points Test Calculator, CRS Score Calculator, Pathway Comparison, or Visa Finder:
- Your inputs and score are used solely to generate your result and the personalised report you requested
- Your score is stored alongside your contact information to allow us to provide relevant advisory (e.g., an adviser knowing your CRS score before a consultation)
- Scores are indicative estimates only and are not assessed, verified, or guaranteed by us or any government authority
- Calculator inputs (e.g., age, education level, work experience) are stored as part of your lead record but are not shared with third parties for their own purposes
- We do not use your immigration profile data for automated decision-making that produces legal or similarly significant effects on you — all advisory recommendations involve human review
Data Sharing and Disclosure
5.1 Service providers (data processors)
We share your personal information with the following categories of service providers who process it only on our instructions:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Zoho Corporation | CRM (lead storage), email delivery (Campaigns) | USA, India | EU Standard Contractual Clauses; GDPR DPA available |
| Cloudflare Inc. | CDN, security, country-level geo-detection | USA (global CDN) | EU Standard Contractual Clauses; GDPR DPA |
| Hostinger International | Website hosting | Lithuania (EU) | EU data centre; GDPR compliant |
| Google LLC | Analytics (GA4), Tag Manager | USA | EU Standard Contractual Clauses; DPA signed |
5.2 Professional referrals
With your explicit consent only, we may refer your details to a specialist legal practitioner or registered migration agent in another jurisdiction. We will always ask before making any referral.
5.3 When required by law
We may disclose personal information if required to do so by law, court order, or a regulatory authority with jurisdiction over our business (including OMARA in Australia and ICCRC/CICC in Canada).
5.4 Business transfers
If we sell or transfer all or part of our business, personal information held by us may be transferred to the new owner. We will notify you before your information is transferred and becomes subject to a different privacy policy.
5.5 What we do NOT do
- We do not sell your personal information to third parties
- We do not share your personal information with other immigration agencies, law firms, or competitors
- We do not use your data for third-party advertising targeting (we do not run Facebook Lead Ads or similar)
Data Retention
| Data category | Retention period | Reason |
|---|---|---|
| Lead records (contact + score) | 3 years from last contact | Business records; allows us to track pathway progress |
| Marketing consent records | 5 years from consent or withdrawal | CASL requires consent records to be retained; GDPR accountability |
| Email communication logs | 2 years | Security and dispute resolution |
| Analytics data (GA4) | 14 months (GA4 default) | Traffic analysis |
| Security/rate limit logs | 90 days | Security review |
| Enquiry/consultation records | 7 years from last activity | Professional regulatory requirements (MARA/RCIC) |
When data is no longer needed, it is deleted from our systems and we request deletion from our service providers. You may request early deletion at any time (see Section 9).
Cookies
7.1 What are cookies?
Cookies are small text files stored on your device by your browser when you visit a website. We use cookies to make immi.tv work properly and to understand how you use it.
7.2 Our cookies
| Cookie name | Type | Purpose | Duration |
|---|---|---|---|
immitv_pref |
Functional | Stores your jurisdiction preference (AU/CA/Both). Contains no personal data — only a two-letter code. | 30 days |
_ga, _ga_* |
Analytics | Google Analytics — measures site usage. IP is anonymised before collection. | 2 years |
_gtm_* |
Analytics | Google Tag Manager — coordinates analytics tags | Session |
| LiteSpeed cache cookies | Functional | Website performance cache control | Session |
7.3 Cookies we do NOT use
- We do not use advertising or tracking cookies
- We do not use third-party social media tracking pixels
- We do not use cross-site tracking cookies
7.4 Managing cookies
You can control cookies through your browser settings. Disabling functional cookies (immitv_pref) will not stop the site from working — you will simply see the default content without geo-based personalisation.
For analytics cookies, you may opt out via:
- Google Analytics Opt-Out Browser Add-on
- Your browser's privacy settings
7.5 Cookie consent
Under the GDPR and UK GDPR, we require consent before setting analytics cookies. A cookie consent notice will be displayed to visitors from the EU and UK. Functional cookies (site operation) do not require consent as they are strictly necessary.
Australian and Canadian law does not currently mandate cookie banners for the types of cookies we use, but we display the consent notice globally for consistency.
International Data Transfers
immi.tv operates across Australia and Canada and uses cloud service providers based in the United States and the EU. Your personal information may be transferred to and processed in countries outside your country of residence.
Safeguards for international transfers
All transfers to countries not deemed adequate by the European Commission (including the USA) are protected by:
- EU Standard Contractual Clauses (SCCs) with each service provider
- Data Processing Agreements (DPAs) signed with Zoho, Cloudflare, and Google
When transferring personal information overseas, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles. Our service providers are contractually bound to equivalent privacy standards.
Personal information transferred to service providers in other countries remains subject to our privacy obligations. We advise you that your information may be subject to access by foreign governments or courts in the destination country.
Your Privacy Rights
9.1 Rights available to all users
- Access You have the right to request a copy of the personal information we hold about you.
- Correction If your information is inaccurate or incomplete, you have the right to request correction.
- Deletion You have the right to request deletion of your personal information. We will comply unless we have a legal obligation to retain it (e.g., professional regulatory records).
- Withdraw consent If you consented to marketing communications, you may withdraw consent at any time by clicking "Unsubscribe" in any email we send, or emailing [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.
9.2 Additional rights for EU/UK users (GDPR/UK GDPR)
- Right to restriction You may request that we restrict processing of your data in certain circumstances (e.g., while a correction request is pending).
- Right to portability You may request your personal data in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another service.
- Right to object You may object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
- Right not to be subject to automated decisions We do not use automated decision-making that produces legal or similarly significant effects. Our calculator results are indicative only and all advisory involves human judgement.
- Right to lodge a complaint EU users: your national data protection authority. UK users: Information Commissioner's Office (ICO). Australian users: Office of the Australian Information Commissioner (OAIC).
9.3 Additional rights for Canadian users (PIPEDA/Law 25)
- Right to access and portability Under PIPEDA and Law 25, you have the right to access your personal information and to receive it in a structured format.
- Right to withdraw consent (CASL) You may withdraw consent to commercial electronic messages at any time. We will process opt-outs within 10 business days (CASL maximum).
- Right to lodge a complaint Office of the Privacy Commissioner of Canada.
- Québec residents (Law 25) You also have the right to have your personal information de-indexed from any technology that makes it publicly available, where applicable. You may also have the right to data portability in the format prescribed by the Commission d'accès à l'information (CAI).
9.4 How to exercise your rights
We may need to verify your identity before processing your request.
Security
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
- Encryption in transit All data submitted through immi.tv is encrypted using TLS (HTTPS)
- Encryption at rest Personal data stored in Zoho CRM is encrypted at rest by Zoho
- Access controls Personal information is accessible only to authorised team members on a need-to-know basis
- No raw IP storage We do not store raw IP addresses in identifiable form
- Rate limiting Our form endpoints are rate-limited to prevent automated abuse
- CSRF protection Form submissions include cross-site request forgery (CSRF) protection tokens
Despite these measures, no internet transmission is 100% secure. If you believe your privacy has been compromised, please contact us immediately at [email protected].
Data breach notification
In the event of a data breach that is likely to result in serious harm to individuals, we will:
- Notify the OAIC within 30 days (Australian Privacy Act — Notifiable Data Breaches scheme)
- Notify affected individuals as required
- Notify EU/UK supervisory authorities within 72 hours where the breach involves EU/UK personal data (GDPR/UK GDPR requirement)
- Notify the Privacy Commissioner of Canada if the breach creates a real risk of significant harm (PIPEDA requirement)
Children's Privacy
Our services are directed at adults who are considering migration. We do not knowingly collect personal information from persons under 18 years of age. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.
Links to Other Websites
Our website may contain links to third-party websites (e.g., government immigration portals, Australian Department of Home Affairs, IRCC Canada). This Privacy Policy applies only to immi.tv. We are not responsible for the privacy practices of any third-party website. We encourage you to review the privacy policies of any site you visit.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last reviewed" date at the top of this policy
- Post a notice on the immi.tv homepage for 30 days after significant changes
- Send an email notification to existing subscribers if the changes materially affect how we use their data
Your continued use of immi.tv after any changes constitutes your acceptance of the updated policy. If you do not agree, you may request deletion of your data (see Section 9).
Contact Us
Jurisdiction-Specific Annexes
Annex A — Australia
immi.tv is an Australian business subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
APP 1 — Open and transparent management: This policy satisfies our APP 1 obligation to have a clearly expressed privacy policy.
APP 5 — Notification of collection: We notify individuals of collection at the point of collection (at the form submission point) by linking to this policy.
APP 7 — Direct marketing: We will not use your personal information for direct marketing unless you have consented (opt-in checkbox) or it is otherwise permitted by APP 7. You may opt out at any time.
APP 8 — Cross-border disclosure: We disclose to overseas service providers (Zoho, Cloudflare, Google). We take reasonable steps to ensure they protect your information to APP-equivalent standards.
Spam Act 2003: We send commercial electronic messages only with your express or inferred consent, always include our identity and contact details, and always include a functional unsubscribe mechanism.
Complaints: If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
Annex B — Canada
PIPEDA (federal): We collect, use, and disclose personal information in accordance with PIPEDA's 10 fair information principles. Our purposes for collection are identified in Section 3 of this policy.
CASL: We send commercial electronic messages only with express consent obtained through an unchecked opt-in checkbox. Consent records are retained for 5 years. Every marketing email contains: sender identification, our mailing address, and an unsubscribe mechanism that processes within 10 business days.
Québec Law 25 (Act 64): For residents of Québec, we comply with enhanced requirements including:
- Appointment of a person responsible for the protection of personal information (our Privacy Officer, named in Section 14)
- Privacy Impact Assessments for high-risk personal information processing (completed as required)
- Right to data portability in technological format
- Disclosure of use of automated processing (we use calculators to compute scores; no automated legal decisions are made)
Complaints (Canada):
- Office of the Privacy Commissioner of Canada: priv.gc.ca
- Commission d'accès à l'information (Québec): cai.quebec.ca
Annex C — European Union and United Kingdom
Legal basis summary:
| Processing activity | Legal basis (GDPR Article 6) |
|---|---|
| Delivering requested lead magnet | Article 6(1)(b) — Contract performance |
| Marketing communications | Article 6(1)(a) — Consent |
| Analytics and service improvement | Article 6(1)(f) — Legitimate interests |
| Security and fraud prevention | Article 6(1)(f) — Legitimate interests |
| Legal compliance | Article 6(1)(c) — Legal obligation |
UK GDPR: Following the UK's departure from the EU, the UK GDPR (retained in UK law by the European Union (Withdrawal) Act 2018) applies to processing of UK personal data. The rights described in Section 9.2 apply equally to UK users. UK users may lodge complaints with the ICO (ico.org.uk).
Representative (EU): If we receive significant EU traffic, we may need to appoint an EU representative under GDPR Article 27 — to be reviewed at 6-month mark post-launch.
Annex D — Other Jurisdictions
Users from other jurisdictions are subject to this policy in full. We apply the highest standard described across all annexes to users from any jurisdiction. If your local law provides rights not described here, please contact [email protected] and we will work to accommodate your request in good faith.
This Privacy Policy was prepared for immi.tv based on Australian, Canadian, EU, and UK privacy law as of March 2026. It should be reviewed by a qualified privacy lawyer before final publication, particularly the Zoho data processing agreements and the GDPR representative requirement.