Privacy Policy

1. Introduction

Immigration Hotspot (“we,” “us,” or “our”) is committed to protecting and respecting the privacy of visitors from the European Union (EU) and European Economic Area (EEA). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Please read this policy carefully. If you have any questions or wish to exercise your data subject rights under the GDPR, you can contact us using the details in Section 12 below.

2. Data Controller

The data controller responsible for your personal data is:

Immigration Hotspot
ABN: 94 164 397 415
Registered Office: Level 17, 31 Queen Street,
The Cluster, Melbourne, VIC 3000, Australia
Email (Data Protection Contact): australia@immigrationhotspot.com.au
Phone: Not available

We do not currently have an EU representative. If you are located in the EU/EEA, you may contact us directly as noted above.

3. What Personal Data We Collect

We collect and process the following categories of personal data when you use ImmigrationHotspot.com.au or otherwise interact with us:

1. Identity Data
   • Full name
   • Date of birth (if provided as part of a consultation request)
2. Contact Data
   • Email address
   • Telephone number
   • Postal address (where applicable)
3. Technical Data
   • IP address
   • Browser type and version
   • Operating system
   • Device identifiers
   • Referral and exit pages
   • Cookies and similar tracking technologies (see Section 10)
4. Profile Data
   • Username and password (for registered users, if applicable)
   • Immigration preferences, history, or eligibility details you voluntarily submit
   • Correspondence and any feedback you send us
5. Usage Data
   • Pages visited, time spent on pages, and other click-stream data (for site analytics)
6. Marketing and Communications Data
   • Your preferences in receiving marketing from us
   • Records of your consents (e.g., newsletter sign-up checkboxes)
7. Automated Profiling
   • Certain profiling is performed within our CRM system to help tailor communications and service offerings (e.g., automated segmentation or eligibility assessments). See Section 6 for more information and your rights.

We do not collect any “special category” (sensitive) personal data—such as health or biometric data—through this website.

4. How We Collect Your Data

• Directly from You: when you fill in forms on our website (e.g., newsletter sign-up, inquiry or contact forms), request a consultation, apply for services, or correspond with us by phone, email, or otherwise.
• Automatically: through cookies, web beacons, and similar technologies when you browse immigrationhotspot.com.au—see our Cookie Policy in Section 10.
• From Third Parties: such as Google Analytics (for aggregated traffic data), Tag Manager, Acuity Online Appointment (for scheduling), or our CRM provider. These third parties all process data under GDPR-compliant terms.

5. Legal Basis for Processing

Under Article 6 of the GDPR, we rely on one or more of the following lawful bases for processing your personal data:

• Consent (Art. 6(1)(a)): where you have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to our newsletter, receiving marketing emails). You may withdraw consent at any time (see Section 9.7).
• Contract Performance (Art. 6(1)(b)): when processing is necessary to perform a contract to which you are a party or to take steps at your request before entering into a contract (e.g., providing immigration consulting services).
• Legal Obligation (Art. 6(1)(c)): to comply with a legal or regulatory obligation (e.g., record-keeping for tax or anti-money laundering, reporting to authorities).
• Legitimate Interests (Art. 6(1)(f)): where we have a genuine and legitimate interest (e.g., improving our website, preventing fraud, sending occasional service-related notifications), provided we do not override your rights and freedoms.

For profiling conducted within our CRM (e.g., to segment clients, tailor communications, or run basic eligibility assessments), we rely on legitimate interests, ensuring it does not override your privacy rights. You may object to profiling at any time (see Section 9.6).

6. Purposes of Processing & Types of Recipients

Third-party service providers:

• Google Analytics & Tag Manager: Used to collect anonymous and pseudonymized usage data (e.g., pages visited, duration) to improve our website.
• Acuity Online Appointment: Used to schedule and manage client consultations.
• CRM System: Used to manage client relationships, communications, billing, and may perform profiling/segmentation for more relevant outreach or service recommendations.

Each third party is contractually bound to process your data only as directed by us and to maintain GDPR-compliant safeguards.

Affiliates or business transfers: In the event of a merger, acquisition, restructuring, sale of assets, or bankruptcy, your data may be shared with or transferred to another organization, provided they agree to handle your data under this Privacy Policy and GDPR requirements.

7. International Data Transfers

Our primary servers and many of our service providers (e.g., CRM host, email platform) are located in Australia, the U.S., or other countries outside the EU/EEA. When we transfer your personal data from the EU/EEA to a country without an EU adequacy decision, we implement appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs): We enter into EU Commission–approved SCCs with each applicable data importer.
• Binding Corporate Rules (BCRs): Where applicable, our affiliates operate under approved BCRs.

Upon request, we can provide details of the specific transfer mechanism in effect (e.g., a copy of the SCCs).

8. Data Retention

We retain personal data only as long as necessary for the purposes outlined above, subject to your rights and any legal obligations:

• Client files (e.g., consultation records): Retained for 7 years from the date of last engagement to comply with professional and regulatory requirements.
• Analytics data (Google Analytics/Tag Manager): Retained indefinitely in anonymized or aggregated form to analyze long-term trends. Any personal identifiers are anonymized or deleted after 12 months.
• Appointment and scheduling data (Acuity): Retained for 7 years (aligned with client files).
• CRM data (including profiling segments): Retained for 7 years or until you request deletion (whichever is sooner), except aggregated reports (which may be retained indefinitely for business intelligence).
• Marketing lists (newsletter subscribers): Retained until you withdraw consent or opt out.
• Transactional/financial records: Kept for 7 years to comply with Australian tax and accounting regulations.

After the applicable retention period expires, we will securely delete or permanently anonymize your data.

9. Your Rights Under GDPR

If you are in the EU/EEA, you have the following rights regarding the personal data we process about you:

1. Right of Access (Article 15): You may request a copy of the personal data we hold about you.
2. Right to Rectification (Article 16): You can ask us to correct inaccurate or incomplete data.
3. Right to Erasure (“Right to Be Forgotten”) (Article 17): You can request deletion of your data when there is no valid reason for us to continue processing (e.g., after retention period or if you withdraw consent).
4. Right to Restrict Processing (Article 18): You can ask us to restrict processing your data when:
   • You contest the accuracy of the data.
   • Processing is unlawful and you oppose erasure.
   • We no longer need the data, but you require it for legal claims.
   • You have objected to processing (see 9.6 below).
5. Right to Data Portability (Article 20): You may request a machine-readable copy of data you have provided to us.
6. Right to Object (Article 21): You can object to:
   • Processing based on legitimate interests (e.g., profiling within our CRM). We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
   • Direct marketing (you can unsubscribe at any time via the link in our emails or by contacting us).
7. Right to Withdraw Consent (Article 7): Where processing relies on consent (e.g., marketing emails), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
8. Right to Lodge a Complaint (Article 77): If you believe we have infringed your rights, you may lodge a complaint with a supervisory authority in the EU/EEA member state of your residence, place of work, or where an alleged infringement occurred.

To exercise any of these rights, please contact us (see Section 12). We aim to respond within one month of receiving your request. If your request is complex, we may extend by two further months and will notify you within one month of receipt, explaining the reason for the extension.

10. Cookies and Tracking Technologies

We use cookies and similar tracking tools to enhance your browsing experience, analyze site traffic, and support our marketing efforts. Below is a summary; for more details, consult our Cookie Policy at https://immigrationhotspot.com.au/cookie-policy.

• Essential Cookies: Required for core site functionality (e.g., session cookies to keep you logged in).
• Performance/Analytics Cookies: Collect anonymous information about visits and traffic sources (e.g., Google Analytics). We configure Google Analytics to mask IP addresses and to anonymize data after 12 months.
• Functional Cookies: Remember your preferences (e.g., chosen language, region).
• Marketing/Advertising Cookies: Track visitors across websites to display relevant ads (e.g., Google Ads tags).

You can manage cookie settings through your browser or via our cookie-banner preferences. Opting out of certain cookies may impact site functionality.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including but not limited to:

• Encryption: Data in transit is protected by SSL/TLS. Where feasible, data at rest is encrypted.
• Access Controls: Role-based access, strong password policies, and two-factor authentication for administrative accounts.
• Regular Testing: Periodic vulnerability scans and penetration testing of our infrastructure.
• Staff Training: Ongoing security awareness training for all employees.
• Incident Response: Established procedures to detect, respond to, and mitigate any suspected data breach.

In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will notify the affected individuals and the relevant Supervisory Authority within 72 hours, as required by GDPR.

12. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your GDPR rights, or want to lodge a complaint, please contact:

Data Protection Officer (Privacy Lead): Neetu Sharma
Email: australia@immigrationhotspot.com.au
Mailing Address: Immigration Hotspot, Level 17, 31 Queen Street,
The Cluster, Melbourne, VIC 3000, Australia

If you are in the EU/EEA, you may also contact your local data protection supervisory authority. A list of European Data Protection Authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time (e.g., to reflect changes in GDPR guidance, business processes, or data-processing practices). The “Last updated” date below will indicate when the policy was most recently revised. Significant changes will be communicated by posting the updated policy on our website and, where appropriate, by notifying you (e.g., via email or a prominent notice).

Last updated: June 4, 2025

14. Additional Notes

• If you are under 16 (or the minimum age in your EU Member State), you must have parental or guardian consent to use our services.
• We do not knowingly collect personal data from minors without appropriate consent.
• Links from our site to third-party websites have separate privacy policies; we are not responsible for their content or practices.