How we handle your personal data

Brighture Immigration Specialists Ltd is a private limited company registered in England & Wales (company number 10822463). We trade as Brighture Immigration. In this policy, "we", "us" and "our" mean Brighture Immigration Specialists Ltd.

We are the controller of the personal data described in this policy. That means we decide how and why it is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information Commissioner's Office (ICO) registration number:

This policy applies to personal data handled by our London and New York offices for clients around the world. It explains what we collect, why, who we share it with, how long we keep it, and your rights. It covers you when you:

• visit this website or our social media pages;
• send us an enquiry or book a consultation;
• use our immigration guidance and application support services;
• receive updates or marketing emails from us; or
• apply to work with us.

It does not cover other websites we link to, or the independent advisers, lawyers and government authorities described in section 7, who have their own privacy notices.

We only use personal data where the UK GDPR gives us a lawful basis. The bases we rely on are:

A. Contract. To answer your enquiry, prepare a proposal, and deliver the services you engage us for: eligibility review, route planning, document checklists, preparing and checking forms and documents, booking appointments, submitting applications where you ask us to, tracking progress and preparing you for interviews. Basis: performance of a contract with you, or steps you ask us to take before entering one.

B. Legal obligation. To keep accounting and tax records, carry out identity and anti-money-laundering checks where they apply, and respond to lawful requests from authorities. Basis: compliance with a legal obligation.

C. Legitimate interests. To run and improve our business, keep records of our work, prevent fraud and misuse, keep our systems secure, and deal with complaints or legal claims. Basis: our legitimate interests, where these are not overridden by your interests and rights.

D. Consent. To send you marketing emails, and for any other use where we ask for your consent. Basis: your consent. You can withdraw it at any time by emailing us or using the unsubscribe link.

E. Vital interests. In rare emergencies, to protect someone's life or safety. Basis: vital interests.

If you do not give us information we need for your application, we may not be able to help you, or the authority may refuse your application.

• from you, or someone you authorise to act for you;
• from your employer or future employer, university or college, or sponsor;
• from government authorities and visa application centres, when they contact us about your application;
• from independent regulated advisers or lawyers working on your matter;
• from service providers we use, such as translation, scheduling, e-signature and payment providers.

We share personal data only where we need to, and only what is needed:

• Government authorities and visa application centres, when you ask us to prepare or submit an application, book an appointment or respond to a request. Examples are UK Visas and Immigration (Home Office), US Citizenship and Immigration Services, the US Department of State, Immigration, Refugees and Citizenship Canada, and the relevant authorities for Australia, the EU and the UAE. Once an authority receives your data, it uses it under its own rules and privacy notice.
• Independent regulated advisers or lawyers, where your matter needs regulated advice or representation. They act for you under their own terms and are responsible for the personal data they hold.
• your employer, sponsor, university or college, where your application involves them and you ask us to;
• translators, document legalisation providers and couriers;
• medical panels and police certificate authorities, at your request;
• service providers who process data for us under contract, such as website hosting, email, secure file storage, client management, scheduling, e-signature and accounting providers;
• payment providers, when you pay an invoice;
• our professional advisers, auditors and insurers;
• law enforcement or regulators, where the law requires us to;
• a buyer or successor if our business is sold or reorganised, under confidentiality safeguards.

We keep personal data only for as long as we need it for the purposes in this policy, including any legal, tax or accounting requirements. In general:

• Client files: for as long as your matter is active, then for as long as we may need them to answer questions about your application or deal with a complaint or legal claim. In England and Wales, most contract claims can be brought for up to six years.
• Financial and accounting records: for as long as UK tax and company law require.
• Enquiries that do not lead to an engagement: only as long as needed to deal with your enquiry and any follow-up.
• Marketing: until you unsubscribe. After that we keep a short record so we don't contact you again.
• Job applications: for a limited period after the recruitment process ends, unless you agree to us keeping them longer.

When we no longer need your data, we delete it securely or make it anonymous. If you ask us to delete your data, we will do so unless the law requires us to keep it. If we must keep some records, we will tell you why.

Under the UK GDPR, you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased, in some circumstances;
• restrict how we use your data, in some circumstances;
• data portability: receive data you gave us in a machine-readable format, or have it sent to another organisation;
• object to our use of your data based on legitimate interests, and to direct marketing at any time;
• not be subject to decisions based only on automated processing that have legal or similarly significant effects;
• withdraw your consent at any time, where we rely on it.

Some rights have exceptions. For example, we may need to keep data to meet a legal obligation or to deal with a legal claim. If an exception applies, we will explain it.

Some US states, including California (under the California Consumer Privacy Act, as amended by the California Privacy Rights Act), give residents privacy rights. Where these laws apply to us, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• have your personal information corrected or deleted;
• opt out of the sale or sharing of your personal information, and of its use for targeted advertising. We do not sell or share personal information in these ways;
• limit our use of sensitive personal information. We only use it to provide the services you ask for;
• not be treated differently because you used these rights.

The categories of personal information we collect, where we get it, why we use it and who we share it with are set out in sections 2 to 7. To make a request, email info@brightureimmigration.com. You can also use an authorised agent. We will need to verify your identity, or the agent's authority, before we respond.

This website is not aimed at children. For family applications, we handle children's personal data only as needed for the application, and we receive it from their parents or legal guardians.

• Brighture Immigration Specialists Ltd is the controller of your data, under UK data protection law.
• We collect what we need to support your immigration application and to meet our legal duties.
• We handle sensitive data, such as health and criminal records information, only where your application needs it.
• We never sell your personal data.
• We share data with government authorities, independent advisers or lawyers, and trusted providers only as needed, with safeguards for international transfers.
• You can use your rights at any time by emailing us, and you can complain to the ICO.