Privacy Notice

This Notice applies to the Canada Immigration CRM platform supplied by HQL Solutions, Pune, Maharashtra, India ("HQL", "we", "us" or "our").

For client files, case records, documents and professional-service information entered by a subscribing organization, that organization ordinarily determines the purpose and means of processing and may be the controller, data fiduciary or equivalent responsible organization under applicable law. HQL processes that information to provide and support the platform and generally acts as a processor/service provider in that context.

For HQL’s own account administration, software licensing, security telemetry, support requests, billing relationship and business contacts, HQL may act as an independent controller/data fiduciary to the extent applicable.

Depending on the customer’s use of the platform, information may include:

• Account and identity data: name, email, phone, role, organization, authentication identifiers and account status.
• Immigration and case data: nationality, date of birth, passport and travel information, immigration history, family and household details, education, employment, language testing, qualifications, government identifiers and application information.
• Documents and potentially sensitive information: passports, civil-status records, financial documents, medical or health-related records, police/criminal-history material, photographs, biometric-related workflow information and other documents uploaded for a case where lawfully required.
• Professional communications: messages, case notes, tasks, appointments, document-review comments and communications between authorized users.
• Billing information: invoice records, payment status, amounts, references and transaction-related records. The CRM should not be used to store full payment-card credentials unless a specifically approved payment service is integrated for that purpose.
• Technical and security data: login events, audit logs, device/browser information, IP/network information, access history, errors and security events.
• Support and commercial data: support requests, implementation information, authorized customer contacts, subscription records and correspondence with HQL.

Information may be used to:

• create and administer authorized accounts and role-based access;
• host, organize, retrieve and process Customer Data on the subscribing organization’s instructions;
• support case workflows, document handling, billing, appointments, tasks, notifications and communications;
• provide technical support, troubleshoot errors, maintain continuity and improve reliability;
• detect, investigate and prevent unauthorized access, abuse, fraud and security incidents;
• maintain audit records and meet legal, regulatory, accounting or contractual obligations;
• administer HQL software subscriptions, licences, customer relationships and service communications.

HQL does not use immigration-client files for unrelated advertising, data brokerage or sale of personal information.

The subscribing organization is responsible for identifying an appropriate lawful basis, giving required notices, obtaining required consent or authorization, and ensuring its instructions to HQL are lawful. HQL will process Customer Data only for the contracted service, documented instructions, security and support, or where processing is required by law.

Where consent is the required legal basis, the subscribing organization is responsible for obtaining and documenting meaningful consent unless HQL expressly agrees in writing to perform that function.

Personal information may be disclosed only as reasonably necessary to:

• authorized users of the subscribing organization according to configured roles and permissions;
• authorized lawyers, consultants or professionals connected to the relevant case where the customer has granted access;
• HQL personnel and contractors who require access for support, security, maintenance or administration and are subject to confidentiality obligations;
• hosting, database, authentication, email, communications, monitoring and other subprocessors used to operate the service;
• government, court, regulator, law-enforcement or other parties where disclosure is lawfully required;
• a successor or transaction counterparty in a legitimate corporate restructuring, merger, financing or sale, subject to appropriate confidentiality and data-protection safeguards.

The platform may involve users, customers and service providers in different countries. Personal information may therefore be stored, accessed or processed outside the country where an individual resides.

The subscribing organization remains responsible for transfer notifications, approvals, consents, contractual clauses or other mechanisms required for its international transfer of Customer Data. HQL will reasonably support the customer with contractual data-protection terms and information about relevant subprocessors where required.

For Moroccan personal data, the subscribing organization should assess and complete any declaration, authorization and foreign-transfer formalities required by Morocco’s data-protection framework and the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). For Canadian personal information, the responsible Canadian organization should address accountability for information transferred to processors outside Canada through appropriate contracts, transparency and oversight.

Users should enter only information reasonably necessary for the relevant immigration, legal, administrative or billing purpose and should avoid uploading unrelated sensitive information. The subscribing organization is responsible for maintaining the accuracy and relevance of Customer Data.

Customer Data is retained according to the subscribing organization’s instructions, applicable professional/recordkeeping requirements, the active service relationship, and legal obligations. HQL does not promise a universal deletion period because immigration, legal and accounting retention obligations can differ by customer and jurisdiction.

When a customer relationship ends, export, return, retention and deletion will follow the applicable signed agreement and documented instructions. Limited residual copies may remain in technically necessary backups, audit records, security records or legally required archives for a reasonable period and will remain protected while retained.

HQL will maintain reasonable administrative, technical and organizational safeguards appropriate to the sensitivity and risks of the information processed. Measures may include role-based access controls, authentication, audit logging, secure development practices, access restriction, backups, monitoring and incident-response processes as appropriate to the service.

No system can be guaranteed completely secure. Users must protect credentials, use authorized devices and networks, follow organization security policies and promptly report suspected compromise.

HQL will investigate confirmed or reasonably suspected security incidents affecting Customer Data and will notify the affected subscribing organization without undue delay where notification is appropriate or contractually/legal required. The customer remains responsible for determining and making notifications to individuals, regulators or authorities where it is legally responsible to do so, unless a signed agreement allocates that responsibility differently.

Depending on applicable law, individuals may have rights to request access, correction, information about processing, withdrawal of consent where consent is the legal basis, deletion/erasure in appropriate circumstances, grievance handling or other rights.

If your request concerns an immigration file or data entered by an agency, law firm or other subscribing organization, contact that organization first. HQL will reasonably assist the subscribing organization with valid requests where required by the applicable customer agreement or law.

Requests concerning HQL’s own account, licensing, security-support or commercial-contact data should be directed to the authorized HQL Solutions contact identified in the applicable order form, proposal or customer agreement.

The platform is not designed as a consumer service for children. Immigration files may nevertheless lawfully contain information about dependent children and family members. Such information should be entered only by an authorized adult, representative or professional and only where necessary for the legitimate case purpose and permitted by applicable law.

Administrative calculations, workflow rules, reminders, templates and other software functions are tools for authorized users. HQL does not make immigration, legal or professional decisions about individuals through the platform. Responsible professionals and subscribing organizations remain accountable for substantive advice and decisions.

Because customers may operate in different jurisdictions, the subscribing organization is responsible for determining which privacy, professional and recordkeeping laws apply to its activities. This may include India’s Digital Personal Data Protection framework, Canadian federal or provincial privacy requirements, Morocco’s Law 09-08 and CNDP procedures, or other applicable laws.

Where HQL is directly subject to a legal obligation for its own processing, HQL will comply with that obligation. Nothing in this Notice is intended to shift a statutory duty that cannot lawfully be transferred by contract.

HQL may update this Notice to reflect legal developments, new subprocessors, security practices or changes to the platform. Material changes will be communicated by a reasonable method such as the platform, login page, email or customer notice.

For immigration-client data, contact the organization that created your account. That organization can escalate a platform-related privacy matter to HQL Solutions through its authorized business or support contact. HQL will cooperate in good faith with lawful complaints, regulatory inquiries and customer privacy-management obligations applicable to the service.