Privacy Policy
Protection of personal information — PIPEDA, Quebec's Law 25 and equivalent provincial statutes
This document is a first draft prepared in accordance with the principles of PIPEDA, Quebec's Law 25 and CASL. It must be reviewed by a lawyer specializing in privacy law before any publication or production use.
This policy describes how Diarra Global Visa & Immigration Services Inc. collects, uses, discloses and retains the personal information of people who use its practice management platform and of the clients whose files are handled through it. It supplements — and does not replace — the professional secrecy owed by every Regulated Canadian Immigration Consultant who is a member of the College of Immigration and Citizenship Consultants.
1. Person responsible for the protection of personal information
Under Law 25, the person exercising the highest authority within the business is responsible for the protection of personal information. This role is held by Adama Diarra, Regulated Canadian Immigration Consultant (CICC No. R1041776).
Any question, access or rectification request, withdrawal of consent, or complaint may be sent to infos@dgvimmigration.com. A response is provided within thirty days.
2. Information we collect
We collect the following categories of information, depending on the role of the individual concerned.
- Identity and contact information
- Name, email address, telephone number, country of citizenship, country of residence, province, and where applicable the Quebec enterprise number for employer clients.
- Immigration status information
- Target immigration program, file category, opening and deadline dates, reason for consultation, file history and consultation notes. This information is considered sensitive.
- Supporting documents
- Identity documents including passports, language test results, diplomas and educational credential assessments, official forms intended for the authorities, and signed service agreements. These documents contain sensitive information.
- Financial information
- Invoices, professional fees, government disbursements, and trust account movements attached to the file.
- Prospect information
- Contact details, contemplated visa type, estimated value of the mandate, source of the contact and notes of exchanges, for people who have expressed interest without yet being clients.
- Technical logs
- IP address, browser identifier, timestamp and description of operations performed, recorded in an internal audit log.
3. Purposes of collection
Each category of information is collected only for the following purposes, determined before collection.
- Assess a person's eligibility for an immigration program and advise them.
- Prepare, assemble and file applications with the competent authorities.
- Draft and perform professional service agreements.
- Bill professional fees and administer the trust account in accordance with CICC ethical obligations.
- Comply with the record-keeping and traceability obligations imposed on regulated consultants.
- Communicate with the individual about their file.
4. Consent and withdrawal
Consent is requested separately from any other information, in plain language, and for specific purposes. Given the sensitivity of immigration status information, the consent obtained is express consent.
You may withdraw your consent at any time by writing to the person responsible for the protection of personal information. Withdrawal ends the processing that depends on it, subject to information we must retain to satisfy a legal, ethical or retention obligation described in section 7.
Where a mandate concerns a minor, the consent of the person having parental authority is required for those under fourteen years of age.
5. Disclosure to third parties
We do not sell any personal information. Information is disclosed only to the following categories of recipients.
- Government authorities
- Immigration, Refugees and Citizenship Canada, Quebec's Ministère de l'Immigration, de la Francisation et de l'Intégration, Employment and Social Development Canada and other competent authorities, solely for the purposes of the mandate entrusted to us.
- Cloud hosting provider
- The platform relies on a third-party hosting and database provider. The location of the servers and the contractual framework governing that provider are the subject of the assessment described in section 6.
- Artificial intelligence assistants, when enabled
- The platform includes a connector allowing external artificial intelligence assistants to consult and prepare draft service agreements. When this connector is enabled, information including the client's name, the target program and the fee amount is transmitted to the assistant's operator, which may be located outside Quebec. This connector is disabled by default and may only be enabled by the firm's principal. Reserved acts — signing, sending, finalizing and cancelling — are at all times performed by a natural person.
- Professional advisors
- Lawyers, accountants or auditors, where required and under a duty of confidentiality.
6. Where information is hosted
Information is hosted in Canada, in our cloud provider's Canada (Central) region. It is not transferred outside Canada in the ordinary operation of the platform.
Because hosting is located in Canada, the disclosure of personal information outside Quebec within the meaning of section 17 of Law 25 does not apply to hosting itself. It remains relevant to the disclosures described in section 5, in particular when the artificial intelligence connector is enabled.
Any change to the hosting region would be subject to a prior privacy impact assessment and to an update of this policy before taking effect.
7. Retention and destruction
Client files and related documents are retained for the period required by the record-keeping obligations applicable to regulated consultants, then securely destroyed.
Prospect information concerning a person who does not become a client is destroyed once it is no longer necessary for the purposes for which it was collected.
Audit logs are retained in append-only form, with no possibility of modification or deletion, for regulatory traceability purposes.
8. Security measures
Access to information is restricted to members of the firm who need it in the performance of their duties. Each firm's data is logically partitioned and every query is filtered by firm.
Exchanges between the browser and the platform are protected by the standard encrypted transport protocol. Data at rest benefits from the encryption measures offered by the hosting provider.
No security measure is described in this policy without having been confirmed as actually implemented. Additional measures that are planned but not yet deployed are documented in our internal compliance plan and are not presented here as existing.
9. Your rights
You have the following rights, which you may exercise by writing to the person responsible for the protection of personal information.
- Access the personal information we hold about you.
- Have inaccurate, incomplete or ambiguous information corrected.
- Withdraw your consent, subject to our legal retention obligations.
- Obtain your information in a structured, commonly used technological format, or request its transfer to a third party.
- Request that dissemination of information cease or that it be de-indexed, in the cases provided by law.
- Be informed where a decision concerning you is based exclusively on automated processing, and submit your observations.
10. Cookies and similar technologies
The platform uses only the cookies strictly necessary for its operation, in particular to maintain your session and remember your display language. These cookies are used neither for advertising nor for cross-site tracking.
Should analytics or advertising cookies be added, your prior consent would be obtained and this policy updated accordingly.
11. Automated decisions and profiling
The platform assigns an indicative score to people who have expressed interest in our services, to help the firm prioritize follow-ups. This score constitutes profiling within the meaning of Law 25.
No decision producing legal effects or significantly affecting you is made solely on the basis of automated processing. Every eligibility assessment, recommendation and reserved act is made by a regulated consultant, a natural person.
You may request to know the information used to establish this score and submit your observations.
12. Information concerning minors
Some immigration files concern minors as dependants. Information about them is collected from the person having parental authority and processed with the same safeguards as that of adults, together with the additional protections provided by Law 25.
The platform is not intended for direct use by minors.
13. Confidentiality incidents
We maintain a register of confidentiality incidents. Where an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the individuals concerned, and take reasonable measures to reduce the risk of injury and prevent recurrence.
If you have reason to believe an incident has occurred, please notify us immediately at the address given in section 1.
14. Complaints
If our response does not satisfy you, you may complain to the competent authority.
- In Quebec, to the Commission d'accès à l'information du Québec.
- Elsewhere in Canada, to the Office of the Privacy Commissioner of Canada.
- In Alberta and British Columbia, to the Information and Privacy Commissioner of the province concerned.
15. Changes to this policy
We may amend this policy to reflect changes in our practices or in the legal framework. The effective date shown at the head of the document indicates the applicable version.
Any material change is brought to the attention of the individuals concerned before it takes effect.