CCPA & GDPR Compliance

Lawful Basis for Processing

We process personal data based on the following lawful bases:

• Contract: Processing necessary to provide immigration case management services
• Consent: Document verification via AI, marketing communications
• Legitimate Interest: Platform security, fraud prevention, service improvement
• Legal Obligation: Compliance with immigration regulations and record-keeping requirements

Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing

Data Transfers

When transferring personal data outside the EU/EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Supplementary technical and organizational measures
• Data Processing Agreements with all service providers

Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring GDPR compliance.

Categories of Personal Information We Collect

• Identifiers: Name, email address, phone number, account ID
• Professional Information: Company name, role, immigration license details
• Internet Activity: Usage data, browser type, device information
• Sensitive Personal Information: Immigration documents, identity verification data (with explicit consent)

Your Rights Under CCPA

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: We do not sell personal information. If this changes, you will have the right to opt-out
• Right to Limit Use: Limit the use of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Data Sharing

We may share personal information with:

• Service Providers: Supabase (hosting), Google (AI processing) under data processing agreements
• Legal Requirements: When required by law or to protect our rights
• With Your Consent: When you explicitly authorize sharing

We do not sell personal information to third parties.

How to Exercise Your Rights

California residents can submit requests by:

• Email: privacy@immiwave.com
• Using the data export feature in your account settings
• Contacting our support team

We will verify your identity before processing requests and respond within 45 days as required by law.