Home › Practice › Privacy Policy

Privacy Policy

Immigration files are personal. We treat them that way. This policy explains what we collect, why we collect it, where it's stored, and the rights you have over your own information.

§ 01Who is responsible

Turas Immigration — operated by Vanessa Constantino de Almeida, RCIC — is the data controller for the personal information collected through this site and our consulting practice. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the confidentiality obligations imposed on RCICs by the College of Immigration and Citizenship Consultants (CICC).

Privacy questions, access requests, and complaints: vanessa@turasimmigration.ca.

§ 02What we collect

Information you give us

  • Identity & contact: name, email, country of residence, phone, preferred language.
  • Immigration history: nationality, status, prior applications and refusals, IRCC file numbers, biographical and family information you choose to share in the contact form, the discovery call, or your retainer.
  • Documents you upload or send by email for a Consultation, Application Review, or full retainer (passports, education and language test results, employment letters, police certificates, medical reports, etc.).
  • Payment data: when you book a paid service, our payment processor collects and stores your card details on PCI-compliant infrastructure. We never see or store your full card number.

Information we collect automatically

  • Server logs: IP address, user agent, requested URL, timestamps. Used to keep the site secure and diagnose problems.
  • Functional cookies: a "soft launch" gate cookie during pre-launch and a session cookie when you book. We do not use third-party advertising cookies or cross-site trackers.

§ 03Why we use it

  • To respond to inquiries and provide the discovery call, Consultation, Application Review, or full representation you've asked for.
  • To prepare submissions to IRCC and other authorities on your behalf, only with your express consent (typically via a signed IMM 5476 Use of a Representative form).
  • To take and confirm payments, issue receipts, and meet our bookkeeping and tax obligations.
  • To meet our regulatory record-keeping duties to the CICC.
  • To send you appointment confirmations, file updates, and operational emails. We do not send marketing emails.
  • To keep the website and your data secure, prevent abuse, and improve service quality.

§ 04Legal basis

We collect and use information based on:

  • Your consent (you decide to send us a form, book a service, or sign a retainer);
  • The need to perform the contract we have with you;
  • Our legitimate interests in operating a secure, well-run practice; and
  • Our legal and regulatory obligations as an RCIC.

§ 05Who we share with

We disclose information only as necessary to deliver our services. We do not sell, rent, or trade personal information.

  • IRCC and other government bodies when filing on your behalf, with your written authorization.
  • Service providers we rely on to run the practice — email delivery (AWS SES), calendar scheduling (Google Calendar), our website host, and our payment processor. These providers act under contractual obligations to keep your data confidential and use it only for the purposes we permit.
  • Translators, interpreters or co-counsel, only with your prior consent.
  • The CICC, when required for a regulatory audit or complaint, or otherwise required by law.
  • Courts and law-enforcement agencies where compelled by valid legal process.

§ 06International data transfers

Some of our service providers process data in the United States or other countries. Where information is transferred outside Canada, we use providers that offer comparable protection through contractual safeguards. By using the site or engaging us, you consent to this processing.

§ 07How long we keep it

The CICC requires us to retain client files for at least 10 years from the date the file is closed. After that period, we securely destroy paper records and permanently delete digital ones, except where a longer retention is required by law (e.g. tax records).

Inquiries that don't progress to a paid engagement are kept for up to 24 months, then deleted. Server logs are kept for up to 90 days unless flagged for security investigation.

§ 08How we protect it

  • HTTPS (TLS) for all traffic to and from the site.
  • Encrypted storage on our servers; the database file sits outside the public web root.
  • Access to client files is limited to Vanessa and any authorized assistant under a confidentiality undertaking.
  • Daily off-server backups of the database, retained on a rolling 14-day window.
  • Multi-factor authentication on every administrative account.
  • Prompt application of security updates.
If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and we will tell you what steps to take.

§ 09Your rights

You have the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or incomplete information;
  • Withdraw your consent to further use, subject to our retention obligations and the impact on any active engagement;
  • Receive a copy of your file at file closing;
  • Complain to us, the CICC, or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

To exercise any of these rights, email vanessa@turasimmigration.ca. We respond within 30 days.

§ 10Cookies & analytics

We use the smallest possible set of cookies, grouped into two categories:

Strictly necessary cookies

  • Session cookie — set when you book a service; used to maintain your booking session across the payment redirect. Expires at the end of your browser session.
  • Consent record (cc_cookie) — stores your cookie preference (accepted or declined analytics). Expires after 182 days. This cookie is required to remember your choice so we don't ask again on every visit.
  • Pre-launch gate cookie — set only during the staging phase; records that you have been admitted to the site. Removed when the site goes fully public.

These cookies cannot be disabled — the site does not function correctly without them.

Analytics cookies (opt-in)

We use Google Analytics 4 (GA4) to understand which pages visitors view and how they navigate the site. GA4 is loaded only after you explicitly accept analytics via the cookie banner that appears at the bottom of the page. If you decline, no GA4 cookies are set and no data is sent to Google.

  • _ga — distinguishes unique visitors; expires after 2 years.
  • _ga_* — stores session state; expires after 2 years.

GA4 is configured with Consent Mode v2: it withholds all analytics cookies and data collection until consent is granted. We do not use advertising, remarketing, or cross-site tracking cookies of any kind.

Your consent choices

When you first visit the site, a banner asks whether you accept analytics cookies. Your choice is logged server-side (timestamp, accepted categories, and a browser-generated consent ID — no personal identifiers) so we can demonstrate compliance with GDPR Article 7(1) if required.

To change your preferences at any time, click "Manage preferences" in the cookie banner footer, or clear the cc_cookie cookie in your browser — the banner will reappear on your next visit.

§ 11Children's information

We do not knowingly collect personal information directly from children under 16. Where a parent or sponsor provides information about minor children as part of a family application, that information is handled with the same protections as the rest of the file.

§ 12Changes to this policy

We update this policy when the law, our tools, or our practice changes. The "Last updated" date below tells you the version in force. If a change materially reduces your rights, we will tell you by email if we have one for you.

Last updated: June 21, 2026 Privacy contact: vanessa@turasimmigration.ca