Privacy Policy

Who we are

Visa Plan Pty Ltd, trading as Visa Plan Lawyers (ABN 17 670 413 368), is an Australian law practice at Level 13, 257 Collins Street, Melbourne VIC 3000. In this policy, "we", "us" and "our" mean Visa Plan Lawyers.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles in it. Because we are in Victoria, we also follow the Health Records Act 2001 (Vic) for health information. Our lawyers owe you a duty of confidentiality under the Legal Profession Uniform Law (Victoria) and its conduct rules, and communications with them for the purpose of legal advice are generally protected by legal professional privilege.

This policy explains what personal information we collect, how we collect, hold, use and disclose it, how you can see or correct it, and how to complain. Ask us if you would like a copy in another form, such as a printed copy. There is no charge.

The kinds of information we collect

We collect what we need to respond to an enquiry and to advise and act for you. Depending on the matter, this may include:

• your name, contact details, date of birth, gender, nationality and languages;
• identity and travel documents, including passport details, visa grant numbers and other identifiers issued by government agencies;
• your immigration history, education, qualifications, skills assessments, English test results and work history;
• family and relationship details, including about your partner, children and other family members;
• financial information, such as income, assets, business records and payment details;
• information about a sponsoring business and its staff, where we act for an employer;
• recordings, transcripts and summaries of calls with us;
• the history of your enquiry with us, for example whether we sent you a service agreement;
• information about how you use our website and respond to our advertising.

Sensitive information

Some matters need sensitive information, as the Privacy Act defines it. This can include health information (for health requirements), criminal record (for character requirements), racial or ethnic origin, religious beliefs, sexual orientation (for example, in a partner visa or a protection claim) and biometric information.

We collect sensitive information only with your consent and only where it is reasonably necessary for your matter, unless the law requires or allows us to collect it. You can tell us at any time that you do not want us to collect a kind of sensitive information, and we will explain what that means for your matter.

Health information

We hold health information, such as medical reports for a visa health requirement, only for your matter. We handle it under the Health Records Act 2001 (Vic) as well as the Privacy Act, and this policy is our policy on managing health information. You can ask to see your health information in the same way as any other information (see "Seeing and correcting your information").

Government identifiers

We record identifiers issued by government agencies, such as passport numbers, visa grant numbers and Department of Home Affairs references, because a matter cannot be run without them. We do not use any of them as our own way of identifying you. We use or disclose them only to act on your matter, to confirm who you are, or where the law requires or allows it.

Dealing with us without giving your name

You can ask us a general question without giving your name, or using another name. To advise you on your own circumstances or act for you, we need to know who you are. We cannot check for conflicts of interest, give advice based on your facts, or lodge an application without knowing who you are, and our trust account records must show your real name.

How we collect and hold information

We collect information from you wherever we reasonably can, including through:

• the enquiry forms on this website;
• lead forms on Google and Meta (Facebook and Instagram), which pass the details you enter to us;
• messages, calls and reviews through our Google Business Profile;
• phone calls, which are recorded, including calls from our automated caller to people who have sent us an enquiry;
• email, text messages, video meetings and meetings in person;
• documents you send us, and documents you sign electronically through our e-signing system.

We also collect information from others when you authorise it or your matter needs it: sponsors and employers, family members, previous representatives, skills assessing authorities, education providers, the Department of Home Affairs and other government agencies, courts and tribunals. If someone else gives us information about you, we take reasonable steps to make sure you know.

We hold information electronically in our case management system and our other systems, run by the service providers listed below. Only staff who need it for their work can see it.

Information we did not ask for

If we receive personal information we did not ask for, we decide within a reasonable time whether we could have collected it under the Australian Privacy Principles. If not, we destroy it or remove anything that identifies you as soon as practicable, where it is lawful and reasonable to do so.

Why we collect, use and disclose information

We collect, hold, use and disclose personal information to:

• respond to your enquiry and contact you about it;
• check for conflicts of interest and confirm who you are;
• advise you, and prepare and lodge applications, submissions and reviews;
• deal with the Department of Home Affairs, other government agencies, courts, tribunals and others involved in your matter;
• bill you, receive payments and keep our trust account;
• meet our professional, legal and record-keeping duties;
• measure and improve our website and advertising, including telling advertising platforms how enquiries progress, as described below;
• send you information about our services, if you have agreed to receive it.

We do not use your information for an unrelated purpose without your consent, unless the law requires or allows it.

Recorded calls and AI tools

Calls are recorded. We record phone calls between you and us, and we tell you at the start of the call. If you do not want a call recorded, tell us and we will offer another way to talk, such as email or a meeting.

Transcripts and summaries. Recordings are turned into written transcripts and summaries by AI services on Microsoft Azure in Australia. Our team uses them to keep an accurate record and to follow up your enquiry.

Our automated caller. If you send us an enquiry, our automated caller may phone you.

• It tells you at the start that it is an automated caller and that the call is recorded.
• It runs on Twilio in Australia, and its replies are written by an AI model on Microsoft Azure in Australia. During the call, speech is converted to text, and replies into speech, by speech services that Twilio uses (such as Google), which may process it in the United States.
• It can answer general questions about how we work.
• It can update the status of your enquiry based on what you tell it, for example that you would like a consultation or do not want to be contacted again.
• You can ask to speak with a person at any time, and our team can review and change any status it records.

Other AI tools. Our team uses AI tools to help read and file incoming emails, including letters from the Department of Home Affairs, and to help prepare documents and review files. Some of these tools are run by providers in the United States, including Anthropic. A member of our team checks the work.

A lawyer reviews all advice. No automated tool gives you legal advice on our behalf. A lawyer reviews all advice we give, and our lawyers make the decisions on your legal matter.

Decisions made with computer programs. The Privacy Act asks us to explain where a computer program makes a decision, or does something closely tied to making a decision, that could significantly affect your rights or interests.

• Information used: your contact details, the details of your enquiry, recordings, transcripts and summaries of your calls with us, and emails and letters about your matter.
• Decisions made by a computer program alone: updating the status of your enquiry after a call with our automated caller, including recording that you do not want to be contacted again. We do not let a computer program alone decide whether we act for you, what we advise, or anything else affecting your legal rights.
• Decisions where a computer program plays a large part but a person decides: our team may use AI transcripts and summaries in deciding how to follow up an enquiry; our lawyers may use them in preparing advice; AI tools that read incoming emails may flag deadlines and file letters on your matter, and our team relies on those results to act on time. A person checks and makes each of these decisions.

Website, advertising and Google Business Profile

Our website and advertising use the services below. Some set cookies or similar technologies and collect information such as your device, browser, IP address, the pages you visit, the advertisement you clicked and your approximate location.

Google Analytics 4 (through Google Tag Manager), to measure how the website is used.

Google Ads, to show and measure our advertising.

• When you submit an enquiry form, we use enhanced conversions: your email address and phone number are hashed (turned into a code that cannot be read as the original) in your browser and sent to Google, which matches them to Google accounts to measure whether our advertising led to the enquiry.
• We also tell Google when an enquiry leads to us sending a service agreement or becomes a client, and when we decide not to proceed with an enquiry. We use the advertisement click identifier where we have one, and hashed contact details, so Google can measure whether our advertising led to the enquiry. This applies to every enquiry that reaches those points, however it reached us.
• If you arrive from one of our advertisements, the phone number shown may be a Google forwarding number, so Google can tell us whether a call came from our advertising.

Meta pixel and Meta Lead Ads (Facebook and Instagram), to show and measure our advertising and to receive the details you submit in a Meta lead form.

Google Business Profile. If you message, call or review us through our Google Business Profile, Google passes us the details you provide.

Cloudflare, which hosts this website, protects it from attacks, and runs Cloudflare Web Analytics, which counts visits without cookies.

You can control cookies in your browser settings. You can opt out of Google Analytics with Google's browser add-on, manage Google advertising in My Ad Center, and manage Meta advertising in your Facebook ad preferences. Turning off cookies may affect how parts of the website work.

Who we disclose information to

We disclose personal information only as needed to act on your matter or run our practice, or where the law requires or allows it. This may include:

• the Department of Home Affairs, other Australian government agencies, the Administrative Review Tribunal and courts;
• skills assessing authorities, education providers, sponsors and employers involved in your matter;
• overseas authorities, and family members or sponsors, where your matter needs it and you have authorised it;
• barristers, translators, medical and other professionals we engage for your matter;
• our service providers, listed below, who must keep it confidential.

Our service providers are:

• Microsoft (Azure and Microsoft 365): our case management system, email, documents, call recordings, transcripts and summaries. Our Azure systems are in Australia.
• 3CX: our office phone system, which runs on our own Microsoft Azure server, and our video meetings.
• Twilio: phone calls made and received by our automated caller, in Twilio's Australian region, and the speech services it uses.
• Clio: our trust account records and a backup copy of matter records, held in Clio's Australian region.
• Xero: accounting and invoicing.
• Slack: internal messaging, including notice to our team of new enquiries.
• Documenso: electronic signing, which we run on our own systems.
• n8n: automated reminders and messages between our systems, which we run on a DigitalOcean server in Sydney.
• Cloudflare: website hosting, security, and delivery of enquiry form submissions to us.
• GitHub: storage of the code for our website and systems.
• Zoom: video meetings, where we use it.
• Google and Meta: analytics, advertising, lead forms and Google Business Profile, as described above.
• AI service providers: the tools described in "Recorded calls and AI tools".

We send and receive text messages through a mobile service we run ourselves.

Disclosure overseas

We are likely to disclose personal information to recipients outside Australia. Some of our service providers store or process information overseas, mainly in the United States. Members of our support staff work from the Philippines, Vietnam and Cambodia and may see your information to support your matter. Where your matter needs it, we also disclose information to authorities, family members or sponsors in other countries.

Before disclosing personal information overseas, we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles, unless an exception in the Privacy Act applies. We take the same steps for health information, as the Health Records Act 2001 (Vic) requires.

Where you ask us to send your information to an authority, family member or sponsor overseas, we will tell you before we send it that, if you consent, we will not have to take reasonable steps to make sure the recipient complies with the Australian Privacy Principles, and we will not be accountable under the Privacy Act for how the recipient handles it. If you then consent, we send it on that basis.

Marketing emails, texts and calls

We send marketing emails or texts only if you have agreed, or where the Privacy Act and the Spam Act 2003 (Cth) otherwise allow it. We never use sensitive information for marketing without your consent. Every marketing message names Visa Plan Lawyers, gives our contact details and includes a way to unsubscribe. We do not make marketing calls to numbers on the Do Not Call Register unless you have agreed to hear from us.

You can opt out at any time, at no cost, by using the unsubscribe link, replying STOP to a text, or contacting us. We act on your request within 5 business days. You can also ask us where we got your details, and we will tell you at no cost. Messages about a matter we are acting on, such as updates, appointments and bills, are not marketing and continue while we act for you.

Security and how long we keep information

We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. Our staff and service providers must keep it confidential.

We keep personal information only as long as we need it and the law requires:

• client files: 7 years after the matter closes;
• trust account records: 7 years after the last entry or after the matter is finalised, whichever is later;
• enquiries that do not lead to an engagement, including recordings of those calls: 2 years after the last contact;
• recordings, transcripts and summaries of calls on a client's matter: 7 years after the matter closes, with the rest of the client file.

After that we securely destroy the information or remove anything that identifies you, unless the law requires us to keep it longer.

Data breaches

We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If a data breach involving your personal information is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the scheme requires.

Children

Many visa matters involve children. We usually collect a child's information from a parent or guardian, who gives it on the child's behalf and with authority to do so. We handle it with the same care as any other personal information, and we ask the parent or guardian to make sure an older child understands, where appropriate, how their information will be used.

Seeing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date, incomplete, irrelevant or misleading. Contact us using the details below. We will need to confirm who you are.

We will respond within a reasonable time, generally within 30 days. It costs nothing to make a request, and we never charge for correcting your information. If giving you access would involve significant cost, we will tell you the charge before going ahead, and it will not be excessive. If we correct information we have given to another organisation, we will tell them if you ask.

If we refuse access or correction, we will tell you why in writing and how to complain. The law allows us to refuse access only in limited cases, for example where it would unreasonably affect another person's privacy, where the information relates to legal proceedings between you and us, or where the law requires or allows us to refuse. If we refuse a correction, you can ask us to attach a statement that you think the information is wrong, and we will.

Complaints

If you think we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first, in writing, so we can look into it. We will acknowledge your complaint, investigate it, and give you our response in writing within 30 days.

If you are not satisfied, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner. For a complaint about health information, you can also contact the Victorian Health Complaints Commissioner. If your concern is about a lawyer's conduct rather than privacy, you can contact the Victorian Legal Services Board and Commissioner.

Changes to this policy

We update this policy when our practices or the law change. The current version is always on this page, with the date it took effect and the date it was last updated.

Contact us

For privacy requests, questions or complaints: Visa Plan Lawyers | Level 13, 257 Collins Street, Melbourne VIC 3000 | enquiry@visaplan.au | (03) 9958 5854

Enquiry collection notice

When you send us an enquiry, by form, phone, email, text or an advertising lead form:

• Visa Plan Lawyers (contact details above) collects your name, contact details and enquiry so we can respond. Without them we cannot contact you or help with your enquiry.
• We may phone you, including through our automated caller, and calls are recorded.
• We use and disclose your details as this policy describes, including to the service providers listed above.
• When you submit a form on our website, a hashed code of your email address and phone number goes to Google. We also tell Google when an enquiry leads to us sending a service agreement or becomes a client, and when we decide not to proceed with an enquiry. We use the advertisement click identifier where we have one, and hashed contact details, so Google can measure whether our advertising led to the enquiry.
• Some service providers are overseas, mainly in the United States, and our support staff in the Philippines, Vietnam and Cambodia may see your details.
• This policy explains how to see or correct your information, how to complain, and how we deal with complaints.