1. Identity of the data controller

Data controller: 1st Step Consulting Ltd trading as Immigration Visa Expert, a company registered in England and Wales (company number 14708821). Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Website: https://www.immigrationvisaexpert.com/. Privacy contact: info@immigrationvisaexpert.com. Telephone: +44 (0)20 3911 1115.

Immigration Visa Expert is our trading name, not a separately incorporated entity. UK immigration advice is provided only within the scope of applicable Immigration Advice Authority (IAA) authorisation. The IAA registration details published by the practice should be confirmed against the current IAA register whenever updated.

2. What personal information we process

• Identity and contact information, including names, dates of birth, nationality, postal and email addresses, telephone numbers, signatures and identity documents.
• Case and eligibility information, such as travel and immigration history, visa applications and refusals, employment, education, accommodation, relationships, dependant information, sponsor records, passport and supporting documents.
• Financial and commercial data, such as income, tax and employment documents, financial statements, payments, invoices, business details and, where necessary, source-of-funds evidence.
• Special category and other sensitive information where relevant and lawful, including health or disability matters, racial or ethnic origin, religion, biometric data, and information involving allegations or criminal convictions.
• Training, recruitment and business information, including enrolments, course records, queries, CVs, business communications, employer/sponsor contacts and regulatory compliance records.
• Technical information such as IP addresses, browser, website access logs, security events, cookies and similar identifiers subject to the separate Cookie Policy.

3. Sources of personal information

We obtain information directly from you or an authorised representative, family member, employer, sponsor or referrer; from documentation and correspondence supplied in connection with a matter; from government and official authorities; from professional advisers and other relevant third parties; and from public registers, website systems and communications platforms. Where we receive information about other people, we assess whether and how privacy information must be supplied to them.

4. Our purposes and lawful bases

We determine the lawful basis for each specific processing activity and assess our legitimate interests against individuals’ rights. Where consent is necessary, it is freely given and may be withdrawn. Submitting a form or browsing the website is not deemed blanket consent.

5. Sensitive information and criminal-offence data

Where we process special category information, we identify an additional condition under Article 9 UK GDPR, such as explicit consent when appropriate, necessity for legal claims where applicable, or another condition permitted by law. Criminal-offence data is processed only where Article 10 UK GDPR and the Data Protection Act 2018 allow it, with applicable safeguards. Sensitive documents must be relevant and proportionate to the service.

6. If information is not provided

Some information is necessary to provide properly informed immigration advice, satisfy professional or legal duties, verify identity, or complete an application. If essential information is withheld or materially inaccurate, we may decline or be unable to continue instructions. We will explain significant consequences where practicable.

7. Confidentiality and information sharing

Client records are confidential. Where reasonably necessary and lawful, we may disclose relevant information to:

• UKVI, the Home Office, government departments, relevant overseas visa authorities, application centres, endorsing bodies, tribunals and courts in connection with instructions;
• our authorised team, supervised casework support, interpreters, translators, barristers and other professional advisers under suitable duties of confidentiality and regulatory arrangements;
• IT, cloud hosting, case-management, payment, appointment, training, identity-verification and communications service providers subject to appropriate safeguards;
• the IAA, insurers, tax, regulatory or law-enforcement authorities when required or lawfully justified;
• the client’s authorised sponsor, employer, family representative or other appropriate recipient for the instructed purpose;

• professional advisers and prospective successors involved in a genuine corporate transaction, subject to confidentiality and lawful sharing.

We do not sell identifiable client case files or share sensitive immigration records with unrelated advertising brokers. We disclose only what is needed and preserve required client approvals. We may refuse a request for disclosure where doing so would breach confidentiality, data protection law or professional duties.

8. Transfers outside the United Kingdom

Some immigration matters necessarily involve overseas authorities or service providers. We may also use approved service suppliers operating internationally. When a transfer is restricted under UK GDPR, we use a recognised lawful mechanism—such as applicable adequacy regulations, a UK International Data Transfer Agreement, UK Addendum or an available statutory exception—and conduct required assessments and safeguards. Details of relevant safeguards may be requested from us. We do not regard general website use as blanket consent to international transfer.

9. Retention and deletion

We retain records only as long as justified by the purpose, IAA requirements, applicable tax and accounting rules, dispute limitation periods, legal holds and continuing regulatory obligations. In particular, the IAA Code of Standards 2024 requires client files and records to be kept for at least six years and securely destroyed afterwards, unless a separate lawful reason requires continued retention. Non-client enquiries, website logs, training records and marketing preferences are reviewed under purpose-specific schedules. Backup records may be removed on controlled cycles. An erasure request does not automatically override a legal duty to retain a record.

10. Information security

We maintain risk-appropriate technical and organisational safeguards, including restricted access, confidentiality arrangements, secure transmission and storage practices, supplier oversight, appropriate account controls and incident-response procedures. Absolute security cannot be guaranteed. Please contact us immediately if you suspect a security incident involving information shared with us.

11. Marketing messages

Service, payment and case-progress communications are distinct from direct marketing. Marketing emails and electronic messages are sent only in compliance with the Privacy and Electronic Communications Regulations 2003, including consent or an applicable soft opt-in where all statutory conditions are met. You may opt out at any time, without affecting necessary case communications.

12. Cookies and online services

Cookies, similar technologies, website analytics and any third-party embeds are governed by our separate Cookie Policy. Non-exempt technologies requiring prior consent must not be activated before that consent is obtained. External sites and payment providers may act as separate controllers; their privacy notices govern their independent use of information.

13. Children, dependants and vulnerable clients

Some cases require data about children, family members or persons who need additional assistance. We take additional care with the relevance, security and confidentiality of this information and assess the appropriate authority to provide instructions or share information.

14. Automated processing and digital assistance

Digital tools may assist document management, administrative triage, fraud prevention or website operations. They are not a replacement for individual regulated legal advice. Where solely automated decisions with legal or similarly significant effects are used, we will provide the legally required information and safeguards. We do not authorise the upload of identifiable client material to unrestricted public AI systems without appropriate assessment and protections.

15. Your data protection rights

Subject to the circumstances and lawful exceptions, you may request access, rectification, erasure, restriction, data portability or object to certain processing; you may withdraw consent at any time when consent is the basis. You may also have protections regarding qualifying solely automated decisions. The right to object to direct marketing is absolute. We may verify identity or authority before acting, and ordinarily respond within the statutory period. Fees or refusal apply only in circumstances allowed by law.

16. Data protection complaints

Please submit data protection concerns to info@immigrationvisaexpert.com or write to the registered office. We will make the complaints process accessible, acknowledge a data protection complaint within 30 days, investigate appropriately and without undue delay, keep you informed and communicate the outcome. Complaints relating to regulated immigration advice may additionally engage our separate client complaints procedure and the IAA complaint process. You may complain to the Information Commissioner’s Office at https://ico.org.uk/.

17. Changes and contact

We may update this Privacy Policy as services, law or technology change. The effective date identifies the current public version. Material changes will be communicated when required by law. For privacy or data rights questions contact info@immigrationvisaexpert.com, or write to 1st Step Consulting Ltd trading as Immigration Visa Expert, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.