PRIVACY POLICY — IMMITALENTS INC.

SECTION 1: PREAMBLE, MISSION, AND BINDING AGREEMENT

1.1. INTRODUCTION AND PRESENTATION OF IMMITALENTS INC.

Welcome to the Privacy Policy of ImmiTalents Inc., a corporation duly incorporated under the laws of the Province of Quebec, Canada, with its head office located in Montreal (hereinafter referred to as “ImmiTalents”, “the Company”, “we”, “us”, or “our”).

1.1.1. Our Mission and Vision

ImmiTalents operates a cutting-edge technological ecosystem designed first and foremost a SaaS (Software as a Service) technological platform to bridge the gap between global professional talent, employers seeking international expertise, and authorized legal professionals specializing in mobility. Our mission is to humanize and simplify the complex journey of international migration through transparency, automation, and ethical data management.

We recognize that in the digital age, and specifically within the sensitive context of immigration and employment, your personal information is your most valuable asset. Our vision is to provide a platform where mobility is no longer hindered by information asymmetry or data insecurity.

1.1.2. Commitment to Data Protection

At ImmiTalents, privacy is not a mere compliance checkbox; it is a core value integrated into our software architecture through “Privacy by Design” principles. We are committed to protecting the confidentiality, integrity, and availability of the information entrusted to us by our Candidates, Employers, and Authorized Professionals. This policy outlines our rigorous standards for data collection, processing, and safeguarding, ensuring that your journey toward new horizons is built on a foundation of absolute trust.

1.2. LEGAL SCOPE AND CONTRACTUAL VALUE

1.2.1. A Legally Binding Contract

This Privacy Policy (the “Policy”) constitutes a legally binding agreement between you, the individual or entity accessing our Platform (the “User”, “you”, or “your”), and ImmiTalents Inc. By accessing immitalents.com, our mobile applications, or utilizing our proprietary Referral Tool, you acknowledge that you have read, understood, and agreed to be bound by the terms of this Policy.

1.2.2. Integration with the Terms of Use

This Policy is an integral part of the ImmiTalents Terms and Conditions of Use (CGU/ToS). Both documents must be read in conjunction to fully understand your rights and obligations. In the event of a direct conflict between a provision in the Terms of Use and a provision in this Privacy Policy regarding the processing of Personal Information, the provisions of this Privacy Policy shall prevail to the extent of the conflict.

1.2.3. Consequences of Non-Compliance

Compliance with this Policy is a condition of your continued access to the Platform. Any violation of these privacy standards—such as the unauthorized harvesting of data (scraping), the submission of fraudulent identity documents, or the misuse of other Users’ contact information—may result in the immediate suspension or termination of your Account, without prejudice to any legal action or reports to regulatory authorities (such as the Commission d’accès à l’information du Québec or professional orders).

1.3. UNIVERSAL ACCESSIBILITY AND THE “FREE-TO-USE” MODEL

1.3.1. Impact of the Free Service Model on Data

As detailed in our Terms of Use, ImmiTalents currently provides its core matching and referral services free of charge to all categories of Users (Candidates, Experts, and Employers).

1.3.2. Ethical Data Stewardship

Because our platform is offered without a fee-for-service for these core functions, we reaffirm that your data is not the product. ImmiTalents does not sell your identifiable personal information to third-party data brokers. Our economic model, while currently free, is designed to be sustained through future value-added services and corporate partnerships that respect the strict boundaries of this Policy. The “free” nature of the service enhances our responsibility to remain a neutral and secure steward of your professional and migration history.

1.4. EXPLICIT ACCEPTANCE AND CONSENT MECHANISMS

1.4.1. The Click-Wrap Consent

Consent is obtained through a clear and proactive “click-wrap” mechanism. Upon registration or when initiating a referral request, you must click a checkbox stating: “I have read and agree to the Privacy Policy and Terms of Use.” This action constitutes your express, free, and informed consent to the processing of your data as described herein.

1.4.2. Implied Consent through Continued Use

While we prioritize express consent, your continued use of the Platform following a minor administrative update to this Policy constitutes your acknowledgment and acceptance of those changes. If at any time you no longer agree with our data practices, you must immediately cease using the Platform and request the closure of your Account.

1.4.3. Specific Consent for Sensitive Data

For certain high-stakes operations—such as biometric identity verification via Stripe Identity or the disclosure of Level 2 personal information to an Expert—we may require additional, specific consent prompts to ensure you are fully aware of the data flow.

1.5. REVISIONS, UPDATES, AND ARCHIVING

1.5.1. Right to Modify

ImmiTalents evolves in a dynamic regulatory landscape, particularly with the implementation of Quebec’s Law 25, the GDPR in Europe, and PIPEDA in Canada. Consequently, we reserve the right to update this Policy at our sole discretion.

1.5.2. Notification Procedure

For material changes that significantly affect your rights (e.g., changes in the types of data collected or new third-party sharing categories), we will provide at least thirty (30) days’ notice by:

• Sending an email to the address associated with your Account.
• Displaying a prominent notice on the Platform’s dashboard.
• Utilizing a pop-up notification upon your next login.

1.5.3. Archiving and Transparency

We maintain an archive of all previous versions of our Privacy Policy. Users may request access to a prior version to understand how their data was managed at a specific point in time by contacting our Data Protection Officer (DPO). The “Effective Date” at the top of the policy indicates the most recent revision.

1.6. USER RESPONSIBILITY IN DATA PROTECTION

1.6.1. Accuracy of Information

The effectiveness of our matching algorithms and the legality of your immigration journey depend on the accuracy of your data. You are responsible for ensuring that all information provided—including CVs, diplomas, and visa history—is truthful and up-to-date. Providing false information not only violates this Policy but may also constitute a crime under immigration laws.

1.6.2. Credential Security

While ImmiTalents employs robust server-side security, you are the primary guardian of your Account access. You agree to:

• Maintain a unique, complex password.
• Enable Multi-Factor Authentication (MFA) where available.
• Notify us immediately of any suspected unauthorized access. ImmiTalents cannot be held liable for data breaches resulting from User negligence in managing their login credentials.

1.6.3. Discretion in Communications

When interacting with other Users (Employers or Experts) via the Platform’s messaging tools, you are advised to exercise discretion. While our system anonymizes initial contacts, any information you choose to disclose voluntarily in a chat remains your responsibility.

1.7. CROSS-BORDER APPLICABILITY

This Policy is designed to satisfy the rigorous requirements of multiple jurisdictions:

• Quebec: Compliance with the Act respecting the protection of personal information in the private sector (Law 25).
• Canada: Adherence to the Personal Information Protection and Electronic Documents Act (PIPEDA).
• European Union: Alignment with the General Data Protection Regulation (GDPR) for our European candidates.

By using ImmiTalents, you acknowledge that your data will be processed and stored on servers located in Canada and/or the United States, subject to the safeguards described in the following sections.

SECTION 2: DEFINITIONS AND KEY TERMINOLOGY

To ensure full transparency and clarity, ImmiTalents provides the following exhaustive list of definitions used throughout this Privacy Policy. These terms are derived from applicable legislation, including Quebec’s Law 25, Canada’s PIPEDA, and the European Union’s GDPR.

2.1. CORE DATA PROTECTION TERMS

1. Personal Information (or Personal Data): Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
   • Examples: Your legal name, private email address, government ID number, IP address, geolocation data, and browsing history that could be linked back to you.
2. Sensitive Personal Information: A sub-category of Personal Information that, due to its nature (medical, genetic, biometric, etc.) or the context of its use or communication, entails a high degree of expectation of privacy.
   • Examples: Information regarding your immigration status, ethnic origin, health conditions, or criminal records provided during the intake process.
3. Biometric Data: Personal information resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person, which allow or confirm the unique identification of that person.
   • Examples: Facial recognition patterns (faceprints) or fingerprints used during our identity verification process via third-party partners like Stripe Identity.
4. Processing (or Treatment): Any operation or set of operations performed on Personal Information, whether or not by automated means.
   • Examples: Collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, or deletion of your data.
5. Anonymization: The process of irreversibly transforming Personal Information so that it can no longer be used to identify a person, directly or indirectly. Once data is truly anonymized, it is no longer considered Personal Information under most laws.
   • Example: Aggregating the ages of 1,000 users to determine an average age without keeping any names or unique IDs.
6. Pseudonymization: The processing of Personal Information in such a manner that it can no longer be attributed to a specific person without the use of additional information.
   • Example: Replacing a User’s name with a “RefID” code while keeping the link to the name in a separate, secure database.
7. Data Controller (or Organization): The entity that, alone or jointly with others, determines the purposes and means of the processing of Personal Information.
   • Note: For the purposes of this Policy, ImmiTalents Inc. is the Data Controller.
8. Data Processor (or Sub-processor): A third party that processes Personal Information on behalf of the Data Controller.
   • Examples: Amazon Web Services (AWS) for data hosting, or Stripe for identity verification.
9. Data Protection Officer (DPO): The individual designated by ImmiTalents to oversee the data protection strategy and ensure compliance with legal requirements (e.g., Law 25’s “Privacy Officer”).
10. Confidentiality Incident (or Data Breach): Any unauthorized access, use, or communication of Personal Information, or the loss of such information or any other breach in the protection of such information.

2.2. PLATFORM-SPECIFIC ROLES

1. User: Any person or entity that accesses the Platform, regardless of whether they have created an account or are merely browsing.
2. Candidate (or Talent/Job Seeker): A natural person using the Platform to seek employment opportunities, mobility advice, or legal representation for immigration purposes.
3. Employer: A legal entity or authorized representative of an organization using the Platform to post jobs, search for international talent, or manage corporate mobility.
4. Authorized Professional (or Expert): A practitioner who is a member in good standing of a recognized professional order or regulatory body authorized to provide legal advice or immigration services.
   • Requirements: This includes lawyers (members of a provincial Bar), Notaries (in Quebec), or Regulated Canadian Immigration Consultants (RCICs) who have verified their credentials on the Platform.
5. Student: An individual using the Platform specifically to access the School Directory or to seek information regarding study permits and educational opportunities in Canada.
6. Visitor: An individual who navigates the public pages of the website without logging into an account.

2.3. TECHNICAL AND OPERATIONAL TERMS

1. Platform: The digital infrastructure operated by ImmiTalents Inc., encompassing the website (immitalents.com), mobile applications, APIs, database systems, and the proprietary matching software.
2. Referral Tool: The automated system that processes User requests to be connected with an Authorized Professional.
3. Expert Search Loop: The proprietary, sequential logic used by the Referral Tool to identify and contact Experts. It ensures that data is shared progressively and only with professionals who are available and have no conflicts of interest.
4. Intake Form: The structured questionnaire filled out by a Candidate or Employer to initiate a search or a referral, containing the primary data needed for the matching logic.
5. RefID: The unique, alphanumeric identifier assigned to a specific referral request or case file to ensure traceability while maintaining Level 1 anonymity.
6. Stage 1 Disclosure (Anonymized): The initial phase of the Expert Search Loop where only non-identifying data is shared with a potential Expert to allow them to assess the case.
7. Stage 2 Disclosure (Identified): The final phase of the loop where full Personal Information (Name, Email, Phone) is shared with an Expert after they have formally accepted the request.
8. Cookies: Small text files stored on your device by your web browser that allow the Platform to remember your preferences, track sessions, and analyze traffic.
9. Web Beacons (or Pixels): Tiny graphic images embedded in emails or web pages used to track whether a User has opened a communication or performed a specific action.
10. Log Files: Files that record events taking place in ImmiTalents’ computer systems (e.g., login times, pages visited, IP addresses).
11. Immigration Pathway Tracker (Milestone Assistant): A digital informational tool allowing Users to visualize and track the standard stages of an international mobility project.
12. Pathway Data: Information regarding the specific milestones checked by a user, session inactivity buffers, and triggered automated informational support.

2.4. LEGAL AND PRIVACY RIGHTS TERMS

1. Consent: Any freely given, specific, informed, and unambiguous indication of the User’s wishes by which they signify agreement to the processing of their Personal Information.
2. Profiling: Any form of automated processing consisting of the use of Personal Information to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning professional performance, economic situation, or reliability.
   • Example: Suggesting specific job offers to a Candidate based on their past career history.
3. Automated Decision-Making: Decisions based solely on automated processing, including profiling, which produce legal effects concerning the User or similarly significantly affect them.
   • Note: ImmiTalents uses automated tools for matching, but final decisions on hiring or legal mandates are always subject to human intervention.
4. Data Portability: The right of a User to receive their Personal Information in a structured, commonly used, and machine-readable format and to have that data transmitted to another controller.
5. Third Party: A natural or legal person, public authority, agency, or body other than the User, ImmiTalents, or the sub-processors directly under ImmiTalents’ control.
6. Cross-Border Transfer: The movement of Personal Information from one jurisdiction (e.g., the EU or Quebec) to another (e.g., the USA) for storage or processing.
7. Retention Period: The duration for which ImmiTalents keeps Personal Information, determined by legal requirements, business necessity, and the purposes for which the data was collected.
8. Applicable Law: Refers to all privacy and data protection laws relevant to ImmiTalents, primarily the Act respecting the protection of personal information in the private sector (Quebec), PIPEDA (Canada), and the GDPR (EU).

SECTION 3: TYPES OF PERSONAL DATA COLLECTED AND COLLECTION METHODS

In accordance with the principle of data minimization, ImmiTalents only collects the information necessary to fulfill the specific purposes of our Platform. This section details the data we collect based on your role and interaction with our services.

3.1. DATA NECESSARY FOR PLATFORM UTILIZATION

3.1.1. Identifiers and Contact Information

For all registered Users, we collect basic identifiers required to manage your account and secure your access.

• Email Address: Essential for account creation, multi-factor authentication (MFA), and critical service notifications.
• Full Name: Required to identify you within the platform’s internal communications and for legal compliance.
• Phone Number: Collected for security verification and to facilitate contact during the “Stage 2 Disclosure” of a referral.
• IP Address: Automatically captured for security purposes, fraud detection, and to ensure compliance with geographic-specific regulations (e.g., Law 25 or GDPR).

3.1.2. Candidate Professional Profile (Talent Data)

To provide our free matching service, Candidates provide extensive professional data.

• Curriculum Vitae (CV) & Employment History: Includes job titles, employer names, duration of employment, and key responsibilities. This is used by our matching algorithm to suggest relevant job offers.
• Education and Credentials: Degrees obtained, institutions attended, and professional certifications.
• Immigration Status and History: Information regarding current visas, past applications, and intended destination. This is classified as Sensitive Data and is handled with enhanced security.
• Language Proficiency: Results from standardized tests (e.g., TEF, IELTS, TOEFL) and self-assessments. We may require copies of test results to verify these claims for Employers or Experts.

3.1.3. Employer and Corporate Information

To ensure the legitimacy of job offers and the safety of our Candidates, we collect corporate data.

• Business Details: Legal name of the company, registration numbers (e.g., NEQ in Quebec), industry sector, and head office address.
• Job Offer Details: Description of roles, salary ranges, and sponsorship availability. This information is processed to comply with local labor and immigration laws.
• Authorized Representative Data: Contact details and identification of the individual managing the company account.

3.1.4. Expert Credentials and Identity Verification

Authorized Professionals are subject to rigorous verification to maintain the integrity of our referral network.

• Professional Accreditations: Copies of Bar membership certificates, RCIC registration numbers, and proof of good standing.
• Identity Documents: Government-issued IDs (passports or driver’s licenses) processed via Stripe Identity.
• Biometric Verification: During the onboarding of Experts and certain Employers, Stripe Identity may perform a “liveness check” by comparing a selfie to a photo ID. ImmiTalents receives the result of this verification but does not store your raw biometric templates.

3.2. DATA PROVIDED VOLUNTARILY BY THE USER

3.2.1. Immigration Assistance Tool Data

When you initiate a referral request, you voluntarily provide case-specific information.

• Case Description: E.g., “I am looking for a work permit for Canada” or “I need to appeal a visa refusal.”
• Supporting Documents: Any legal or administrative files you choose to upload to assist the Expert in their initial assessment.
• Anonymization Logic: This data is shared with Experts in a two-stage process. Stage 1 is strictly anonymized (using your RefID) until the Expert accepts the conflict check.

3.2.2. School Directory and Academic Data

Users accessing our educational services may provide:

• Academic Transcripts: For evaluation by educational institutions.
• Program Preferences: Targeted areas of study and desired start dates.
• Explicit Consent for Sharing: This data is only shared with educational institutions after you provide a specific, granular consent for that specific school.

3.2.3. Communications and Support

• Support Logs: Records of your interactions with our customer success team via email or internal chat.
• Feedback and Surveys: Voluntary responses to service quality surveys.
• Community Contributions: Any articles or blog posts contributed by Experts.

3.3. DATA GENERATED THROUGH PLATFORM INTERACTION

3.3.1. Usage Data and Behavioral Analytics

We collect data on how you navigate our Platform to improve matching scores and UI/UX.

• Platform Activity: Pages viewed, time spent on specific sections, and job offers saved.
• Example: “User ID #8892 viewed 5 job offers in Toronto on January 20, 2026, at 2:30 PM.”
• Matching Metrics: We track the success rate of suggestions to fine-tune our proprietary software logic.

3.3.2. Technical Data and Metadata

Our systems automatically log technical details about your connection:

• Device Information: Hardware model, operating system version, and unique device identifiers.
• Browser Metadata: Browser type, version, and language settings.
• Diagnostic Data: Crash reports and system performance metrics.

3.3.3. Cookies and Tracking Technologies

ImmiTalents uses various types of cookies to enhance your experience:

• Essential Cookies: Strictly necessary for the platform to function (e.g., session management, security).
• Analytical/Performance Cookies: Used to count visitors and see how they move around the site (e.g., Google Analytics).
• Functional Cookies: Recognize you when you return and remember your preferences (e.g., language choice).
• Targeting/Advertising Cookies: Used to deliver suggestions (like job offers) more relevant to your interests. Note: We do not use these to sell your profile to outside advertisers.

3.3.4. Geolocation Data

With your consent (usually managed via browser settings), we may collect your precise or approximate geolocation.

• Purpose: To suggest job offers or Experts located near you or in your target destination.
• Control: You can disable location tracking at any time without losing access to the platform’s primary features.

3.5. PATHWAY TRACKER DATA

When utilizing the Milestone Assistant, we collect:

• Checkbox Interaction: Data regarding which logistical stages of the immigration journey have been completed.
• Inactivity Buffer Metadata: The system monitors activity to trigger informational milestone summaries (usually after 2 hours of inactivity).

SECTION 4: PURPOSES OF PROCESSING AND LEGAL BASES

ImmiTalents processes your Personal Information for specific, legitimate, and transparent purposes. This section outlines how we use your data and the legal grounds upon which we rely, as required by Law 25, PIPEDA, and the GDPR.

4.1. SERVICE PROVISION AND CORE PLATFORM FUNCTIONALITY

The primary purpose of collecting your data is to provide the features you access on the Platform.

4.1.1. Account Creation and Management

We process your contact details and identifiers to establish your unique User ID, secure your login, and manage your preferences.

• Purpose: To verify your identity at login and allow you to manage your “Mobility Passport.”
• Legal Basis: Performance of a contract.

4.1.2. Job Matching and Display

For Candidates, our proprietary algorithm analyzes your CV, employment history, and skills to suggest the most relevant job offers.

• Example: “Your CV is analyzed by our algorithm to suggest relevant roles, such as Developer positions in Montreal based on your past experience in Java.”
• Purpose: To optimize the recruitment process for both the Talent and the Employer.
• Legal Basis: Legitimate interest (providing the core benefit of our free platform).

4.1.3. Employer Recruitment Management

For Employers, we process job offer data and applicant profiles to facilitate the selection of international talent.

• Purpose: To ensure that job offers meet the criteria for sponsorship and to manage the System for Applicant Tracking (ATS).
• Legal Basis: Performance of a contract / Legitimate interest.

4.2. MATCHING AND REFERRAL LOGIC (THE EXPERT SEARCH LOOP)

ImmiTalents operates a specialized Referral Tool to connect Users with Authorized Professionals.

4.2.1. Sequential Referral Logic

To protect Candidate privacy, the logic of our algorithm identifies suitable Experts based on their specialization, location, and availability. Unlike standard broadcasting, our system sequentially contacts Experts to prevent wide-scale data exposure.

• Purpose: To ensure that your sensitive immigration data is only disclosed to an Expert who is willing and able to take your case.
• Legal Basis: User consent (granted during the intake process).

4.2.2. Selection Criteria for Experts and Schools

Experts and educational institutions are suggested based on:

• Suitability: Matching the specific legal or academic needs expressed in your form.
• Reliability: Performance metrics based on responsiveness and feedback.
• Legal Basis: User consent.

4.3. COMMUNICATION AND USER NOTIFICATIONS

We use your contact information to keep you informed about your journey on the Platform.

4.3.1. Technical and Security Notifications

We send automated emails for password resets, MFA codes, and SLA updates.

• Purpose: To maintain the security and operational efficiency of your account.
• Legal Basis: Legitimate interest.

4.3.2. Alert and Service Messages

Our system generates notifications regarding your active searches or referrals.

• Example: “New offer matching your profile: Senior Developer in Montreal.”
• Purpose: To provide real-time updates on your mobility project.
• Legal Basis: Performance of a contract.

4.3.3. Newsletters and Community Updates

With your explicit opt-in, we send newsletters regarding immigration law updates, career advice, and platform news.

• Legal Basis: Consent. You may unsubscribe at any time via the link provided in each email.

4.4. LEGAL COMPLIANCE AND REGULATORY OBLIGATIONS

As a Canadian entity, ImmiTalents must adhere to strict regulatory standards.

4.4.1. Law 25 (Quebec) and PIPEDA Compliance

We process data to fulfill our obligations regarding transparency, data minimization, and the realization of Privacy Impact Assessments (PIA) for new technological features.

• Purpose: To ensure that automated decisions (like matching) are governed by appropriate safeguards.

4.4.2. Anti-Fraud and Sanctions Screening

We process identity documents and IP addresses to prevent fraudulent account creation and to comply with international sanctions and immigration laws.

• Legal Basis: Compliance with a legal obligation.

4.5. SERVICE IMPROVEMENT AND BUSINESS INTELLIGENCE

We analyze how our Platform is used to build a more effective ecosystem.

4.5.1. Aggregated and Anonymized Analytics

We use usage data to generate statistical reports that do not identify individuals.

• Example: “60% of our candidate base is currently seeking work permits specifically for Canada.”
• Purpose: To share market trends with institutional partners and to optimize our matching algorithms.
• Legal Basis: Legitimate interest (improving the service for the benefit of all users).

4.5.2. UI/UX Optimization

We monitor navigation paths to identify friction points in the user experience and to improve the Platform’s layout.

• Legal Basis: Legitimate interest.

4.6. MARKETING AND PERSONALIZED CONTENT

To sustain our “free-to-use” model, we may offer targeted promotions.

4.6.1. Personalized Suggestions

We may suggest value-added services (like identity certification or specialized training) based on your profile.

• Purpose: To connect you with resources that accelerate your mobility.
• Legal Basis: Consent / Legitimate interest.

4.6.2. Opt-Out and Transparency

Users have full control over their marketing preferences. You can opt-out of personalized marketing through your profile settings or by contacting our Privacy Officer.

SECTION 5: DATA SHARING AND DISCLOSURE

ImmiTalents does not sell your Personal Information. However, to provide our global mobility services, we must share certain data with trusted partners and professionals. This section describes the categories of recipients and the safeguards we apply to these disclosures.

5.1. SHARING WITH AUTHORIZED PROFESSIONALS (EXPERTS)

The core functionality of our Referral Tool involves transferring data to legal experts. This process is governed by a strict two-stage disclosure protocol to maximize privacy.

5.1.1. The Referral Workflow

• Stage 1 (Anonymized Case Summary): When a User initiates a referral, our system shares only non-identifying data with potential Experts.
  • Data shared: Country of residence, intended immigration program, summary of the legal issue, and relevant professional experience.
  • Purpose: To allow the Expert to conduct a conflict-of-interest check and determine if they have the capacity to assist.
• Stage 2 (Full Identified Disclosure): Only after an Expert formally accepts the request through our Platform are your identifiers released.
  • Data shared: Full Name, Email Address, Phone Number, and your complete CV or case documents.
  • Example: “If you request assistance for a Study Permit, we share your anonymized case profile with a lawyer specialized in student immigration. Your contact info is only released once they click ‘Accept’.”

5.1.2. Responsibilities of the Authorized Professional

Experts who receive data via ImmiTalents are independent data controllers. However, by joining our network, they contractually agree to:

• Confidentiality: Maintain the absolute confidentiality of the information provided, consistent with their professional code of ethics and solicitor-client privilege.
• Timely Contact: Obligation to contact the User within ten (10) business days of receiving the Stage 2 disclosure.
• Privacy Compliance: Adhere to their own privacy policies and applicable data protection laws in their jurisdiction.

5.2. SHARING WITH EDUCATIONAL INSTITUTIONS (SCHOOL DIRECTORY)

For Users seeking educational opportunities in Canada, data sharing is initiated purely by the User.

5.2.1. Academic Data Transmission

If you use our School Directory to request information or apply to a program, we may transmit:

• Academic Profile: Grades, transcripts, and diplomas.
• Statement of Purpose: Letters of intent or motivation provided during the intake.

5.2.2. Explicit Consent Required

Sharing with schools is never automated. You must provide specific, granular consent by ticking a checkbox for each specific institution you wish to contact. You have the right to withdraw this consent at any time before the data is transmitted.

5.3. SHARING WITH SERVICE PROVIDERS (SUB-PROCESSORS)

ImmiTalents utilizes third-party infrastructure to deliver a secure and efficient Platform.

5.3.1. Technical Infrastructure Partners

We disclose data to the following categories of service providers:

• Hosting and Cloud Storage: We use Amazon Web Services (AWS) and/or Google Cloud Platform to host our databases and application code.
• Payment and Identity Verification: We use Stripe (including Stripe Identity) to process payments and verify the credentials of Experts and Employers.
• Analytics and Monitoring: We use Google Analytics and Mixpanel to track Platform performance and User behavior.
• Communication Tools: We use SendGrid or Amazon SES for automated email delivery.

5.3.2. Safeguards and Data Processing Agreements (DPA)

ImmiTalents enters into rigorous Data Processing Agreements (DPA) with every sub-processor. These agreements include:

• Standard Contractual Clauses (SCCs): To ensure protection for data transferred outside the EU/Quebec.
• Security Requirements: Mandating that sub-processors implement encryption, access controls, and regular audits.
• Purpose Limitation: Prohibiting sub-processors from using your data for their own marketing or any purpose other than providing the specific service to ImmiTalents.

5.4. LEGAL DISCLOSURES AND PUBLIC AUTHORITIES

In exceptional circumstances, ImmiTalents may be legally compelled to disclose your information.

5.4.1. Compliance with Law Enforcement

We may share data with government agencies or law enforcement (e.g., SPVM, RCMP, IRCC) if we receive a valid:

• Subpoena or Search Warrant: Issued by a court of competent jurisdiction.
• Production Order: Regarding an investigation into fraud or immigration violations.

5.4.2. Protection of Rights and Safety

We reserve the right to disclose Personal Information when we believe in good faith that such disclosure is necessary to:

• Detect, prevent, or address fraud, security breaches, or technical issues.
• Protect the rights, property, or safety of ImmiTalents, our Users, or the general public.
• Defend ImmiTalents against legal claims or lawsuits.

5.5. BUSINESS TRANSFERS AND RESEARCH

5.5.1. Mergers, Acquisitions, and Sales

In the event that ImmiTalents Inc. undergoes a corporate restructuring, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information may be among the assets transferred. We will notify you via email and a prominent notice on our Platform thirty (30) days prior to any such change in ownership.

5.5.2. Academic and Institutional Research

ImmiTalents may share data with universities or immigration research institutes for the purpose of improving global mobility policy.

• Mandatory Anonymization: Any data shared for research purposes is strictly anonymized and aggregated. No identifying information (names, emails) is ever shared with research partners.

5.6. SUCCESS RATE DATA REPORTING (CNESST COMPLIANCE)

To comply with the requirements of our CNESST Permit (No. AR-2504666) and the Regulation respecting personnel recruitment agencies, Experts must share anonymized case completion data with ImmiTalents. This data is used exclusively to report our success rate as an intermediary to regulatory authorities and to optimize matching logic.

SECTION 6: PAYMENT DATA AND FINANCIAL NEUTRALITY

This section outlines ImmiTalents Inc.’s policy regarding financial transactions and the processing of payment information. While ImmiTalents provides its core services free of charge to its current user base, we maintain rigorous standards for any financial data processed through our Platform.

6.1. PRINCIPLE OF FINANCIAL NEUTRALITY

6.1.1. Independence from Professional Fees

ImmiTalents acts solely as a technological facilitator. We do not process, collect, or manage payments related to the professional fees charged by Authorized Professionals (Experts) to Candidates or Employers. Any financial arrangement, retainer agreement, or billing for legal services occurs strictly outside of the ImmiTalents Platform.

6.1.2. Educational Institution Fees

Similarly, ImmiTalents does not collect tuition fees, application fees, or any other academic charges on behalf of educational institutions listed in our School Directory. Users are directed to the respective institutions for all financial transactions related to their studies.

6.1.3. Absence of Commissions from Candidates

ImmiTalents reaffirms its “Free-for-Talent” model. We do not deduct any percentage from a Candidate’s future salary, nor do we charge “success fees” for successful immigration outcomes or job placements.

6.2. PROCESSING OF PAYMENTS FOR PLATFORM SERVICES

In the event that ImmiTalents introduces paid value-added services (e.g., premium employer dashboards, featured expert listings, or document certification services), the following protocols apply:

6.2.1. Categories of Payment Data Collected

When a payment is initiated on the Platform, the following information may be processed:

• Billing Information: Legal name, billing address, and tax identification number (if applicable).
• Transaction Metadata: Date of purchase, amount, currency, and the specific service acquired.
• Limited Card Data: To facilitate renewals or support, our system may store only the last four digits of the credit card and the expiration date.

6.2.2. Use of Third-Party Payment Processors (Stripe)

ImmiTalents does not store full credit card numbers or CVV codes on its own servers. All payments are processed through Stripe, a secure, PCI-DSS compliant third-party gateway.

• Tokenization: Your payment information is “tokenized” by Stripe. This means ImmiTalents receives a secure digital “token” that allows us to process the transaction without ever seeing or storing your actual financial credentials.
• Direct Interaction: When you enter payment details, you are interacting directly with Stripe’s secure interface, even if it appears integrated into our Platform.

6.3. SECURITY STANDARDS FOR FINANCIAL DATA

6.3.1. PCI-DSS Compliance

We ensure that our infrastructure and our integration with Stripe comply with the Payment Card Industry Data Security Standard (PCI-DSS). This involves regular security scans and the implementation of robust encryption (TLS 1.2 or higher) for all data in transit.

6.3.2. Access Controls

Access to billing information and transaction history within ImmiTalents is restricted to a limited number of authorized personnel in the accounting and legal departments, strictly on a “need-to-know” basis.

6.4. FRAUD PREVENTION AND DETECTION

To protect the Platform and our Users from financial crimes, we implement automated fraud detection measures.

6.4.1. Monitoring and KYB/KYC Integration

We cross-reference payment data with the identity information provided during the account verification process (Know Your Business/Know Your Customer). Discrepancies between billing information and verified identity may trigger an account review.

6.4.2. Reporting to Authorities

In accordance with Canadian anti-money laundering (AML) and anti-fraud regulations, ImmiTalents reserves the right to report suspicious transactions to relevant financial authorities (e.g., FINTRAC) or law enforcement agencies.

6.5. RETENTION OF FINANCIAL RECORDS

6.5.1. Legal and Tax Obligations

Personal Information related to financial transactions is retained for a period of seven (7) years following the end of the fiscal year in which the transaction occurred. This retention is mandatory to comply with the Income Tax Act (Canada) and the Taxation Act (Quebec).

6.5.2. Post-Retention Deletion

Once the statutory retention period has expired, billing data that is no longer required for legal or security purposes is permanently deleted or anonymized.

6.6. RIGHT TO MODIFY PRICING POLICIES

As stated in the Terms of Use, ImmiTalents reserves the right to change its pricing model. Should the Platform transition from its current free model to a subscription or fee-based model for certain features, this Section 6 will be updated to reflect the new data collection categories, and Users will be notified in accordance with the procedures outlined in Section 1.5.

SECTION 7: DATA RETENTION AND DELETION

ImmiTalents adheres to the principle of storage limitation. We retain Personal Information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements.

7.1. DETAILED RETENTION SCHEDULE

The following table outlines our standard retention periods based on the type of data and the legal or technical justification for its storage:

7.2. EARLY DELETION AND THE “RIGHT TO BE FORGOTTEN”

7.2.1. User-Initiated Deletion Procedure

Users have the right to request the early deletion of their Personal Information at any time. To do so:

1. Direct Action: You can use the “Delete Account” function in your profile settings.
2. Written Request: You may email our Data Protection Officer at info@immitalents.com with the subject line “Data Erasure Request.”
3. Confirmation: Once a request is verified, ImmiTalents will process the deletion within thirty (30) days. You will receive a final confirmation email once the process is complete.

7.2.2. Effects of Deletion

Upon deletion:

• Your profile, CV, and all personal identifiers are removed from our production databases.
• Your RefID history is anonymized, removing any link to your identity.
• Any shared documents with Experts or Employers remain subject to the retention policies of those independent controllers.

7.3. EXCEPTIONS TO DELETION REQUESTS

ImmiTalents may be legally required to deny a deletion request or retain specific portions of your data in the following cases:

• Legal Hold: If the data is necessary for an ongoing or anticipated legal proceeding, investigation, or litigation.
• Regulatory Compliance: As noted in the schedule above, financial records must be kept for seven years regardless of an account deletion request.
• Security & Fraud: If the data is required to detect security incidents, protect against malicious/fraudulent activity, or prosecute those responsible for such activity.
• Public Interest/Research: If the data is used for aggregated academic research or statistical purposes, provided it is fully anonymized.

7.4. POST-RETENTION DATA DISPOSAL

7.4.1. Irreversible Deletion

Once the applicable retention period has expired (or an early deletion request has been fulfilled), Personal Information is permanently deleted from our servers.

7.4.2. Backup Rotation

Please note that data may persist in our encrypted secure backups for an additional period (typically 60 to 90 days) until the backup rotation cycle completes. During this interval, the data is not accessible for operational use.

7.4.3. Anonymization as an Alternative

In certain cases, rather than deleting data, ImmiTalents may choose to irreversibly anonymize it. Once anonymized, the data can no longer be linked to you and may be used for statistical analysis and service improvement indefinitely.

SECTION 8: SECURITY MEASURES AND DATA BREACH PROTOCOL

Protecting the sensitive information related to your immigration and career projects is ImmiTalents’ highest priority. This section details our comprehensive security framework and our commitment to transparency in the event of an incident.

8.1. MULTI-LAYERED SECURITY MEASURES

ImmiTalents implements a combination of technical, organizational, and physical safeguards to protect Personal Information against loss, theft, and unauthorized access.

8.1.1. Technical Security Measures

Our engineering team utilizes industry-standard technologies to secure our digital infrastructure:

• Encryption in Transit: All communications between your device and our servers are encrypted using Secure Socket Layer (SSL/TLS 1.2 or higher) protocols.
• Encryption at Rest: Sensitive data, including passwords and identified documents, is stored using high-grade AES-256 encryption.
• Robust Firewalls & WAF: We employ Web Application Firewalls (WAF) to detect and block malicious traffic, SQL injections, and Cross-Site Scripting (XSS) attempts.
• Regular Penetration Testing: At least annually, we engage third-party security firms to perform “ethical hacking” or intrusion tests to identify and patch vulnerabilities.
• Multi-Factor Authentication (MFA): To access sensitive platform features (especially for Experts and Employers), MFA is required to add an extra layer of identity verification.

8.1.2. Organizational Security Measures

Security is an integral part of our corporate culture and internal governance:

• Principle of Least Privilege: Access to User data within ImmiTalents is strictly restricted to employees whose job functions absolutely require it.
• Security Awareness Training: All ImmiTalents staff undergo mandatory quarterly training on data privacy, phishing prevention, and the requirements of Quebec’s Law 25.
• Confidentiality Agreements: Every employee and contractor must sign a binding non-disclosure agreement (NDA) that persists even after their employment ends.
• Internal Audits: We maintain access logs for all database interactions and conduct periodic audits to ensure compliance with our internal security policies.

8.1.3. Subcontractor and Third-Party Security

When we collaborate with sub-processors (as listed in Section 5), we apply a rigorous vetting process:

• Certification Standards: We prioritize partners who hold recognized certifications, such as ISO/IEC 27001 or SOC 2 Type II.
• Contractual Enforcement: All service providers must sign a Data Processing Agreement (DPA) that mandates the same (or higher) level of protection as ImmiTalents provides.
• Regular Reviews: We periodically review the security posture and compliance reports of our critical infrastructure providers.

8.2. DATA BREACH AND CONFIDENTIALITY INCIDENT PROTOCOL

In the unfortunate event of a “Confidentiality Incident” (as defined by Law 25) or a “Personal Data Breach” (under GDPR), ImmiTalents follows a strictly defined response protocol.

8.2.1. Detection and Immediate Response

We utilize automated monitoring tools that alert our dedicated Security Response Team (SRT) in real-time to suspicious activity. Upon detection of a potential incident:

• Containment: We immediately isolate affected systems to prevent further data loss.
• Investigation: We perform a forensic analysis to determine the source, scope, and nature of the breach.

8.2.2. Risk Assessment

In accordance with Law 25, we assess whether the incident presents a “risk of serious injury” to the affected Users. Criteria for this assessment include:

• The sensitivity of the information concerned (e.g., identity documents vs. job titles).
• The likelihood that the information could be used for ill-intentioned purposes (e.g., identity theft).
• The extent of the breach (number of individuals affected).

8.2.3. Mandatory Notifications and Timelines

If the assessment determines a serious risk, ImmiTalents will proceed with the following notifications:

• To Regulatory Authorities: We will notify the Commission d’accès à l’information du Québec (and other relevant bodies like the CNIL if EU residents are affected) as soon as possible, and no later than 72 hours after becoming aware of the incident.
• To Affected Users: We will notify you without undue delay. This notification will be sent via the primary email address associated with your account and may be supplemented by a notice on the Platform.

8.2.4. Content of the Notification

Our communications regarding an incident will be clear and include:

• A description of the incident and when it occurred.
• The categories of data involved.
• The measures taken by ImmiTalents to mitigate the risk.
• Recommended steps for you to protect yourself (e.g., changing passwords or monitoring credit files).
• Contact details for our Privacy Officer for further questions.

8.2.5. Concrete Scenario Examples

• Scenario A: Unauthorized access to CV database. If we detect that a malicious actor has accessed the Candidate database, we will contact all Candidates via email, providing specific guidance on how to detect and prevent identity theft, even if the risk is deemed low.
• Scenario B: Individual Account Compromise. If we detect suspicious login activity on your specific account, we will immediately suspend the account and require you to complete a secure identity verification and password reset before regaining access.

SECTION 9: USER RIGHTS AND DATA SUBJECT REQUESTS

ImmiTalents Inc. empowers its Users with extensive rights over their Personal Information. We provide clear mechanisms for you to control, modify, and protect your digital footprint within our ecosystem, in full compliance with Quebec’s Law 25 and the GDPR.

9.1. RIGHT OF ACCESS AND TRANSPARENCY

You have the right to know whether ImmiTalents holds Personal Information about you and to obtain a copy of that information in a readable format.

9.1.1. Access Procedure

To request a copy of your data:

1. Form: Submit a written request to our Data Protection Officer (DPO) at info@immitalents.com.
2. Identity Verification: To prevent unauthorized access to your file, we will require proof of identity before processing the request.
3. Response Delay: ImmiTalents will respond to your access request within thirty (30) days. If the request is complex, we may extend this period by an additional thirty days, notifying you of the delay.

9.1.2. Scope of Access

The access report includes the categories of data processed, the purposes of processing, the categories of recipients (e.g., Experts or Employers), and the origin of the data if not collected directly from you.

9.2. RIGHT TO RECTIFICATION

Accuracy is essential for successful matching and legal compliance. You have the right to request the correction of any inaccurate or incomplete Personal Information.

9.2.1. Self-Service Correction

Most information, including your contact details, CV, and professional history, can be modified directly by you through your Profile Settings.

9.2.2. DPO Assistance

If you are unable to modify specific technical or identity data via the interface, you may contact our DPO. Once the accuracy of the new information is verified, ImmiTalents will update its records and notify any third parties (such as sub-processors) who previously received the incorrect data.

9.3. RIGHT TO ERASURE (THE RIGHT TO BE FORGOTTEN) AND DE-INDEXING

You may request the deletion of your Personal Information or the removal of links pointing to your profile.

9.3.1. Erasure Procedure

• Conditions: You can request erasure if the data is no longer necessary for the original purposes, if you withdraw your consent, or if you believe the processing is unlawful.
• Example: “If your CV is obsolete or you have successfully migrated and no longer need our services, you may request the total deletion of your profile and historical data.”
• De-indexing: In certain jurisdictions (like Quebec or the EU), you have the right to request that your profile be “de-indexed” from internal search engines or public directories to minimize your digital visibility.

9.4. RIGHT TO DATA PORTABILITY

To facilitate your mobility, ImmiTalents allows you to transfer your data to other service providers.

9.4.1. Portable Formats

Upon request, we will provide you with a copy of the data you provided to us in a structured, commonly used, and machine-readable format.

• Standard Formats: We typically provide data in JSON or CSV formats to ensure interoperability.
• Direct Transfer: Where technically feasible, you may request that we transmit this data directly to another controller of your choice.

9.5. RIGHT TO WITHDRAW CONSENT

ImmiTalents relies on your consent for many of its core features. You have the right to withdraw this consent at any time.

9.5.1. Operational Impact

Please be aware that withdrawing consent for specific processing operations will directly impact your ability to use the Platform’s services.

• Matching Service: If you withdraw consent for professional profiling, the automated matching algorithm will be deactivated, and you will no longer receive job suggestions.
• Expert Search Loop: If you withdraw consent for the sequential disclosure process, the Referral Tool will cease to function for your account.

9.6. RIGHT TO OBJECT AND RESTRICT PROCESSING

You have the right to object to the processing of your data for specific purposes.

9.6.1. Marketing and Newsletters

You can object to receiving marketing communications at any time. Every newsletter or promotional email from ImmiTalents includes a “Unsubscribe” link. You can also manage these preferences in your account dashboard.

9.6.2. Profiling and Automated Decisions

You may object to profiling or automated decision-making that significantly affects you. While ImmiTalents uses matching algorithms, we maintain a human-in-the-loop approach for final employment and legal connections.

9.7. HOW TO EXERCISE YOUR RIGHTS

To exercise any of the rights described above, please follow these steps:

1. Email: Send your request to info@immitalents.com.
2. Detail: Specify which right you are exercising (e.g., “Request for Data Access” or “Objection to Marketing”).
3. Identity Proof: Attach a scan of a government ID or perform the identity verification via our secure link.
4. Verification and Processing: ImmiTalents will verify the legitimacy of the request and provide a response, free of charge (unless the request is manifestly unfounded or excessive), within the legal timeframes mentioned in Section 9.1.1.

SECTION 10: INTERNATIONAL DATA TRANSFERS AND CROSS-BORDER COMPLIANCE

ImmiTalents Inc. is a globally focused platform headquartered in Montreal, Quebec, Canada. To provide our free international mobility and referral services, your Personal Information may be transferred to, stored in, or processed in jurisdictions outside of your country of residence.

10.1. GLOBAL INFRASTRUCTURE AND DATA RESIDENCY

10.1.1. Primary Storage Location (Quebec/Canada)

The majority of our production databases and application logic reside on secure cloud servers located in the Canada (Central) region (primarily in Montreal or Toronto). This ensures that data is subject to the rigorous protection standards of Quebec’s Law 25 and Canada’s PIPEDA.

10.1.2. Secondary Storage and Sub-processors (USA)

To maintain the high availability and security features of our free service (such as CDN acceleration, DDoS protection, and identity verification via Stripe), some data may be processed in the United States.

• Note: While the US may have different data protection laws than your home country, ImmiTalents ensures that all US-based sub-processors provide an “adequate level of protection” through the safeguards mentioned in Section 10.2.

10.2. LEGAL SAFEGUARDS FOR CROSS-BORDER TRANSFERS

In compliance with Law 25 (specifically regarding transfers outside of Quebec) and the GDPR (Chapter V), ImmiTalents implements the following mechanisms:

10.2.1. Privacy Impact Assessments (PIA)

Before transferring any Personal Information outside of Quebec or the European Economic Area (EEA), ImmiTalents conducts a Privacy Impact Assessment. This assessment evaluates:

• The sensitivity of the data being transferred.
• The legal framework of the recipient country.
• The security measures implemented by the recipient. We only proceed with the transfer if the assessment confirms that the information will benefit from protection equivalent to that provided under Quebec law.

10.2.2. Standard Contractual Clauses (SCCs)

For transfers to countries not recognized as providing an “adequate” level of protection by the European Commission or Quebec authorities, we utilize Standard Contractual Clauses. These are binding legal agreements that commit the recipient to maintaining high privacy standards and providing Users with enforceable rights and effective legal remedies.

10.2.3. Adequacy Status of Canada

Users from the European Union (EU) should note that the European Commission has officially recognized Canada as providing an adequate level of data protection for commercial organizations under PIPEDA. This facilitates the secure flow of data from Europe to our Montreal-based servers.

10.3. TRANSFERS NECESSARY FOR THE REFERRAL SERVICE

10.3.1. International Expert Matching

By using our proprietary Referral Tool, you acknowledge that your data may necessarily be transferred to an Authorized Professional located in your target destination (e.g., a lawyer in Ontario, British Columbia, or Europe).

• The “Necessity” Basis: This transfer is essential for the performance of the service you have requested (connecting you with legal representation).
• Controlled Disclosure: As detailed in Section 5.1, we minimize risk by only sharing identified data (Stage 2) once a specific Expert in that jurisdiction has been selected.

10.4. DATA ACCESS BY INTERNATIONAL PERSONNEL

While our primary servers are in Canada, authorized ImmiTalents personnel or contractors located in other regions may access technical logs or support data to provide 24/7 technical assistance.

• Encryption: Such access is performed through secure, encrypted tunnels (VPN/TLS) and is subject to the “Principle of Least Privilege” (Section 8.1.2).
• No Local Storage: International personnel are strictly prohibited from downloading or storing User Personal Information on local, unmanaged devices.

10.5. USER CONSENT FOR TRANSFERS

By creating an account and utilizing our Platform, you explicitly consent to the transfer of your Personal Information to Canada, the United States, and other jurisdictions as required to fulfill our service commitments. You have the right to withdraw this consent; however, doing so will require the closure of your account as the Platform’s global matching logic cannot function without cross-border data flows.

SECTION 11: PROTECTION OF MINORS (CHILDREN’S PRIVACY)

ImmiTalents Inc. is committed to the safety and privacy of young individuals. Our Platform is strictly intended for professionals and adults managing career and migration projects.

11.1. MINIMUM AGE REQUIREMENT

11.1.1. General Rule

The use of ImmiTalents is strictly prohibited for individuals under the age of sixteen (16). We do not knowingly collect, solicit, or maintain Personal Information from anyone under this age threshold. This policy aligns with the stringent requirements of the General Data Protection Regulation (GDPR) and Canadian privacy standards.

11.1.2. Age Verification during Registration

During the account creation process, ImmiTalents collects the User’s date of birth. If the information provided indicates that the individual is under 16, the registration process will be immediately terminated, and any temporary data entered will be purged from our systems.

11.2. REPORTING AND REMEDIATION PROTOCOL

11.2.1. Signalment of a Minor User

If you are a parent, legal guardian, or a concerned third party and you suspect that a minor under 16 has bypassed our restrictions to create an account or provide Personal Information, please contact us immediately at info@immitalents.com.

11.2.2. Investigation and Deletion

Upon receiving a credible report regarding a minor user:

1. Immediate Suspension: The account will be frozen to prevent further data processing or communication.
2. Verification: We will conduct an internal audit to confirm the age of the user.
3. Mandatory Erasure: If confirmed to be under 16, all associated Personal Information, profiles, and documents will be permanently deleted from our active databases and backup archives within forty-eight (48) hours.
4. Notification: We will confirm the completion of the deletion to the reporting party.

11.3. PARENTAL AND GUARDIAN RESPONSIBILITY

11.3.1. Supervision of Online Activity

While ImmiTalents employs technical barriers, we rely on parents and guardians to supervise their children’s online behavior. The nature of the Platform involves the exchange of sensitive legal and professional data that is not suitable for minors.

11.3.2. Liability for Misrepresentation

Parents or guardians are legally responsible for the actions of their children. If a minor gains access to the Platform through a fraudulent representation of their age, ImmiTalents reserves the right to terminate the account without notice and denies any liability for loss of data.

11.4. EXCEPTIONS FOR FAMILY IMMIGRATION MATTERS

In limited circumstances, an Authorized Professional may need to process data concerning a minor (e.g., as part of a family sponsorship application or a study permit for a dependent). In these cases:

• The data must be provided exclusively by the parent or legal guardian through the guardian’s verified adult account.
• The guardian must provide explicit written consent for the processing of the minor’s data as part of the legal mandate facilitation.
• ImmiTalents processes such data only as a technical intermediary between the guardian and the selected Expert.

SECTION 12: IMPORTANT LEGAL DISCLAIMER AND NO LAWYER-CLIENT RELATIONSHIP

ImmiTalents Inc. operates exclusively as a technology-based service provider. To ensure a clear understanding of our role and to protect both the Company and our Users, we provide the following mandatory legal disclaimers.

12.1. IMMITALENTS IS NOT A LAW FIRM

12.1.1. Absence of Professional Legal Status

ImmiTalents Inc. is a digital matching and recruitment platform. We are not a law firm, a notary office, or a regulated immigration consultancy. We do not practice law, and we are not authorized to provide legal representation or advocate on your behalf before any government body or tribunal.

12.1.2. No Solicitor-Client Relationship

Your use of the Platform—including the creation of a profile, the submission of data through the Referral Tool, or communication with our support team—does not create a solicitor-client (or lawyer-client) relationship between you and ImmiTalents Inc. Such a privileged relationship is only established when you enter into a formal, written mandate or retainer agreement directly with an Authorized Professional (Expert) who has accepted your case.

12.1.3 NON-ADVOCACY STATUS OF TOOLS

The Immigration Pathway Tracker (Milestone Assistant) is strictly a documentary and logistical tool. Logistical information provided by the Tracker is based on general public data and does not constitute legal advice or the opening of an immigration file. ImmiTalents is a technology platform, and final decisions regarding legal pathways are the responsibility of the User and their selected Expert.

12.2. NO LEGAL ADVICE PROVIDED

12.2.1. General Information Purpose

All content provided on the Platform, including but not limited to guides, blog articles, checklists, visa eligibility simulations, and AI-generated matching summaries, is for informational and documentary purposes only. This information should not be construed as legal advice or as a substitute for the professional judgment of a qualified lawyer or consultant.

12.2.2. Examples of Non-Legal Advice

To clarify, the following activities on our Platform do not constitute legal advice:

• Automated tools that suggest which immigration programs might correspond to your profile.
• Informational summaries regarding the required documents for a specific visa category.
• General career advice or matching scores between your CV and a job offer.
• Communication from ImmiTalents support staff regarding technical platform usage.

12.3. NO GUARANTEE OF SUCCESS OR OUTCOME

12.3.1. Governmental Discretion

Immigration decisions are made exclusively by government authorities (such as IRCC in Canada or MIFI in Quebec). ImmiTalents has no influence over these decisions. Consequently, the use of our Platform or our Referral Tool does not guarantee that you will obtain a visa, a permit, or any legal status.

12.3.2. Employment Outcomes

Similarly, ImmiTalents does not guarantee that a Candidate will be hired by an Employer or that a job offer will remain active. The final decision to hire resides solely with the Employer.

12.3.3. Expert Performance

While we vet Experts for their active credentials, ImmiTalents does not guarantee the quality or the results of the legal work performed by the Experts in our network. Any claim regarding professional negligence or the outcome of a legal file must be addressed directly to the Expert or their professional liability insurer.

12.4. INDEPENDENCE OF AUTHORIZED PROFESSIONALS

The Authorized Professionals in our referral network are independent practitioners. They are not employees, agents, or partners of ImmiTalents Inc. They are solely responsible for their own professional conduct, the accuracy of their advice, and their compliance with their respective codes of professional ethics.

12.5. USER RESPONSIBILITY

You are responsible for conducting your own due diligence before engaging an Expert or signing an employment contract. You acknowledge that relying on general information from the Platform is at your own risk.

ECTION 13: CONTACT INFORMATION AND DATA PROTECTION OFFICER (DPO)

If you have any questions about this Privacy Policy, our data handling practices, or if you wish to exercise your rights as described in Section 9, ImmiTalents Inc. provides multiple channels for communication.

13.1. HOW TO REACH US

For general inquiries regarding privacy or to report a technical issue, you may contact our head office:

• Corporate Address: ImmiTalents Inc. Attn: Legal Department 1100 Boul Crémazie E, 8th Floor Montreal, Quebec, H2P 2X2, Canada
• General Support Email: info@immitalents.com

13.2. DATA PROTECTION OFFICER (DPO) / PRIVACY OFFICER

In accordance with Quebec’s Law 25 and the GDPR, ImmiTalents has designated a Privacy Officer (Data Protection Officer) who is responsible for overseeing our privacy strategy and ensuring compliance with all applicable laws.

You may contact the DPO directly for matters related to the exercise of your data rights or to report a confidentiality incident:

• Name: Privacy Officer
• Email: info@immitalents.com

13.3. EXERCISE OF RIGHTS AND RESPONSE STANDARDS

13.3.1. Formal Requests

Any request for access, rectification, or deletion should be sent via email to info@immitalents.com. For security reasons, we will only process requests sent from the email address associated with your account, and we may require additional proof of identity.

13.3.2. Response Delays

• Standard Requests: We aim to respond to all legitimate requests within thirty (30) days of receipt.
• Complex Requests: If your request is particularly complex or if you have submitted multiple requests, we may extend this period by an additional thirty days. In such cases, we will notify you of the delay within the initial 30-day window.

13.4. COMPLAINT MANAGEMENT AND REGULATORY RECOURSE

13.4.1. Internal Complaint Procedure

If you are dissatisfied with our handling of your Personal Information or our response to a rights request, we encourage you to contact our DPO first to attempt a resolution. We will investigate your complaint thoroughly and provide a written explanation of our findings.

13.4.2. External Recourse

If you remain unsatisfied after our internal investigation, you have the right to lodge a formal complaint with the competent supervisory authority in your jurisdiction:

• In Quebec (Canada):
  • Commission d’accès à l’information du Québec (CAI)
  • Website: www.cai.gouv.qc.ca
• In Canada (Federal):
  • Office of the Privacy Commissioner of Canada (OPC)
  • Website: www.priv.gc.ca
• In the European Union:
  • You may contact your local Data Protection Authority (e.g., the CNIL in France, or the DPC in Ireland).

• (END OF PRIVACY POLICY)