01.Scope, Identity & Enterprise Commitment
OrbixOverseas ("Orbix", "we", "us", or "the Platform") is an international immigration technology software provider. We license our proprietary case orchestration infrastructure, document vaulting systems, eligibility calculators, and applicant intake portals to registered immigration consultants, legal attorneys, global mobility enterprises, and education consultancies ("Agency Clients" or "Data Controllers").
In the course of delivering our services, Orbix operates primarily as a Data Processor under GDPR Article 28 and equivalent global statutes, processing information on behalf of our Agency Clients who act as Data Controllers. With respect to administrative agency account billing, direct consultations, and platform telemetry, Orbix acts as an independent Data Controller.
Immigration records contain sensitive personal identifiers. We do not sell, rent, lease, monetize, or disclose client or applicant personal information to advertising networks, commercial brokers, or algorithmic aggregators.
02.Granular Categories of Data Collected
To facilitate visa applications, embassy lodgements, and government document compliance, the following categories of data are ingested into our encrypted vaults:
A. Biographical & Identity Records
Full legal names, alias names, dates of birth, places of birth, nationality, citizenship status, marital status, national ID numbers, and machine-readable passport zones (MRZ).
B. Immigration History & Submissions
Previous visa refusals, travel history records, consular stamps, designated learning institution (DLI) acceptance letters, Labour Market Impact Assessments (LMIA), Certificates of Sponsorship (CoS), and Expression of Interest (EOI) profiles.
C. Educational & Employment Credentials
University transcripts, degree certificates, Educational Credential Assessments (ECA), resume portfolios, employment reference letters, and language competency scorecards (IELTS, PTE, TOEFL, CELPIP).
D. Financial Evidentiary Files
Bank statements, Guaranteed Investment Certificates (GIC), proof of liquid funds, taxation assessments, property valuations, and sponsorship affidavits required for visa eligibility audits.
E. System Telemetry & Forensic Audit Logs
IP addresses, login timestamps, device fingerprints, API invocation signatures, role-based document access events, and cryptographic hashes of uploaded records to guarantee tamper-proof audit trails.
03.Legal Basis & Purpose of Processing
Under Article 6 of the General Data Protection Regulation (GDPR) and international privacy frameworks, Orbix processes information solely pursuant to lawful bases:
- Contractual Performance (Art. 6(1)(b)): Delivering case intake, document checklist validation, automated application packaging, and client communication workflows.
- Legal & Regulatory Compliance (Art. 6(1)(c)): Assisting licensed immigration counsel in complying with mandatory record retention mandates enacted by immigration tribunals (e.g., IRCC, UKVI, Department of Home Affairs, USCIS).
- Legitimate Interests (Art. 6(1)(f)): Maintaining cybersecurity monitoring, fraud detection, credential abuse prevention, and enterprise service optimization.
04.Cryptographic Storage & Defense-In-Depth
Orbix enforces security protocols modeled after SOC-2 Type II standards:
Every uploaded file is stored in encrypted private buckets with distinct per-file cryptographic keys managed via AWS KMS hardware security modules.
All network traffic between applicant browsers, agency portals, and API endpoints is protected by strict TLS 1.3 with Perfect Forward Secrecy (PFS) and HSTS.
Postgres Row-Level Security (RLS) policies enforce strict cryptographic separation between agencies, ensuring cross-tenant queries are structurally impossible.
Granular permission tiers (Agency Admin, Senior Legal Counsel, Case Assistant, Client) with biometric or TOTP authenticator authentication.
05.Verified Enterprise Sub-processors
Orbix works exclusively with premier cloud providers under binding Data Processing Agreements:
| PROVIDER | PURPOSE | DATA LOCATION |
|---|---|---|
| Amazon Web Services (AWS) | Encrypted Cloud Hosting & S3 Vaults | Canada / US / EU Sovereign Zones |
| Meta Cloud API (WhatsApp) | Encrypted Status Updates & Telemetry | Global Infrastructure |
| Stripe / Razorpay | PCI-DSS Tokenized Payment Processing | North America / Europe / Asia |
| Twilio / SendGrid | Transactional Email & Biometric Alerts | United States / EU |
06.Data Retention, Portability & Cryptographic Shredding
Customer Data is retained for the active duration of the agency license. Because immigration law requires legal practitioners to maintain case archives for statutory audit periods (commonly 5 to 7 years depending on jurisdiction), Orbix provides:
- One-Click Case Portability: Agencies can generate an encrypted ZIP export containing all applicant PDFs, communication histories, and status logs at any time.
- Account Deletion & Cryptographic Shredding: Upon contract termination and written notice, Orbix permanently overwrites and deletes all customer records within 30 days, following DoD 5220.22-M sanitization standards.
07.Your Legal Rights (GDPR, PIPEDA, CCPA)
Regardless of geographical location, every applicant whose data is stored within OrbixOverseas retains statutory rights to:
08.Contact Our Data Protection Office
For questions regarding this policy, to request a Data Processing Addendum (DPA), or to exercise statutory privacy rights: