Who we are
This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our website and services.
- Controller
- XIPHIAS Immigration Private Limited, Bengaluru, Karnataka, India
- Data Protection Officer
- Not applicable. Contact our Privacy Team at [email protected].
- India: Grievance Officer
- [email protected] (we aim to respond within statutory timelines)
What we collect & why we collect it
We collect the following categories of data for the purposes described below.
| Data category | Purpose | Legal basis / CPRA | Retention | Recipients |
|---|---|---|---|---|
| Account & contact | Create/manage your account; respond to enquiries. | Contract; legitimate interests (service operations). | For as long as you have an account + 24 months. | Hosting, CRM, support vendors. |
| Usage & device | Analytics; improve performance and UX. | Consent (cookies/SDKs) where required; legitimate interests. | 12–24 months aggregated. | Analytics providers, A/B testing tools. |
| Marketing preferences | Send newsletters and offers; measure effectiveness. | Consent (opt-in); right to withdraw at any time. | Until you unsubscribe + 24 months logs. | Email service providers; advertising partners. |
| Support & chat transcripts | Troubleshoot issues; quality assurance. | Legitimate interests; contract. | Up to 36 months unless required longer. | Customer support platforms. |
Sensitive personal information (SPI) handling
We do not intentionally collect SPI (e.g., government IDs) unless you provide it for compliance. Where collected, we restrict use, apply additional safeguards, and honor CPRA’s right to limit use of SPI.
International disclosures
If we transfer data outside your jurisdiction, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
Your privacy rights
EU/UK (GDPR)
Access, rectify, erase, restrict, object, and data portability; lodge a complaint with a supervisory authority.
California (CCPA/CPRA)
Right to know/delete/correct, opt‑out of sale/share, and limit use of sensitive personal information.
India (DPDP)
Withdraw consent, access/correct/erase, grievance redressal; nominate an alternate contact for rights requests.
To exercise your rights, email [email protected]. We may request additional information to verify your identity and will respond within applicable timelines.
International data transfers
Where we transfer personal data across borders, we implement safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful mechanisms. You can request a copy of relevant safeguards by contacting us.
How we secure your data
- Encryption in transit; restricted access on a need‑to‑know basis.
- Vendor due diligence and contractual controls.
- Organizational measures: policies, training, and incident response.
No method of transmission or storage is 100% secure. We will notify users and/or regulators where required by law in the event of a breach.
Children’s privacy
Our services are not directed to children. If you believe a child provided personal data, contact us so we can take appropriate action. Where parental consent is required, we will not process a child’s data without verifiable consent.
Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email and/or a prominent notice on our site. The date at the top indicates when this policy was last updated.
Version history
- v1.0 — 09 Oct 2025: Initial publication.
Contact us
General privacy enquiries
Email: [email protected]
Address: XIPHIAS Immigration Private Limited, Bengaluru, Karnataka, India
India grievance officer
Email: [email protected]
We aim to acknowledge queries promptly and resolve them within statutory timelines.
This page is provided for informational purposes and does not constitute legal advice. Consult counsel to tailor it to your operations, vendors, and jurisdictions.