Privacy Policy

1. Introduction

Sindhu & Partners is committed to protecting and respecting your privacy. We understand the importance of safeguarding personal information and maintaining the trust and confidence of our clients, prospective clients, business contacts and website users.

This Privacy Notice explains how we collect, use, disclose, retain and protect personal information when you:

• visit our website;
• instruct us to provide legal or immigration services;
• contact us for information or advice;
• subscribe to our updates or communications; or
• otherwise interact with us.

This Privacy Notice has been prepared in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable privacy laws.

2. Who We Are

"Sindhu & Partners" is the trading name used for the professional services group comprising:

Sindhu Immigration Services
An organisation regulated by the Immigration Advice Authority ("IAA").

References in this Privacy Notice to "Sindhu & Partners", "we", "our" or "us" refer to the relevant entity providing services to you.

Where required by law, the relevant entity acting on your matter will be the Data Controller of your personal information.

For data protection enquiries, please contact:

Data Protection Officer
Sasuie Abbas Leghari

Email: sasuie.leghari@sindhuimmigrationltd.co.uk
Telephone: 0203 560 3315
Address: Ground Floor, Cobham House, 9 Warwick Court, London, WC1R 5DJ

3. Information We Collect

Depending upon the nature of our relationship with you, we may collect and process the following information.

Identity Information

• Full name
• Date of birth
• Nationality
• Gender
• Passport details
• Biometric residence permit details
• Immigration status
• Photographic identification

Contact Information

• Residential address
• Postal address
• Email address
• Telephone numbers

Immigration and Legal Matter Information

• Visa history
• Immigration applications
• Refugee and asylum information
• Human rights claims
• Family circumstances
• Employment history
• Educational records
• Travel history
• Home Office correspondence
• Court and tribunal documents

Financial Information

• Bank details
• Payment records
• Billing information
• Source of funds information
• Anti-money laundering verification information

Technical Information

When you use our website, we may collect:

• IP addresses
• Browser information
• Device information
• Website usage data
• Cookie identifiers

Marketing Information

• Communication preferences
• Event registrations
• Newsletter subscriptions

4. Special Category Data

Due to the nature of our legal and immigration services, we may process special category personal data, including:

• racial or ethnic origin;
• religious or philosophical beliefs;
• trade union membership;
• health and medical information;
• biometric information;
• sexual orientation (where relevant to immigration or legal matters);
• genetic information;
• information concerning criminal allegations, convictions or offences.

We only process such information where legally permitted and necessary for the provision of our services, compliance with legal obligations, establishment or defence of legal claims, or where explicit consent has been obtained.

5. How We Collect Personal Information

We may collect personal information from:

You Directly

When you:

• instruct us;
• complete enquiry forms;
• attend meetings;
• communicate with us by telephone, email or post.

Third Parties

Including:

• family members;
• employers;
• referees;
• interpreters;
• expert witnesses;
• barristers;
• other professional advisers;
• recruitment agencies.

Government and Regulatory Bodies

Including:

• UK Visas and Immigration (UKVI);
• the Home Office;
• HM Courts and Tribunals Service;
• local authorities;
• the Immigration Advice Authority.

Public Sources

Including:

• Companies House;
• Land Registry;
• court records;
• sanctions databases;
• publicly available websites.

6. Lawful Bases for Processing

We process personal information only where permitted by law.

The lawful bases we rely upon include:

Contract

Where processing is necessary to provide legal or immigration services requested by you.

Legal Obligation

Where we are required to comply with legal or regulatory requirements.

Legitimate Interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights.

Examples include:

• managing our business;
• improving our services;
• maintaining website security;
• preventing fraud;
• risk management.

Consent

Where consent is required by law.

You may withdraw consent at any time, although this may affect our ability to provide services.

Legal Claims

Where processing is necessary for the establishment, exercise or defence of legal claims.

7. How We Use Your Information

We may use your personal information to:

• provide legal and immigration advice;
• assess your eligibility for services;
• prepare applications, representations and appeals;
• communicate with government bodies and tribunals;
• verify identity;
• comply with anti-money laundering requirements;
• maintain client records;
• manage billing and payments;
• respond to enquiries;
• improve our services;
• conduct audits and quality assurance reviews;
• prevent fraud and unlawful activity;
• satisfy regulatory obligations.

8. Who We Share Information With

We treat personal information confidentially.

Where necessary, we may disclose information to:

Government Authorities

Including:

• UKVI;
• Home Office departments;
• HM Passport Office;
• overseas embassies and consulates.

Courts and Tribunals

Including judges, tribunal members and court staff.

Professional Advisers

Including:

• barristers;
• expert witnesses;
• translators;
• interpreters;
• overseas legal advisers;
• consultants.

Regulators

Including:

• Immigration Advice Authority;
• Legal Ombudsman;
• law enforcement agencies where required.

Service Providers

Including:

• IT providers;
• cloud storage providers;
• document management systems;
• payment providers.

All service providers are required to maintain appropriate confidentiality and security standards.

9. International Transfers

The nature of immigration and international legal work may require personal information to be transferred outside the United Kingdom.

Examples include:

• foreign embassies;
• overseas legal representatives;
• foreign government authorities;
• international employers and educational institutions.

Where information is transferred internationally, we will take appropriate steps to ensure adequate protection in accordance with UK data protection legislation.

10. Data Security

We are committed to protecting personal information.

We maintain appropriate technical and organisational measures designed to protect information against:

• accidental loss;
• unauthorised access;
• misuse;
• disclosure;
• alteration;
• destruction.

These measures include secure systems, controlled access arrangements, encryption technologies where appropriate, staff training and confidentiality obligations.

11. Personal Data Breach Response

Sindhu & Partners maintains procedures for identifying, investigating, managing and responding to actual, suspected or potential personal data breaches.

A personal data breach may include any unauthorised or accidental access, disclosure, loss, destruction, alteration or misuse of personal information.

Examples may include:

• Loss or theft of documents containing personal information;
• Emails sent to incorrect recipients;
• Unauthorised access to client files or systems;
• Cybersecurity incidents, including phishing attacks, malware or ransomware;
• Accidental disclosure of confidential client information;
• Loss of electronic devices containing personal data.

Our Response

Where a personal data breach is identified, we will:

• Take immediate steps to contain and mitigate the breach;
• Assess the nature and extent of the incident;
• Investigate the cause of the breach;
• Evaluate the potential impact on affected individuals;
• Implement corrective measures to prevent recurrence;
• Maintain records of all data protection incidents in accordance with our regulatory obligations.

Notification

Where required by applicable data protection legislation, we will notify the Information Commissioner's Office ("ICO") without undue delay and, where feasible, within the statutory time limits.

If a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals as soon as reasonably practicable and provide information regarding:

• The nature of the breach;
• The categories of information affected;
• The likely consequences;
• The measures taken to address the breach; and
• Recommended steps individuals may take to protect themselves.

Cybersecurity and Business Continuity

Sindhu & Partners maintains appropriate technical and organisational measures designed to protect personal information and support business continuity, including:

• Access controls and authentication procedures;
• Secure cloud-based systems;
• Data backup and recovery processes;
• Staff training and awareness programmes;
• Incident response and escalation procedures;
• Regular reviews of information security risks.

While no electronic transmission or storage system can be guaranteed to be completely secure, we continually review and enhance our security measures to protect the information entrusted to us.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy legal, regulatory and professional obligations.

Retention periods may vary depending upon the nature of the matter.

Generally, client files may be retained for up to:

• 6 years following completion of the matter;
• longer periods where required by law;
• longer periods where professional obligations, regulatory requirements or legitimate interests justify retention.

At the end of the applicable retention period, information will be securely deleted or anonymised.

13. Your Rights

Subject to applicable law, you may have the right to:

• access your personal information;
• request correction of inaccurate information;
• request deletion of personal information;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a supervisory authority.

Requests may be submitted to our Data Protection Officer using the contact details above.

14. Marketing Communications

Where permitted by law, we may send you information regarding:

• legal developments;
• immigration updates;
• seminars and events;
• firm news and publications.

You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link in any email;
• contacting us directly.

We will never sell your personal information to third parties.

15. Cookies

Our website uses cookies and similar technologies to improve functionality, security and user experience.

Further information is available in our separate Cookie Policy.

16. Third-Party Websites

Our website may contain links to external websites.

We are not responsible for the privacy practices, content or security of third-party websites and encourage users to review their privacy notices before providing personal information.

17. Complaints

If you have concerns regarding our use of your personal information, please contact us in the first instance.

You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"):

Information Commissioner's Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

18. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time to reflect legal, regulatory or operational changes.

Any updates will be published on our website and will take effect from the date of publication.