Who this notice concerns
Australia Legal provides migration-application assistance for employers, employees and couples. This notice concerns the Australian website and information supplied when asking about or receiving those services. It does not describe every activity of the separate international website or replace a notice supplied for another service.
For a privacy question or request, email [email protected], using “Privacy request” in the subject. Please describe the request without attaching passports or other sensitive documents to an initial email.
Before an engagement proceeds, you should receive the identity of the responsible provider and adviser, together with the agreed scope of work.
Information involved in an enquiry
An enquiry can include your name, email address, telephone number, location, the assistance requested and the circumstances you choose to describe. Employer enquiries can also include a business name, the role to be sponsored and a contact person’s details. Employee enquiries can indicate whether an employer is involved. Partner enquiries can describe the relationship and application help sought.
Please provide only what is needed to explain your initial question. Do not send identity documents, medical information, police records or detailed relationship evidence through a general enquiry channel. The team can explain an appropriate method if documents are needed later.
You may ask a general question without identifying yourself, or use a pseudonym where practicable. Individual advice or representation can require identification and further information. Without necessary details, the team may be unable to assess a request or perform the work you ask for.
Information involved in an application
Depending on the work agreed, a migration matter can require identity and contact records; nationality, travel and visa history; employment, qualifications and business information; financial or payment records; and family or relationship evidence. Health information, criminal-record information or other sensitive information may be relevant to a particular application.
These categories are not a request to provide every document. Information should be collected only where needed for the matter or a legal obligation. Where applicable law requires consent for sensitive information, the relevant consent must be obtained or a lawful exception must apply. Agreeing to pay for a service is not, by itself, consent to every use of sensitive information.
Where information comes from
Information can come from you, an authorised representative, a person involved in your application, an employer or sponsor, a previous adviser, or an authority dealing with the matter. It can also come from correspondence, consultations and documents you authorise the team to obtain.
If you provide someone else’s information, you must have authority to do so and explain the relevant handling to them where appropriate. This includes information about a worker, partner or dependant. Where information is collected indirectly, the person’s own notification and consent rights still need to be considered.
Why information is used
Enquiry information is used to understand the assistance requested, respond, arrange an appropriate consultation and explain the proposed scope and fees. Information supplied for an agreed matter is used to assess the circumstances, prepare or progress the authorised work, communicate with the client and keep related records.
Other relevant purposes can include invoicing, resolving complaints, protecting legal rights and meeting duties imposed on the responsible professional. A new purpose outside the original request requires its own justification and, where required, consent or a further collection notice.
The Australian Privacy Act and Australian Privacy Principles apply to organisations within their coverage; not every small business is automatically covered. Where those laws apply, collection must be reasonably necessary for the relevant activities, and subsequent use or disclosure must have a permitted basis. Professional confidentiality duties can apply independently of Privacy Act coverage.
Who may receive information
Depending on your instructions and the work agreed, recipients can include the responsible adviser and authorised support personnel; government departments, assessing bodies and review bodies; interpreters, translators or other professionals; and providers supporting communications, document storage, appointments, payments or business administration.
This is a description of possible recipient roles, not permission for unrestricted sharing. For work performed by a registered migration agent, the Code of Conduct requires written client consent for disclosure of client information unless disclosure is required by Australian law. Other applicable legal and professional duties must also be respected.
An employer, sponsor or family member who pays a fee does not automatically receive another person’s complete file. Representation and authority to share information must be addressed for the people involved. Government bodies and independent professionals may handle information under their own legal obligations and notices.
Overseas handling and other websites
Australia Legal’s international website describes operations involving Australia, Italy and Spain. Where personnel in those countries participate in your matter, information may need to be handled across borders. Technology providers may also process information outside Australia. The countries relevant to a particular service depend on the team and providers actually used.
A website link does not authorise transferring your application file. Where the Australian Privacy Principles apply, overseas disclosure is subject to APP 8 and any applicable exception. A collection notice should identify relevant overseas countries where practicable. Ask the team about the countries involved before providing sensitive material if this affects your decision to proceed.
If you choose to follow an international-site or social-media link, the destination can collect information about your visit under its own arrangements. Please read the destination’s privacy notice for its information-handling arrangements.
Website technology, cookies and marketing
Submitting the website’s enquiry form sends the details you enter to Australia Legal through Cloudflare Pages and its WhatConverts lead-management profile so the team can respond. The form creates an enquiry record, but does not take payment, reserve a consultation or accept document uploads. Please do not include identity documents or sensitive personal information in an initial enquiry. Opening the website also sends ordinary connection information, such as an IP address, browser details and requested pages, to the hosting infrastructure needed to deliver and protect the site.
This website does not use advertising tags, analytics, session-replay tools or call-tracking integrations. If this changes, this notice will be updated to explain the tools and purposes, with consent requested where required.
A service enquiry is not a request for a newsletter. Any separate marketing arrangement must explain the messages offered and provide a way to stop them. You can request that marketing stop using the contact address above; doing so does not prevent necessary communications about an existing matter. The separate international website’s marketing choices do not automatically apply to this Australian website.
Automated tools and professional decisions
The website does not assess visa eligibility or make an automated decision about an application. A government decision is made by the relevant authority, not by this website.
If an adviser proposes using an AI tool with your personal information, the purpose, information involved and relevant handling arrangements need to be explained first. OMARA guidance says a registered migration agent needs written client consent before putting personal details into an AI platform or system. Browsing this website is not that consent.
Retention, security and incidents
Information should be kept for the purpose it was collected for and for applicable professional, accounting or legal requirements, rather than indefinitely. Where the registered migration-agent Code requires a client file, it generally requires retention for seven years after the last action on that file. That rule does not establish a seven-year retention period for every website visit or general enquiry.
Other records need a retention period suited to the request, the work performed and any legal hold or dispute. Where the Privacy Act applies, information that is no longer needed must be destroyed or de-identified subject to lawful retention exceptions. A deletion request cannot override a duty to preserve a client file, but the reason for continued retention can be explained.
Client information needs safeguards appropriate to its sensitivity and access restricted to authorised purposes. No website, email channel or storage method can promise absolute security. If an incident occurs, assessment and any required notification must follow the laws applicable to the affected information.
Access, correction and your choices
Email the contact above to request access to your personal information, correct an error, ask about retention or raise a concern. Describe the records or matter concerned and the outcome you want. Identity and authority may need to be checked in a proportionate way before information is released.
Where the Australian Privacy Principles apply, access and correction requests are subject to their requirements and exceptions. Access may need to protect another person’s privacy or legally privileged material; part of a record may be supplied with protected material removed. A refusal should explain the applicable reason and available complaint options. A correction request is not subject to a correction fee; any permissible charge for providing access should be explained in advance.
You can withdraw consent for future processing that depends on that consent, subject to lawful limits. Withdrawal does not make earlier authorised processing unlawful and may affect work that cannot proceed without the information. It does not require destruction of records that must legally be retained. Additional rights under another applicable privacy law can be raised through the same contact; this notice does not limit those rights.
Children and sensitive family matters
If a matter includes a child, only information relevant to that child’s participation in the matter should be requested. A parent’s, guardian’s or representative’s authority needs to be established where required, while considering the child’s understanding, interests and own information rights. An adult’s service contract is not blanket permission to use a child’s information for unrelated purposes.
Family disputes, changes in authority or concerns about sharing information with another person should be raised privately with the responsible adviser before further documents are supplied.
Complaints and updates
Send a privacy complaint to the contact above with the relevant dates, what happened and the outcome you seek. It should be reviewed by the person responsible for the matter and answered with the findings and any proposed next steps. Avoid including unnecessary identity or sensitive documents in the initial complaint.
Where the OAIC has jurisdiction, its guidance is to complain to the organisation first and allow 30 days for a response before escalating, unless an exception applies. You can read the OAIC privacy complaint guidance (opens in a new tab). Other applicable regulators and professional complaint routes remain available.
Material changes to the website or information handling should be reflected in an updated notice with a revised date. A revised website notice does not, on its own, supply consent for a new purpose or change an existing service agreement. See the related website terms and conditions.