Privacy Policy

About this policy

This policy explains how we collect, hold, use and disclose personal information when you make an enquiry, use our website or engage our migration practice. It also explains how you can access or correct your information, make a complaint and choose whether your information is processed using AI. It covers clients, prospective and former clients, applicants, sponsors and other individuals whose information we handle.

1. Our privacy and confidentiality obligations

In this policy, “we”, “us” and “our” mean 1313 Success Group Pty Ltd trading as Nanak Migration Group. We apply the privacy standards described in this policy, informed by the Australian Privacy Principles (APPs), and comply with the Privacy Act 1988 (Cth) and other privacy requirements to the extent they apply to our business.

Our registered migration agents also owe the confidentiality duty in section 35 of the Migration (Migration Agents Code of Conduct) Regulations 2021 as amended (Code). They must not disclose or allow disclosure of client personal information to a third person without written client consent, except where a Commonwealth, State or Territory law requires disclosure. This duty continues after the engagement ends. A permission under privacy law does not, by itself, displace that duty.

Read this policy with our Artificial Intelligence Policy and your service agreement. This policy gives information about our practices; reading it, using our website or making an enquiry does not itself give consent to every collection, disclosure, marketing activity or AI use described below.

2. Information we collect and hold

We limit collection to information reasonably necessary for the relevant enquiry, service or lawful business function. Depending on the matter, we may collect and hold the following:

• Identity and contact information, including names, date and place of birth, nationality, citizenship, passport and visa details, addresses and contact preferences.
• Immigration information, including travel and visa history, applications, refusals, cancellations, conditions and correspondence with authorities.
• Family and relationship information, including partners, children, dependants and evidence relevant to a family or partner application.
• Education, language, employment and sponsorship information, including qualifications, skills assessments, test results, references, payslips and employer records.
• Financial and service information, including evidence of funds, bank statements, relevant tax records, invoices, payment confirmations, instructions, communications and complaints.
• Technical and interaction information, including website activity, device and browser details, IP addresses, enquiry and booking data, and records of your communications with us.

2.1 Sensitive information

A matter may require health information, criminal records, racial or ethnic origin, religious beliefs, political opinions or associations, sexual orientation or practices, or biometric information of the kind protected by privacy law. We collect sensitive information only where reasonably necessary and with valid consent, unless a lawful exception applies. We explain what is required and why; a general engagement or privacy-policy acknowledgement is not treated as blanket consent.

We handle relationship evidence, gender identity information, family violence or protection claims and children’s information with particular care, whether or not each item falls within the statutory definition of sensitive information. We do not request every category listed above from every client.

Our records may include professional opinions, file notes and AI-assisted drafts or summaries prepared under our AI Policy. Information about an identifiable person is protected even if it is an inference or is later found to be incorrect.

3. Collection methods and your choices

We usually collect information directly from you through consultations, questionnaires, our website, email, telephone, secure document channels and the material you supply. Where direct collection is unreasonable or impracticable, and collection is lawful and necessary, we may obtain information from authorised representatives, employers, sponsors, referees, previous advisers, government agencies, review bodies, assessing authorities, education providers, health providers, translators or public records.

At or before collection, or as soon as practicable afterwards, we take reasonable steps to explain the purpose, relevant recipients and overseas handling, whether collection is required by law and the main consequences of not supplying the information. Identity checks and client records may be necessary under sections 36 and 56 of the Code. We identify any additional collection requirement relevant to your matter.

You may make a general enquiry anonymously or using a pseudonym where practicable. We will explain when identity or other information is necessary to advise, verify instructions or lodge an application. If essential information is withheld, we may be unable to provide all requested services; we will discuss the effect with you.

If we receive information we did not request, we assess whether we could lawfully have collected it. If not, we destroy or de-identify it as soon as practicable where lawful and reasonable, subject to any legal record-keeping requirement. We restrict use and access while that assessment occurs.

We tell you before recording a consultation and obtain the permission required for the recording. AI transcription or recording also requires the separate written consent described in our AI Policy. Ordinary written file notes remain available.

4. Other people and related services

If you give us another person’s information, tell them about this policy and ensure you have lawful authority to provide it. We may seek confirmation directly. We remain responsible for our own collection, notices and consent requirements and do not rely solely on your assurance where further checks are needed.

A partner, sponsor, employer, family member or person paying our fees is not automatically entitled to another client’s confidential information. We identify the clients we act for and agree appropriate sharing arrangements. Family members may request separate files. For children and people who may lack capacity, we assess capacity and verify the authority of any parent, guardian or other representative before relying on their instructions or consent.

Engaging this migration practice does not automatically authorise information sharing with Nanak Accountants & Associates or another related or referral business. Where such sharing is proposed, we explain its purpose and obtain the required written authority, unless disclosure is required by law. Contact us privately if particular sharing or communication arrangements could put you at risk.

5. Purposes and disclosures

We use information to respond to enquiries, assess instructions and options, prepare and manage applications, arrange relevant assessments and translations, communicate with you and authorities, administer fees and records, maintain service quality and security, and respond to complaints or legal obligations. Any new or unrelated use must have an appropriate legal basis and satisfy our confidentiality duties.

Subject to those duties and the necessary written consent, we may disclose information to the following recipients for the relevant purpose. We disclose only what is reasonably necessary. The list does not authorise unrestricted access to your file.

5.1 No sale of personal information

We do not sell your personal information or provide it to other businesses for their independent marketing. If business ownership or file responsibility changes, any proposed transfer must comply with applicable law, the Code and the required notice and consent arrangements.

6. Overseas access and disclosure

Personal information may be accessed, stored or processed outside Australia. The likely countries under the arrangements described for our practice are India, where our Jammu support team works, and the United States, where technology and AI services may process data. A matter may also require dealings with authorities or service providers in your country of citizenship, residence, employment or study. The relevant country depends on your circumstances.

Our Jammu support personnel may undertake authorised document preparation and administration under the supervision of our registered migration agent. Their access is limited to assigned work and is subject to confidentiality and security requirements. Professional immigration assistance remains with the registered migration agent; overseas support arrangements do not transfer that responsibility.

Before engaging an overseas recipient, we assess the information involved, the recipient and any subcontractors, security, purposes of access and retention. We take reasonable steps to require appropriate protection, including contractual and operational safeguards. Where APP 8 applies, overseas disclosure can leave us accountable under Australian law for a recipient’s mishandling of the information.

We identify other likely recipient countries in collection notices and update this policy when our general arrangements change, where practicable. You may ask for current details relevant to your matter. We do not use agreement to this policy, an engagement or AI consent as consent to disapply APP 8.1. Any legally available exception must be assessed separately and must not override the Code.

If you require Australian-only handling, tell us before providing documents or engaging us. We will explain whether that arrangement is feasible. Refusing AI use alone does not prevent ordinary overseas support or cloud handling authorised for your matter.

7. Artificial intelligence

Approved AI may assist with drafting, summarising, extracting or organising authorised material and research support. Before AI is used to give immigration assistance, we explain its role. Before personal information is entered into an AI system, we obtain specific written consent identifying the proposed provider, purpose, information and relevant overseas handling.

We do not treat consent to our general services as consent to AI. You may decline or withdraw AI consent without an increase to your agreed fee solely for that choice. Approved provider terms and settings must prohibit model training and unrelated reuse of client information. Unapproved, free or personal AI accounts must not be used for client work.

A registered migration agent reviews and approves substantive AI-assisted work before it is provided as advice or lodged. Our AI Policy explains the safeguards, consent process, withdrawal arrangements and limits on deletion of completed records. An AI feature integrated into our practice software is subject to the same requirements as a separate tool.

8. Automated processing and decisions

We do not allow a computer program or AI system to make the final professional assessment, recommendation or lodgement decision on your matter without the registered migration agent’s judgement and approval. Visa and review outcomes are determined by the relevant authority, whose systems are governed by its own policies.

Software and approved AI can support administration and preparation, including organising information used by the agent. Human review does not by itself mean that automated-decision transparency requirements are irrelevant. Before introducing or materially changing a system that uses personal information to make, or substantially support, a decision with significant effects on an individual, we assess the relevant obligations and provide the required disclosures.

We will review our systems and this policy before the APP automated-decision transparency provisions commence on 10 December 2026. Where applicable, the policy will describe the kinds of information used and the decisions made or substantially supported by computer programs.

9. Website and marketing information

Our website and service providers may use cookies, server logs and analytics to operate the site, remember preferences, understand visitor use and maintain security. Technical information, including IP addresses and cookie identifiers, may be personal information when linked to an identifiable person. Enquiry and booking forms collect the information you enter.

You can manage cookies through your browser and any site controls provided. Restricting cookies may affect functionality. If we use advertising pixels, remarketing, additional analytics or an AI chat service, we must provide appropriate notices and obtain consent where required. Sensitive enquiry content and client documents must not be sent to advertising tools. Third-party links and platforms have their own privacy practices.

We may send relevant service news or marketing where permitted and with the consent required for the communication. Marketing includes a simple opt-out; you can also contact us to opt out without charge. We do not use sensitive information for marketing without express consent. Your choice does not stop necessary messages about your existing matter. Electronic marketing must comply with applicable spam requirements.

10. Security and government identifiers

We take reasonable technical and organisational steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Our required controls include individual accounts, access restricted to work needs, multi-factor authentication where available, appropriate encryption, controlled document sharing, staff confidentiality obligations, security updates, backups and secure disposal. Providers and overseas support arrangements are subject to security review.

No system is immune from compromise. Please use the document channels we nominate, avoid sending unnecessary sensitive information by ordinary email or social media, and tell us promptly about suspected account compromise or an incorrect recipient. We will discuss a safer communication method where needed.

We do not adopt passport numbers or other government identifiers as our own client identifiers. We use or disclose them only for lawful, necessary purposes, such as identity verification and an authorised application. A migration engagement does not give us a general right to collect your tax file number. Please redact TFNs from tax records before providing them unless a lawful collection basis has been specifically explained. Unnecessarily received TFNs are restricted and removed where legally permitted.

11. Retention and disposal

Under section 56 of the Code, the registered migration agent must take all reasonable steps to keep a client file for seven years after the last action on the file for that client. The period is not measured simply from a visa decision or the end of an engagement. A later action may change the relevant date.

We retain records longer where another legal requirement, an active proceeding or a properly assessed continuing need requires it. Enquiries that do not become engagements and other records are kept only for as long as reasonably necessary. Provider logs and temporary AI material should be minimised and managed separately from the required client file.

When retention is no longer required and the information is no longer needed for a permitted purpose, we take reasonable steps to destroy it securely or permanently de-identify it. Backup copies may remain until their normal secure deletion cycle, with access restricted. A deletion request or withdrawal of consent does not override legal retention obligations.

12. Access, correction and return of documents

You may contact us to request access to the personal information we hold about you or ask us to correct information that is inaccurate, outdated, incomplete, irrelevant or misleading. We may reasonably verify identity and authority. We respond within a reasonable period, ordinarily within 30 days, and explain any delay.

There is no charge to make a request or to correct information. If a charge for providing access is lawful and appropriate, it will be reasonable and explained in advance. Access may be limited where the law permits, including to protect another person’s privacy. If we refuse access or correction, we provide written reasons unless the law prevents this and explain the available complaint process.

If correction is refused, you may ask us to associate a statement of your position with the record. Where we correct information previously disclosed to another recipient, you may ask us to notify that recipient; we take reasonable steps to do so unless impracticable or unlawful.

The separate document-return duty in section 54 of the Code is not extended by our general privacy-request timeframe. On a qualifying written request, documents to which a client is entitled must be returned within 14 days. We may retain copies needed for our legal records. Outstanding fees do not entitle this practice to withhold those documents.

13. Data breaches

If we suspect unauthorised access, disclosure or loss of personal information, we act promptly to contain the incident, assess the information and people affected, preserve relevant evidence and reduce harm. Where the Notifiable Data Breaches scheme applies, we assess suspected eligible breaches within the applicable statutory timeframe and notify the OAIC and affected individuals as required.

Notification depends on the legal criteria, including whether serious harm is likely and whether effective remedial action prevents that harm. When notification is required, we explain the nature of the incident, the information involved and recommended protective steps as soon as practicable. We also consider applicable confidentiality and professional obligations.

14. Enquiries and complaints

Privacy and AI enquiries: Navpreet Aulakh, Registered Migration Agent (MARN 2619467), Nanak Migration Group, 21 Ravenwoods Way, Craigieburn VIC 3064. Email visa@nanakmigration.com.au · Phone 1300 644 728.

Please describe the concern, relevant dates and the outcome you seek. We acknowledge complaints promptly, investigate fairly and aim to provide a written response within 30 days. If additional time is needed, we explain why and give an expected response date. We can discuss assistance if you have difficulty putting your concern in writing.

If you are dissatisfied with our response, or we have not responded within a reasonable period, you may contact the Office of the Australian Information Commissioner (OAIC), where the matter falls within its jurisdiction, on 1300 363 992 or through its privacy complaints service. The OAIC generally expects you to raise the complaint with us first and allow a reasonable opportunity to respond.

Concerns about a registered migration agent’s professional conduct or confidentiality may be raised directly with OMARA. You do not need our permission or to complete our internal process before contacting OMARA. Making a complaint does not waive your rights.

15. Availability and changes

This policy is available free of charge on our website and on request. Contact us if you need it in another accessible form. We review it at least annually and when our services, systems or legal requirements change. We publish the revised version with its policy date and notify existing clients of material changes affecting their information.

A revised policy does not retrospectively authorise a new use or disclosure. We obtain further consent where required. Nothing in this policy excludes a legal duty, restricts a non-excludable right or limits the confidentiality obligations of our registered migration agents.

16. Legal framework and guidance

Sources reviewed on 15 September 2026. The Code applies to registered migration agents; Privacy Act and APP obligations depend on their statutory application. The standards and procedures stated in this policy also govern our practice.

• Migration Agents Code of Conduct — sections 35, 36 and 53 to 56.
• OAIC Australian Privacy Principles guidelines.
• OAIC guidance on collection of personal information.
• OAIC guidance on overseas disclosure.
• OMARA guidance on the use of artificial intelligence.
• OAIC guidance on tax file number information.
• OAIC guidance on access, correction and security.
• OAIC guidance on reporting data breaches.
• OAIC automated decision making consultation — commencement information; consultation material is not final guidance.