In brief: Immexa Connect is a restricted client portal for the Immexa practice-management system. It lets invited clients see matter information, communicate with their assigned professional, upload documents, complete forms and view invoices. We do not sell personal information or use it for third-party advertising.
1. Who this policy applies to
This policy applies to the Immexa Connect mobile application and its related web portal and services (together, Immexa Connect), provided and supported by XQ Systems (we, us or our).
Immexa Connect connects to the main Immexa system used by the legal, migration or other professional practice that invited you (your service provider). Your service provider uses and manages your matter information to deliver its professional services and may also give you its own privacy notice. Questions about the substance of your matter should be directed to that service provider.
2. Information we collect and hold
Depending on your matter and how you use the service, Immexa Connect may process:
- Account and contact information, such as your name, email address, username and account identifiers.
- Identity and immigration information, which may include date of birth, nationality, passport or visa details, family information, travel and immigration history, education, employment and other information requested for your matter.
- Sensitive information where relevant to a matter, such as health information, criminal history, racial or ethnic origin, relationship information or government identifiers.
- Matter and service information, including your matter reference, service type, assigned agent, stages, tasks, evidence requests and status updates.
- Documents and forms that you choose to upload or complete, together with file names, types, sizes and submission records.
- Communications, including secure messages, attachments and support enquiries.
- Billing information, such as invoice references, amounts, payment status and due dates. The current mobile app does not collect payment-card details.
- Technical and security information, such as IP address, device or browser type, access times, authentication events, server logs, crash information and, if enabled, a device push-notification token.
3. How information is collected
Information is collected from you when you sign in, send a message, upload a file, answer a question, complete a form or contact support. Information is also received from your service provider through the main Immexa system, and technical information is generated when the service is used. Accounts are created or invited through Immexa; the mobile app does not offer public self-registration.
4. Why we use information
We process personal information to:
- authenticate you and provide secure access to your Immexa client portal;
- display and synchronise your matter, requests, documents, forms, messages and invoices with the main Immexa system;
- allow you and your service provider to communicate and exchange information;
- operate, secure, maintain, troubleshoot and improve the platform;
- prevent misuse, investigate security events and keep appropriate audit records;
- provide support and respond to privacy enquiries; and
- meet legal, regulatory, professional and contractual obligations.
Immexa Connect does not use your personal information for third-party behavioural advertising and does not sell your personal information.
5. When information may be disclosed
Information may be available to or disclosed to:
- your service provider and its authorised directors, agents, lawyers, migration professionals and staff;
- XQ Systems personnel who require access to operate, secure or support the platform;
- hosting, storage, email, security, monitoring and other technology suppliers acting for us or your service provider;
- professional advisers, insurers, auditors or regulators where reasonably required; and
- courts, law-enforcement bodies, government agencies or other parties where required or authorised by law, or where necessary to protect rights, safety and system integrity.
Service providers that handle personal information are expected to use it only for the authorised service and to apply privacy and security protections at least equivalent to those described in this policy.
6. Overseas processing
Some technology suppliers may store or process information outside Australia. Supplier locations can change according to infrastructure and support arrangements. Where overseas processing occurs, we take reasonable steps appropriate to the circumstances to require suitable confidentiality, security and privacy protections. You may contact us for current information about material overseas service-provider locations relevant to Immexa Connect.
7. Storage and security
We use safeguards designed for the nature of the information, including encrypted network connections, access controls, authenticated APIs, tenant separation, audit logging and secure device storage for the app session token. No online service can guarantee absolute security. You should protect your password, keep your device secure and notify us or your service provider promptly if you suspect unauthorised access.
8. Retention and deletion
Information is retained only for as long as reasonably needed for the purposes described above and as required by law, professional record-keeping duties, dispute resolution, security, backup and legitimate business requirements. Retention periods may therefore differ by record type and by the obligations applying to your service provider.
You may request deletion or closure of your portal account by contacting your service provider or XQ Systems. A request may not result in immediate deletion where information must be retained by law, is part of a professional client file, is needed for a current claim or security record, or remains temporarily in protected backups. When information is no longer required, reasonable steps are taken to delete or de-identify it.
9. Access, correction and privacy choices
You may ask to access personal information held about you or request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. You may also ask questions about consent, account closure or deletion. Contact your service provider for matter records, or contact XQ Systems using the details below for platform-related information. We may need to verify your identity before acting on a request.
10. Notifications and device permissions
The app may offer notifications for matter activity if this feature is enabled. You can manage notification permissions in your device settings. The current app uses the system file picker when you choose to upload a document and does not request ongoing access to your photo library, camera, contacts or precise location.
11. Children
Immexa Connect is not directed to children for independent use. Information about a child may form part of a professional matter and should be supplied and managed by a parent, guardian or otherwise authorised person through the relevant service provider.
12. Complaints
If you believe personal information has been mishandled, contact us with enough detail to investigate. We will acknowledge and assess the concern, may seek further information, and will communicate an outcome or next steps. You may also contact the Office of the Australian Information Commissioner at oaic.gov.au if you are not satisfied with the response.
13. Changes to this policy
We may update this policy when the service, suppliers, legal requirements or information-handling practices change. The current version will be published at this URL with its effective date. Material changes may also be communicated through the app or service provider where appropriate.