1. Who We Are

1.1 Data Controller

Immigration Workspace is a product of Ascend General Consultants Ltd, a private limited company registered in England and Wales, company number 16315187.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Ascend General Consultants Ltd is the data controller in respect of the personal data of users of the Immigration Workspace platform.

Ascend General Consultants Ltd is registered with the Information Commissioner's Office (ICO), registration number C1905899.

Ascend General Consultants Ltd — Immigration Workspace

Registered in England and Wales, company number 16315187

Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

Data Protection Enquiries: support@immigrationworkspace.com

General Contact: support@immigrationworkspace.com

1.2 About This Policy

This Privacy Policy applies to all personal data processed by Immigration Workspace in connection with the use of our platform including:

• Data provided by registered users (immigration practitioners)
• Data relating to visa applicants entered into the platform by practitioners
• Data collected automatically through use of the platform
• Data provided through the client portal by visa applicants
• Data provided through the public landing page including the free refusal analyser

2. What Data We Collect

2.1 Account and Registration Data

When you create an account on Immigration Workspace we collect the following information:

• Full name
• Email address
• Organisation or firm name
• Password (stored in encrypted form — we cannot see your password)
• Account verification status and verification timestamps
• Subscription plan and billing status
• Two-factor authentication settings

2.2 Case and Client Data

When you create and manage cases on the platform you may enter personal data relating to your clients and visa applicants. This data is entered by you and may include:

• Applicant full name
• Date of birth
• Nationality and country of birth
• Passport number and expiry date
• Current immigration status and history
• Sponsor details and employer information
• Job title, role description, and salary
• Current address and location
• Family information where relevant to visa route
• Documents uploaded to support the case
• Notes entered by the practitioner
• Case correspondence and messages

Special Category Data: Some data entered into cases may constitute special category personal data under UK GDPR — for example information about nationality, religion, or family status. As the data controller for your clients' data you are responsible for ensuring you have an appropriate legal basis for processing this data. Please refer to Section 8 for more information on your responsibilities as data controller.

2.3 Billing and Payment Data

When you subscribe to a paid plan we collect billing-related information. Payment processing is handled by Stripe. We do not store your full card details on our systems. We collect and store:

• Billing name and email address
• Subscription plan and billing history
• Invoice records
• Stripe customer ID (reference only — no card data stored by us)
• Payment status and transaction timestamps

2.4 Usage and Technical Data

When you use the platform we automatically collect certain technical and usage data including:

• IP address and general location (country or region level)
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Date and time of access
• AI generation usage and token consumption
• Feature interaction logs
• Error logs and performance data for platform improvement

2.5 Support and Communication Data

When you contact us for support or submit a support ticket we collect:

• Your name and email address
• The content of your support request
• Our responses and the full ticket history
• Any attachments or screenshots you share with us

2.6 Free Refusal Analyser Data

When you use the free refusal analyser tool on our public landing page without logging in we collect and process:

• The content of the refusal letter PDF you upload — processed by AI to generate the analysis result
• Your email address if you choose to provide it to receive your analysis report
• Basic usage data such as IP address and timestamp

Refusal Analyser Notice: Refusal letters may contain sensitive personal data. Please ensure you have appropriate authority to upload and process any document containing third party personal data. We process uploaded documents solely to generate your analysis result and do not store refusal letter content after processing.

3. How We Collect Your Data

3.1 Data You Provide Directly

We collect data that you provide to us directly when you:

• Register for an account
• Create and manage cases on the platform
• Upload documents to a case
• Use the AI generation features
• Subscribe to a paid plan
• Contact our support team
• Use the free refusal analyser
• Complete your account profile
• Invite clients to the client portal

3.2 Data Collected Automatically

We automatically collect certain data when you access and use the platform through:

• Server logs — recording access times, IP addresses, and pages visited
• Session tracking — to maintain your login session securely
• Usage analytics — to understand how the platform is used and improve it
• Error tracking — to identify and fix technical issues

3.3 Data from Third Party Services

We may receive limited data from third party services we use to operate the platform including:

• Stripe — payment confirmation, subscription status, and billing events
• Anthropic — AI processing confirmations and usage data
• Cloudflare — infrastructure and delivery confirmations

4. Why We Use Your Data — Legal Basis

4.1 Legal Bases for Processing

Under UK GDPR we are required to have a lawful basis for processing your personal data. We rely on the following legal bases:

4.2 Contract Performance

We process your account data and usage data because it is necessary to perform the contract we have with you — that is to provide you with access to Immigration Workspace and the features you have subscribed to. This includes:

• Creating and maintaining your account
• Processing your subscription and payments
• Providing access to all platform features
• Sending service-related notifications
• Responding to your support requests

4.3 Legitimate Interests

We process certain data on the basis of our legitimate interests as a business where those interests are not overridden by your rights. This includes:

• Improving and developing the platform based on how it is used
• Maintaining the security and integrity of the platform
• Preventing fraud and unauthorised access
• Sending you relevant product updates and feature announcements
• Analysing usage patterns to improve the user experience

4.4 Legal Obligation

We may process your data where we are required to do so by law including:

• Retaining financial records for 7 years in accordance with UK tax and accounting law
• Responding to lawful requests from regulatory authorities
• Complying with UK GDPR, the Data Protection Act 2018, and other applicable regulatory requirements

4.5 Consent

Where we rely on consent as our legal basis we will always ask for your explicit agreement before processing your data for that purpose. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Your Data

5.1 To Provide the Platform

• Create and manage your account and login sessions
• Enable case creation, management, and document generation
• Process AI analysis requests using the data you provide
• Enable client portal access for your clients
• Send deadline reminders and case update notifications
• Process subscription payments and manage billing

5.2 To Improve the Platform

• Analyse usage patterns to understand which features are most valuable
• Identify and fix technical issues and bugs
• Develop new features based on how practitioners use the platform
• Monitor platform performance and infrastructure health

5.3 To Communicate With You

• Send account verification and password reset emails
• Send subscription confirmation and billing notifications
• Notify you of important changes to the platform or these policies
• Respond to your support tickets and enquiries
• Send product updates and new feature announcements where you have not opted out

5.4 To Maintain Security

• Detect and prevent unauthorised access and fraud
• Monitor for suspicious activity on the platform
• Enforce our Terms of Service and acceptable use policy
• Maintain audit logs of account and case activity

5.5 To Meet Legal Obligations

• Retain financial and billing records for 7 years as required by UK law
• Respond to lawful requests from courts or regulators
• Comply with UK GDPR and data protection obligations

6. Data We Do Not Collect or Use

6.1 What We Do Not Do

✓ Our Commitments to You

We are committed to using your data only for the purposes set out in this policy. Specifically:

• We do not sell your personal data or your clients' data to any third party
• We do not use your client case data to train our AI models
• We do not share your data with advertisers or marketing companies
• We do not use your data for any purpose unrelated to providing and improving Immigration Workspace
• We do not store full payment card details on our systems
• We do not access your case data except where necessary to provide technical support you have requested or where required by law

7. Who We Share Your Data With

7.1 Third Party Service Providers

We share limited personal data with trusted third party service providers who help us operate the platform. All third party providers are subject to appropriate data processing agreements and are required to handle your data securely and in accordance with UK GDPR and the Data Protection Act 2018.

7.2 Our Service Providers

Stripe

Purpose: Payment processing, subscription management, and billing.

Data shared: Billing name, email address, and payment information. Stripe processes all card data directly — we do not receive or store your full card details.

Location: United States and United Kingdom

Privacy policy: stripe.com/privacy

Anthropic (Claude AI)

Purpose: AI processing for document generation, refusal analysis, case intelligence, and all AI-powered features.

Data shared: Case data and documents you submit for AI processing. This data is sent to Anthropic's API to generate AI outputs.

Location: United States. This is a restricted international transfer under UK GDPR. We protect this transfer using a UK International Data Transfer Agreement (IDTA) as the appropriate safeguard.

Important: Anthropic does not retain your data after processing and does not use data submitted through the API to train its AI models.

Privacy policy: anthropic.com/privacy

Cloudflare

Purpose: File storage, content delivery network (CDN), and infrastructure delivery for the platform.

Data shared: Files and documents stored on the platform are held via Cloudflare R2 storage. Cloudflare infrastructure is used to deliver the platform reliably and securely.

Security: Cloudflare is selected for its industry-leading security standards and compliance with applicable data protection requirements.

Privacy policy: cloudflare.com/privacypolicy

7.3 Legal Disclosure

We may disclose your personal data to third parties if we are required to do so by law, court order, or regulatory authority. We will endeavour to notify you of any such disclosure where we are legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and ensure your data continues to be protected in accordance with this Privacy Policy.

7.5 No Sale of Data

✓ We Do Not Sell Your Data
We do not sell, rent, or trade your personal data or your clients' personal data to any third party for any commercial purpose. Your data is used only to provide and improve Immigration Workspace.

8. Data Controller and Data Processor

8.1 Ascend General Consultants Ltd as Data Controller

Ascend General Consultants Ltd is the data controller in respect of the personal data of registered users of Immigration Workspace — that is the personal data you provide when you create an account and use the platform.

8.2 Ascend General Consultants Ltd as Data Processor

When you enter personal data relating to your clients and visa applicants into Immigration Workspace, you are the data controller for that personal data. Ascend General Consultants Ltd acts as your data processor — processing that data on your behalf and according to your instructions.

Your Responsibilities as Data Controller: As the data controller for your clients' personal data you are responsible for:

• Having an appropriate legal basis for processing your clients' personal data on this platform
• Informing your clients that their personal data is processed using Immigration Workspace
• Complying with all applicable data protection obligations in respect of your clients' data
• Ensuring that client data you enter into the platform is accurate and up to date
• Responding to any data subject access requests from your clients in relation to data you hold about them

8.3 Data Processing Agreement

Agency plan customers may request a formal Data Processing Agreement (DPA) setting out the terms on which we process personal data on your behalf. Please contact us at support@immigrationworkspace.com to request a DPA.

9. International Data Transfers

9.1 Transfers Outside the UK

Some of our third party service providers are based outside the United Kingdom. As a UK company we are subject to UK GDPR rules on international data transfers. When we transfer personal data outside the UK we ensure that appropriate safeguards are in place to protect your data including:

• UK International Data Transfer Agreements (IDTAs) — the UK equivalent of Standard Contractual Clauses
• Transfers to countries with UK adequacy regulations in place
• Other appropriate safeguards as permitted under UK GDPR

9.2 Anthropic — United States Transfer

When you use AI features on Immigration Workspace, case data is transmitted to Anthropic's API which operates from the United States. The United States does not benefit from a UK adequacy decision. This transfer is therefore a restricted transfer under UK GDPR and is protected by a UK International Data Transfer Agreement (IDTA) between Ascend General Consultants Ltd and Anthropic.

Anthropic does not retain your data after processing is complete and does not use data submitted through the API to train its AI models.

By using the AI features of the platform you acknowledge that data submitted for AI processing will be transferred to Anthropic's systems in the United States for the purpose of generating your requested output, protected by the safeguards described above.

9.3 Stripe — United States and United Kingdom

Stripe operates in both the United States and the United Kingdom. Where personal data is transferred to Stripe's US operations this is protected by appropriate transfer mechanisms including IDTAs. Stripe is certified under applicable data transfer frameworks.

9.4 Cloudflare — Global Infrastructure

Cloudflare operates a global content delivery network. Data stored and delivered through Cloudflare is subject to Cloudflare's data protection commitments and applicable transfer safeguards. Cloudflare's infrastructure is selected to minimise data transfer risks and maximise security.

9.5 Data Minimisation

We only transfer the minimum data necessary to third party providers to fulfil the specific purpose for which it is being transferred.

10. How Long We Keep Your Data

10.1 Retention Periods

We retain your personal data only for as long as is necessary for the purposes set out in this policy or as required by law.

10.2 Retention Schedule

Account Data

Retained for the duration of your account plus 30 days following account deletion to allow for any disputes or recovery requests. After 30 days all account data is permanently deleted.

Case and Client Data

Retained for the duration of your active subscription. Following account cancellation or deletion case data is retained for 30 days to allow export before permanent deletion.

Billing and Financial Records

Retained for 7 years following the transaction date as required by UK tax and accounting law, including the Companies Act 2006 and HMRC requirements.

Support Ticket Data

Retained for 2 years following the closure of the support ticket to allow for follow-up and dispute resolution.

Usage and Technical Logs

Retained for up to 12 months for security monitoring and platform improvement purposes before automatic deletion.

Refusal Analyser Uploads

Refusal letter content uploaded to the free tool is processed and not stored after the analysis is generated. Email addresses collected through the tool are retained until you unsubscribe or request deletion.

10.3 Deletion on Request

You may request deletion of your data at any time. See Section 13 for information on your right to erasure.

11. How We Protect Your Data

11.1 Technical Security Measures

We implement a range of technical and organisational security measures to protect your personal data including:

• TLS encryption for all data in transit between your browser and our servers
• Encryption of all data at rest in our databases
• Secure password hashing — we cannot see your password
• Two-factor authentication (2FA) available for all user accounts
• JWT-based session management with appropriate expiry
• Role-based access controls limiting what data each user can access
• Regular security monitoring of platform infrastructure
• Automated backups with secure storage and encryption

11.2 Organisational Security Measures

• Access to user data is restricted to those who need it to provide the service
• We maintain an audit log of administrative access to the platform
• We review and update our security practices regularly

11.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach as required by UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms we will also notify you directly without undue delay.

11.4 No Absolute Guarantee

While we take data security seriously no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your data but we are committed to using best practice measures to protect it.

12. Cookies and Tracking

12.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They are used to make websites work properly and to provide information to website owners.

12.2 Cookies We Use

Essential Cookies

These cookies are strictly necessary for the platform to function. They cannot be disabled. They include:

• Session cookies — to keep you logged in during your session
• Security cookies — to protect against cross-site request forgery
• Preference cookies — to remember your platform settings

Analytics Cookies

We use analytics to understand how the platform is used and to improve it. Analytics data is collected in aggregated and anonymised form where possible.

12.3 Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling essential cookies will affect the functionality of the platform. For full details of the cookies we use please see our Cookie Policy at immigrationworkspace.com/cookies

13. Your Rights Under UK GDPR

13.1 Your Data Rights

Under UK GDPR you have the following rights in relation to your personal data. We will respond to all valid requests within one month of receipt.

13.2 Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this in a clear and accessible format.

13.3 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can update most account information directly through your profile settings.

13.4 Right to Erasure

You have the right to request that we delete your personal data. You may submit a deletion request through your account settings or by contacting us at support@immigrationworkspace.com

Please note that we may be required to retain certain data for legal or regulatory reasons such as financial records retained for 7 years under UK law. Where this applies we will inform you.

13.5 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances — for example while you contest the accuracy of the data we hold.

13.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. You can export your case data from the platform at any time through the PDF export feature.

13.7 Right to Object

You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis. You can also object to receiving marketing communications from us at any time by using the unsubscribe link in any marketing email or by contacting us directly.

13.8 Rights Related to Automated Decision Making

We use AI to generate risk scores, refusal predictions, and case intelligence reports. These outputs are intended as tools to assist qualified practitioners and do not constitute automated decision making that produces legal or similarly significant effects on individuals. Practitioners remain responsible for all decisions made in relation to their clients.

13.9 How to Exercise Your Rights

To exercise any of your rights please contact us at:

support@immigrationworkspace.com

Please include your full name, email address, and a clear description of your request. We will respond within one month. We may ask you to verify your identity before processing your request.

13.10 Right to Complain

If you believe we have not handled your personal data in accordance with UK GDPR you have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the supervisory authority for data protection in the United Kingdom:

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: ico.org.uk

We encourage you to contact us directly before lodging a complaint with the ICO. Please email us at support@immigrationworkspace.com and we will respond within one business day.

14. Children's Privacy

14.1 Age Restriction

Immigration Workspace is intended for use by professionals aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18.

If you believe that a person under the age of 18 has provided personal data to us please contact us at support@immigrationworkspace.com and we will take steps to delete that data as soon as possible.

15. Third Party Links

15.1 External Links

Immigration Workspace may contain links to third party websites or services. This Privacy Policy applies only to Immigration Workspace. We are not responsible for the privacy practices of any third party website or service. We encourage you to read the privacy policy of any third party site you visit.

16. Changes to This Policy

16.1 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. We will notify you of material changes by:

• Sending an email notification to the address registered to your account
• Displaying a prominent notice within the platform
• Updating the Last Updated date at the top of this page

Your continued use of Immigration Workspace after the effective date of any updated policy constitutes your acceptance of those changes. If you do not agree to the updated policy you should stop using the platform and delete your account.

17. How to Contact Us

17.1 Contact Details

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data please contact us at:

Ascend General Consultants Ltd — Immigration Workspace

Registered in England and Wales, company number 16315187

Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

ICO Registration Number: C1905899

Data Protection Enquiries: support@immigrationworkspace.com

General Support: support@immigrationworkspace.com

We aim to respond to all enquiries within one business day.

17.2 Related Policies

Please also review our related policies:

• Terms of Service
• Cookie Policy
• GDPR Statement

✓ We Take Privacy Seriously
Your privacy and the privacy of your clients is important to us. If you have any concerns about how we handle personal data please reach out to us at support@immigrationworkspace.com and we will respond within one business day.