Privacy Policy

Last updated:
3 November 2026

Concord's Privacy Policy outlining how we collect, use, share and process personal data.

1. What is this Privacy Policy for?

Introduction

This Privacy Policy is issued by Crimson Consulting Limited, a company incorporated in New Zealand (Company Number 4957459, NZBN 9429041095355). Concord Visa is a brand of Crimson Consulting Limited ("Concord", "we", "us", or "our"). We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, share and process identifiable information about you ("Personal Data") across all websites, applications and platforms that we own or operate, and all services we provide ("Services"). Unless specified otherwise, Concord acts as the controller of your Personal Data. This Privacy Policy also explains your privacy rights.

Third Party Links and Platforms

Our Services may contain links to websites, applications, platforms and services maintained by third parties. The privacy practices of these third parties, including social media platforms that host our branded content, are governed by their respective privacy policies. We encourage you to review their policies to better understand their privacy practices.

Concord's Role as a Processor

This Privacy Policy also applies where Concord processes Personal Data in the role of a processor or service provider on behalf of our customers. For example, where our customer is an employer or organisation that has purchased our Services for its own employees or users, their privacy practices may also apply, but they do not reduce the protections in this Privacy Policy. Concord is not responsible for the data privacy and security practices of its customers.

2. What Personal Data do we collect?

Directly or Automatically

We may collect Personal Data both directly from you, and automatically when you interact with our Services. The Personal Data we collect from you may include identifiers, financial information, immigration and visa records, commercial details, visual data, professional or employment-related information, internet activity, as well as any other such information from time-to-time. Below are the situations in which we collect this information and the types of Personal Data involved:

  • Expressing an interest in obtaining additional information about our products or Services; requesting customer support; using our "Get In Touch" form or similar features; registering to use our websites or to receive communications; signing up for an event, webinar or contest; or downloading certain content: Contact information, such as your name, residential address, phone number, email address, immigration information, username and password, and other information you have voluntarily chosen to share
  • Making purchases via our websites or registering for an event or webinar: Contact information, financial and billing information, such as billing name and address, credit or debit card number or bank account information
  • Attending an event in person: Contact information, such as your name, residential address, phone number, email address, immigration information, username and password, and other information you have voluntarily chosen to share
  • Interacting with our websites or emails: Information about your device and your usage of our websites or emails (such as Internet Protocol (IP) addresses or other identifiers), which may qualify as Personal Data (see Section 4 below) using cookies, web beacons, or other similar technologies
  • Using and interacting with our products and Services: Information about your device and your usage of our products or Services through log files and other technologies; your IP address; contact information such as your name; your voice, image and video; your qualification and employment history relevant to your immigration matter; your immigration information; and other information you voluntarily share
  • Communicating with us via a call (phone, video, or otherwise): Contact information such as your name, phone number, email and username; your voice, image and video; and other information you voluntarily share
  • Visiting our offices: Contact information such as your name, phone number and email; time and date of arrival; image or video
  • Applying for a job with us: Contact information such as your name, phone number and email; professional or employment-related information; qualification information; your immigration information; and any other information you voluntarily share
  • Voluntarily submitting certain information to us, such as filling out a survey, responding to a questionnaire or participating in other forms of research: Any information you voluntarily choose to provide to us
  • If you are a supplier or service provider to Concord (or work for a supplier or service provider): Contact information, financial and billing information, such as billing name and address and/or bank account information; any other information you voluntarily choose to provide to us
  • If you are employed or contracted by a company or organisation that purchased our Services: Any information you voluntarily choose to provide to us

Specific types of data

We only collect what we need to prepare and track your immigration matter. Depending on your visa, this may include:

  • Passport and immigration data: passport details, visa history, travel history, I-94 records and case numbers.
  • Financial data: bank statements, payslips and tax records, where a visa requires proof of funds or salary.
  • Health data: medical exam results and vaccination records, only where a visa requires them.
  • Character data: police certificates and court records, only where a visa requires them.
  • Family data: your partner's and children's details and documents, to include them in your application.
  • Case status from government systems: the status and history of your USCIS case, to show you where it is up to.

We do not collect precise geolocation, your phone contacts, or biometric data such as fingerprints.

Indirectly

We may also collect Personal Data indirectly from third party sources such as marketing and research partners, or from publicly available sources such as social media profiles or professional networking sites. We may generate information based on the Personal Data provided by you combined with Personal Data from such third party or public sources in accordance with applicable law. This information may be used to detect, prevent or otherwise address fraudulent, deceptive or illegal activity, misuse of our Services, security or technical issues, and to protect the rights, property and safety of Concord, our staff members, customers, or the public. We may also infer or generate information based on the Personal Data we collect to provide you with the most relevant user experience and keep our databases up to date.

If you provide us or our affiliates with any Personal Data relating to other individuals, you represent that you have the authority to do so and have obtained the necessary consent (where required). You acknowledge that such Personal Data may be used in accordance with this Privacy Policy. If you believe your Personal Data has been provided to us improperly, or wish to exercise your rights under applicable law, please contact us using the details in Section 12 below.

3. What do we use Personal Data for and under which legal bases?

(1) To perform a contract or to take steps prior to entering a contract:

  • Delivering, administering or providing our Services to you, including those Services you have purchased or received through a free trial
  • Verifying your identity
  • Processing payments
  • Sending you necessary communications
  • Providing you with customer service or support

(2) Where you have given consent to the processing of your Personal Data:

  • Sending you information about Concord's products and Services
  • Accessing Personal Data stored on your browser relating to your use of our Services
  • Placing cookies and other similar technologies through our products, Services and in email communications, in accordance with our Cookies Policy

(3) Where necessary to conduct our business and pursue our legitimate interests:

  • Delivering or providing our Services to you
  • Sending you information about Concord's products and Services, including through direct marketing activities
  • Analysing and measuring the effectiveness of our Services to better understand usage and improve user engagement and retention
  • Diagnosing and addressing any problems with our Services
  • Investigating and responding to any comments or complaints from you
  • Conducting market research to understand user interests, the effectiveness of our advertising campaigns, and customer satisfaction
  • Analysing the use and navigation of our Services to detect, prevent, or otherwise address fraudulent, deceptive or illegal activity or misuse of our Services

(4) Where necessary to protect the vital interests of another individual:

  • Protecting personal property or safety, including safeguarding the rights, property or safety of our users or the public

(5) Where necessary for legal reasons:

  • Responding to requests from government or law enforcement authorities, including for compliance, regulatory and investigative purposes
  • Complying with judicial proceedings, court orders or legal processes
  • Using or disclosing Personal Data as reasonably necessary to detect, prevent, or otherwise address fraudulent, deceptive or illegal activity, misuse of our Services, security issues, or piracy, to protect both you and Concord

If we need to collect and process Personal Data by law, or under an agreement with you, and you fail to provide the requested Personal Data, we may not be able to perform our agreement with you. Where we collect and process your Personal Data based on legitimate interests, you may object to this processing in certain circumstances. In such cases we will stop processing such Personal Data unless we have overriding legitimate grounds or legal obligations to continue processing. Where a particular legitimate interest is not a recognised legal basis in a certain jurisdiction, we will rely on other available legal grounds for the data collection and processing activities described above.

De-identified data

Sometimes we remove details that identify you, so the data can't reasonably be linked back to you. We use this de-identified data only to improve our Services and to produce statistics, such as average processing times. We never sell this data. We never give it to third parties without your active consent.

4. How do we use cookies?

Concord uses cookies when you interact with our website or Services. Cookies are small text files stored by your web browser when you visit websites. In addition to cookies, we may also use other similar technologies such as HTML5 Local Storage, local shared objects, web beacons, and embedded scripts. These technologies help us remember your preferences when you return to our sites, analyse how you use the website, conduct market research, and gather information about the ads you see and interact with.

The Concord app (the "Concord Platform") does not use advertising cookies.

You can control how Concord uses cookies and similar technologies by adjusting your browser settings, where you can manage or block cookies. By allowing cookies, we can improve your experience by:

  • tailoring our website and content based on your preferences;
  • keeping track of your settings and preferences for future visits;
  • better understanding your likely interests to provide you with more relevant Concord ads and content on non-Concord websites and apps; and
  • helping us enhance the performance of our website for you.

If you choose to disable cookies and similar technologies, our websites may not function properly, and your user experience may be different from what you expect. We won't be able to remember your preferences across sessions, so your experience may not be tailored to your interests. You will still have access to the content on our website, but certain features that rely on cookies may not function. Additionally, you will still see ads, but they might not be relevant to your interests.

There are also strictly necessary cookies. These cookies are essential for our website to function and cannot be disabled through our systems. They are usually only set in response to actions you take which amount to a request for services, such as setting your privacy preferences, logging in, or filling out forms. While you can set your browser to block or alert you about these cookies, doing so may prevent parts of our website from working. These cookies do not store any Personal Data.

5. Who do we share Personal Data with?

We do not sell your data. We do not sell, rent or trade Personal Data for money or anything else of value. This includes de-identified, anonymised and pseudonymised data.

We only share your Personal Data with the parties listed below, and only to provide our Services or where the law requires. No third party may use or disclose your Personal Data, including de-identified data, for any other reason without your active consent. Every organisation we share with must follow this Privacy Policy under a written agreement.

  • Concord affiliates: Entities, affiliates or subsidiaries within our corporate group, including any future acquisitions that become part of the group.
  • Partners: Entities or individuals that we collaborate with to sell, promote or advertise our Services, including those who sponsor, organise, or run events and webinars with us.
  • Service providers: External entities, contractors or suppliers that we engage to provide the Services to you, including IT and system administration, credit card processing, market research, customer analytics, marketing, event planning, customer support and accounting services. These service providers may utilise artificial intelligence technologies to analyse Personal Data, detect trends, make predictions, and create AI-generated responses or content. Our agreements with these service providers prohibit them from using your Personal Data, including de-identified data, to train or improve their AI models. Our current service providers are listed below.
  • Other users with whom you are affiliated: This includes individuals connected to your use of our Services. For example, (a) for dependants included in an immigration application, this may include the principal applicant and their family members, and (b) for authorised users, it may include their employer or other organisation.
  • Third parties: Social media networks, job vacancy and recruitment platforms, advertising websites, and internet service providers.
  • Professional advisers: Professional service providers such as lawyers, bankers, auditors, accountants and insurers who provide legal, banking, auditing, accounting, insurance and consultancy services.
  • Third parties involved in a corporate transaction: The prospective or actual purchaser of all or substantially all of Concord's assets or shares (whether through merger, reorganisation, acquisition, dissolution or other fundamental corporate change), and their professional advisers, to the extent required. See "Changes to our business" below.
  • Public authorities: Regulatory, governmental, compliance or judicial bodies (federal, state, city or otherwise), to the extent required for legal reasons.

Concord may share aggregated information, such as statistical data to show trends about the general use of our Services. Where such disclosure is public, it will be on an anonymised basis only. We never sell aggregated or de-identified data.

Our service providers

See our current list of service providers, including what each one does for us, what data it receives and where that data is stored.

Data we receive from USCIS

If you ask us to, we connect to USCIS to get the status of your case. We use this data only to show you and your adviser where your case is up to. We do not use it for marketing or to train AI models. We do not share it with anyone other than the parties listed in this section. We delete it along with the rest of your data under section 8.

Your disclosure choices

You choose what you share with us. Sharing complete information helps us prepare a strong application, but if you leave out something a visa requires, we may not be able to proceed. Once an application is filed, the government holds a copy, and we cannot delete it from their systems.

Your application may include details about your family. Please only share them with their permission, or if you are their parent or guardian.

Changes to our business

If we sell or merge our business, we will tell you before your data is transferred, and the new owner must follow this Privacy Policy. If we close, we will give you time to download your data before we securely delete it.

6. What are your rights relating to Personal Data?

Your rights

Where provided by applicable law, you may have the following rights concerning your Personal Data:

  • to request a copy of your Personal Data;
  • to correct, delete or restrict processing of your Personal Data;
  • know more about how we process your Personal Data; and
  • object to the processing of your Personal Data in certain circumstances (such as opting out of our direct marketing activities).

These rights apply only to Personal Data that we actually hold and may be limited in certain circumstances. For example, we may fully or partially deny your request if fulfilling it would reveal personal information about another individual. Any request to delete Personal Data may be limited where such data must be kept in order to fulfil any legal or reporting obligations, or where it may be relied on to defend any claims made against us.

You also have the right to not provide us with your Personal Data, although this may mean we are unable to carry out the Services or otherwise perform our agreement with you. As set out under Section 4, you may adjust your web browser or operating system settings to prevent certain types of automatic data collection, although this may result in our Services not functioning as intended.

Exercising your rights

To exercise your rights, please contact us using the information in Section 12 below. In order to respond to any request, your Personal Data may be processed. We will respond to legitimate requests within 45 days, or sooner if the law requires. To delete your data, see clause 11A of our Terms of Service. Occasionally it will take us longer to respond, taking into account the complexity and number of requests we receive. If your request is denied, we will explain the reasons for the refusal.

You may be able to exercise your rights by editing or deleting your Personal Data by logging into and accessing the "My Account", "My Profile" or a similar feature within the Service you are using. By doing so, you may be able to update or delete certain Personal Data.

Concord may send you direct marketing communications using the Personal Data you provide to us. You can opt-out of receiving marketing communications at any time by clicking the unsubscribe link at the bottom of our emails, or by emailing us at contact@concordvisa.com.

7. How do we keep your Personal Data safe?

Concord takes appropriate technical, organisational and physical measures to help safeguard Personal Data against accidental, unlawful, or unauthorised alteration, destruction, loss or disclosure. Some of the security controls we use include encryption, two-factor authentication and identity verification, staff training, and appropriate contractual confidentiality obligations for employees and contractors.

While we follow generally accepted standards to protect Personal Data, no method of storage or transmission is 100% secure. You remain responsible for limiting access to your devices, protecting your password, and signing out of websites and applications after each session.

Data breaches

If a breach of your Personal Data happens, we will tell you without undue delay. We will explain what happened, what data was affected, and the steps you can take to protect yourself. We will also notify the relevant data protection authority where the law requires.

8. How long do we keep Personal Data?

Concord will retain and process your Personal Data for as long as we have a legal basis to do so. We will delete certain Personal Data once we no longer have a business reason to retain it.

If you close your account, we will delete your Personal Data within 45 days. If your account has had no open matter for 7 years, we will email you, and if you do not ask us to keep your account within 45 days, we will delete your Personal Data.

However, certain types of Personal Data may need to be retained even after you discontinue the Services in order for us to comply with legal, business and reporting obligations. This may include information related to our business and contractual transactions with you, and will be retained for as long as required to fulfil our legal obligations.

Where your employer or another organisation engaged us, we may keep some Personal Data on their behalf for as long as our agreement with them requires, for example to support their own legal record-keeping. This Privacy Policy still applies to that data.

Upon expiry of the applicable retention period, your Personal Data will be deleted. In the event that any Personal Data cannot be entirely deleted from our systems due to technical reasons, we will implement appropriate measures to prevent its further use.

9. How do we process Personal Data of dependants and minors?

Our Services are directed to adults. We process Personal Data about minors only where they are included as dependants in an immigration matter (for example, a child included in a family visa application). Where required by law, we rely on the consent and authority of the parent or legal guardian, or process the data as necessary to perform our contract with the parent or to comply with legal obligations. Parents and guardians may request access to, correction of, or deletion of a dependant’s Personal Data by contacting us using the details in Section 12 below.

If you believe we have mistakenly or unintentionally collected Personal Data of a minor without appropriate consent, please contact us by using the information in Section 12 below.

10. Do we transfer your Personal Data internationally?

Concord is a global organisation. Your Personal Data may be collected, transferred to and stored by Concord, affiliates or third parties that may be in your jurisdiction or in other jurisdictions. Therefore, your Personal Data may be processed outside your country or jurisdiction, including in places that are not subject to an adequacy decision by the European Commissioner or your local legislature or regulator, and may not provide for the same level of data protection. We ensure that the recipient of your Personal Data offers an adequate level of protection and security, including by making sure such processing will be in a manner and for a purpose consistent with this Privacy Policy.

11. Will this Privacy Policy change?

This Privacy Policy will be updated from time to time to accommodate and reflect changes to industry practices, new technologies, legal requirements, and other factors. If we make any changes, the "last updated" date at the top of this page will be modified, and the revised version will be published. We encourage you to periodically review this Privacy Policy so that you remain informed about the Personal Data we collect, how we use it, and under what circumstances it may be disclosed.

If we make a material change, we will email you a plain-language summary and ask you to click “I agree” when you next log in. If you don’t agree, you can close your account under clause 11A of our Terms of Service.

Small fixes, like typos, don't need your consent. We will still update the "last updated" date.

12. Contacting us

Concord's Data Protection Officer oversees our compliance with data protection obligations. The Data Protection Officer also handles data subject access requests (or similar) and liaises with data privacy regulators in each jurisdiction Concord operates in.

To exercise your rights regarding your Personal Data, or if you have any questions regarding this Privacy Policy or our data privacy practices, please email us at contact@concordvisa.com, call us on +64 21 608 067, or write to us at:

Concord Data Protection Officer

c/- Crimson Consulting Limited

Level 4, 125 Saint Georges Bay Road, Parnell

Auckland 1052

New Zealand

When you contact us, please ensure you provide all relevant information to assist with your request or query, including the jurisdiction you reside in.

Concord is committed to working with you to fairly resolve any complaint or concern about privacy. However, if you believe that we have not been able to assist with your complaint or concern, you may wish to exercise your right to lodge a complaint with the appropriate authority in your jurisdiction.

13. California residents

If the California Consumer Privacy Act (CCPA) applies to us, California residents can ask to know, correct or delete the Personal Data we hold. We do not sell or share Personal Data for advertising, and we will not treat you differently for using your rights. To make a request, contact us using the details in section 12.

Concord Visa is a brand of Crimson Consulting Limited (Company Number 4957459, NZBN 9429041095355).