1. Client Data Usage Declaration (Work Use Only)

Explicit Declaration of Purpose: By submitting your details on any form within the Vishwas International ecosystem, you acknowledge that this data is collected strictly for the purpose of professional immigration consultancy and internal work use. We categorically declare that your personal information—including phone numbers, email addresses, and academic records—is utilized solely to facilitate your UK Study or Spouse Visa application.

We are committed to maintaining the sanctity of your data. It is never sold, rented, or leased to third-party marketing agencies for unrelated commercial activities. Your data serves a single functional purpose: to assess your eligibility and process your visa application with the UK Home Office.

2. Executive Preamble and Strategic Governance

1.1. Introduction to the Data Governance Framework

In the highly regulated and sensitive domain of immigration consultancy, the management of personal data is not merely a procedural necessity but a critical component of legal risk management and corporate governance. For Vishawas International, an entity operating at the nexus of Indian digital marketing and United Kingdom immigration law, the imperative to establish a robust, exhaustive, and defensible privacy framework is paramount. This document serves as the master governance report and public-facing Privacy Policy, designed to meet the rigorous standards of the Digital Personal Data Protection (DPDP) Act 2023 of India, the UK General Data Protection Regulation (UK GDPR), and the stringent advertising policies of Meta Platforms (Facebook).

The primary objective of this framework is to articulate, with absolute clarity and legal precision, the methodologies by which Vishawas International collects, processes, retains, and protects the personal information of students and spouses seeking entry into the United Kingdom. Furthermore, this document functions as a comprehensive legal shield, explicitly delineating the boundaries of liability and establishing the terms under which services are rendered. It is engineered to preemptively mitigate the risk of litigation by clarifying that the consultancy provides advisory services without guaranteeing outcomes, thereby insulating the organization from liability associated with visa refusals, processing delays, or changes in government policy. By interacting with Vishawas International’s landing pages, Facebook Lead Forms, or consultancy services, users are contractually bound by the terms, disclaimers, and data practices detailed herein.

1.2. The Imperative of "No Blame" and Liability Containment

A central tenet of this policy framework is the establishment of a "No Blame" architecture. In the immigration sector, client expectations often exceed the consultant's actual influence, leading to potential disputes when visa outcomes are unfavorable. To address the specific requirement that "no person do not blame use... do not putt any case," this report integrates extensive Limitation of Liability clauses. These clauses are not boilerplate additions but are tailored to the specific mechanics of UK visa processing. They explicitly segregate the service of consultancy (which is under Vishawas International's control) from the outcome of adjudication (which is the sole prerogative of the UK Home Office). This distinction is critical for preventing future legal actions and ensuring that clients acknowledge the inherent risks of immigration applications prior to engaging our services.

1.3. Scope of Applicability

This framework applies comprehensively to all data ingestion points within the Vishawas International ecosystem:

• Digital Acquisition Channels: Specifically, landing pages optimized for Facebook Lead Ads, Instagram Stories, and other Meta advertising placements where user data is captured via Instant Forms or direct website entry.
• Consultancy Operations: The physical and digital processing of documents for UK Study Visas (Tier 4/Student Route) and Spouse/Partner Visas (Appendix FM).
• Third-Party Interactions: Data shared with or received from educational institutions, VFS Global, and payment processors.

This policy governs the lifecycle of data from the moment of "Lead Capture" on Facebook to the final "Data Deletion" or "Archival" post-service, ensuring a seamless chain of custody and compliance.

2. Regulatory Compliance Landscape

2.1. Alignment with the Digital Personal Data Protection (DPDP) Act 2023

As an Indian entity, Vishawas International operates as a Data Fiduciary under the DPDP Act 2023. This legislation fundamentally reshapes the obligations of small and medium businesses processing digital personal data. This framework ensures compliance through the following mechanisms:

• Notice and Verifiable Consent: The Act mandates that consent must be "free, specific, informed, unconditional, and unambiguous." This policy serves as the "Notice" required under Section 5 of the Act, explaining the purpose of processing in clear terms before the user submits their data on the Facebook Lead Form. We utilize a "check-box" mechanism on our landing pages to ensure that consent is an affirmative action, not implied.
• Legitimate Uses: While consent is the primary basis, the policy also identifies "legitimate uses" such as complying with legal judgments or responding to medical emergencies, providing a comprehensive legal basis for processing beyond simple consent.
• Duties of the Data Principal: The framework highlights the duties of the user (Data Principal) to provide verifiable and authentic information. Under the DPDP Act, users are liable for impersonation or providing false data, which reinforces our "Client Responsibility" defense.

2.2. Compliance with Meta (Facebook) Advertising Standards

Operating on the Meta advertising platform requires strict adherence to specific privacy mandates to avoid ad account suspension.

• Privacy Policy Linkage: Meta’s Lead Ads Terms require a direct link to a privacy policy that explicitly states what data is collected. This document fulfills that requirement, preventing ad rejection due to "Broken URL" or "Missing Policy" errors.
• Prohibited Attributes: We explicitly state that our data collection does not facilitate discrimination based on personal attributes such as race, religion, or sexual orientation, aligning with Meta’s anti-discrimination policies. The data collected (e.g., nationality) is solely for visa eligibility determination, a permitted exemption under immigration advertising rules.
• Data Security Disclosure: To satisfy Meta’s requirement for transparency regarding data security, Section 10 of this report details our encryption and storage protocols.

2.3. UK GDPR and Cross-Border Data Adequacy

Given that the ultimate destination of the data is the United Kingdom (universities and Home Office), the framework adheres to the principles of the UK GDPR.

• International Transfer: We justify the transfer of data from India to the UK on the basis of "Contractual Necessity" (Article 49 derogation)—the service (getting a visa) cannot be performed without sending the data to the UK.
• Data Minimization: We strictly adhere to collecting only what is mandated by the UKVI application forms, ensuring we do not collect excessive data that could violate GDPR principles.

3. Comprehensive Data Inventory and Collection Architecture

To provide immigration services, Vishawas International must collect a broad spectrum of "Personal Data" and "Sensitive Personal Data." This section catalogs these data points to demonstrate transparency and justify their necessity for the specific visa categories offered.

3.1. Primary Identity and Contact Data

Collected at the initial "Lead Generation" stage via Facebook Forms:

• Full Legal Name: As it appears on the passport. Discrepancies here lead to immediate visa rejection.
• Contact Coordinates: Valid Email Address and Mobile Number (WhatsApp enabled). This is essential for the "Correspondence" purpose defined in the DPDP Act.
• Date of Birth: Critical for determining age-based eligibility (e.g., minor vs. adult student applications).
• Current Location/Residency: To determine the correct Visa Application Centre (VAC) jurisdiction (e.g., North vs. South India).

3.2. Specialized Data for UK Student Visas

For applicants pursuing the Student Route, the data requirements are extensive and specific.

3.3. Specialized Data for UK Spouse/Partner Visas

This category involves highly intimate data to satisfy the "Genuine and Subsisting Relationship" test.

• Relationship Evidence: Marriage certificates, wedding photographs, chat logs (WhatsApp/Facebook Messenger exports), call history records, and money transfer receipts. This data is sensitive but is the only way to prove the relationship is not a sham.
• Sponsor Financials: The UK partner’s payslips (6 months), P60 forms, employment contracts, and bank statements. This validates the £29,000 minimum income threshold.
• Accommodation Proof: Housing inspection reports, tenancy agreements, and council tax bills from the UK address to prove no overcrowding.

3.4. Technical and Behavioral Data

When users visit our landing page via Facebook Ads:

• Device Fingerprinting: IP address, browser type, OS version.
• Interaction Telemetry: Time on page, scroll depth, form abandonment rates.
• Tracking Pixels: Meta Pixel data which helps in "Retargeting" users who dropped off before submitting the form. This is disclosed to comply with cookie laws.

4. Purpose Limitation: Why We Collect Your Information

In strict adherence to the "Purpose Limitation" principle of the DPDP Act and GDPR, Vishawas International processes personal data only for specific, explicit, and lawful purposes.

4.1. Contractual Necessity and Service Fulfillment

The primary purpose is to perform the contract of "Visa Consultancy."

• Eligibility Assessment: Analyzing academic and financial data to determine if the client meets UKVI criteria before application, saving fees on doomed applications.
• Document Preparation: Formatting, translating, and organizing documents (e.g., converting bank statements to UKVI format) for submission to VFS Global.
• Application Submission: Entering data into the Gov.uk "Access UK" portal and the VFS appointment system.

4.2. Communication and Client Lifecycle Management

• Transactional Alerts: Sending automated emails/WhatsApp messages regarding CAS issuance, biometric appointments, and passport collection status.
• Regulatory Updates: Informing clients of sudden changes in immigration rules (e.g., IHS fee hikes) that impact their pending cases.

4.3. Legal Compliance and Fraud Prevention

• Identity Verification (KYC): We verify identity to prevent impersonation fraud.
• Anti-Money Laundering (AML): We scrutinize financial documents (bank statements) to ensure funds are genuine and not "parked" funds, protecting the consultancy from complicity in immigration fraud.

4.4. Marketing and Analytics

Ad Optimization: Using aggregated, anonymized data to refine Facebook Ad targeting (e.g., creating "Lookalike Audiences" of successful student profiles) to improve business efficiency.

5. Information Sharing and Disclosure Matrix

Vishawas International adopts a rigid "Need-to-Know" sharing policy. We do not monetize client data by selling it to third-party marketing agencies.

5.1. Mandatory Governmental and Institutional Disclosures

• UK Home Office (UKVI): Full disclosure of the applicant’s profile is mandatory for the visa decision.
• VFS Global: Data is shared for the logistical processing of biometrics and passport handling.
• Educational Institutions: For study visas, data is shared with UK universities to obtain the Offer Letter and CAS.

5.2. Operational Service Providers

We utilize trusted third-party processors who are bound by Data Processing Agreements (DPAs).

• Cloud Infrastructure: Data is stored on encrypted cloud servers (e.g., AWS, Google Cloud) located in secure jurisdictions.
• CRM Solutions: To manage lead flow and application stages.
• Payment Gateways: For processing consultancy fees; financial data (credit card numbers) is handled directly by the gateway (e.g., Razorpay, Stripe) and not stored by us.

5.3. Legal and Safety Exemptions

We may disclose data without consent if required by law (e.g., a court order from an Indian High Court) or to protect the vital interests of the user (e.g., a medical emergency during travel).

6. The "Ironclad" Liability Shield: Disclaimer and Indemnification

CRITICAL NOTICE: This section constitutes the core legal defense mechanism for Vishawas International, directly addressing the requirement to prevent future litigation or "blame" regarding visa outcomes. By engaging our services, the client explicitly acknowledges and accepts these terms.

6.1. The "Consultancy vs. Authority" Distinction

Vishawas International is a private consultancy firm. We strictly declare that:

• No Authority to Grant Visas: We do not possess any authority to grant, issue, or guarantee a visa. This power resides exclusively with the Entry Clearance Officers (ECO) of the UK Home Office.
• No Guarantee of Outcome: The client acknowledges that visa issuance is a sovereign decision of the UK government. Vishawas International guarantees only the service of filing and advice, not the result. Past success rates are marketing statistics and do not constitute a warranty of future success.

6.2. Limitation of Liability for Rejections and Delays

To the maximum extent permitted by Indian law:

• Visa Refusals: Vishawas International shall not be liable for any visa refusal, ban, or rejection. The client accepts that refusals can occur due to subjective assessment by the ECO, credibility interviews, or undisclosed adverse history.
• Processing Delays: We are not responsible for delays caused by the UK Home Office, VFS Global, or third-party courier services. Timelines provided are estimates based on current trends and are not binding deadlines.
• Financial Cap: In the event of any proven negligence by Vishawas International, our total liability shall be strictly limited to the consultancy fee actually paid by the client. We are not liable for third-party fees (Visa Fees, NHS Surcharge), travel costs, or consequential losses (loss of university intake, loss of job offer).

6.3. Client Responsibility and Indemnification

The client agrees to indemnify, defend, and hold harmless Vishawas International from any claims, damages, or lawsuits arising from:

• False Information: The client providing fake, forged, or doctored documents (e.g., fake bank statements, altered marksheets).
• Non-Disclosure: The failure to disclose previous visa refusals or criminal convictions.
• Policy Changes: Financial losses incurred due to sudden changes in UK immigration rules (e.g., increase in maintenance funds) after the contract is signed.

6.4. Force Majeure

Vishawas International is not liable for failure to perform obligations due to events beyond reasonable control, including but not limited to pandemics (COVID-19), government lockdowns, strikes at UKVI/VFS, or natural disasters.

7. Data Retention and Lifecycle Management

7.1. Retention Periods

We adhere to a strict retention schedule to comply with the "Storage Limitation" principle.

• Inquiry Leads (No Service): Data from Facebook Leads who do not convert is retained for 12 months for follow-up, then anonymized.
• Active Cases: Retained for the duration of the application process.
• Completed Cases (Grant/Refusal): Retained for 3 years post-decision. This allows us to assist with BRP collection, errors in visas, or future applications (e.g., Graduate Route).
• Financial Records: Retained for 8 years as per the Indian Income Tax Act requirements for auditing.

7.2. Deletion Protocols

Upon expiry of the retention period, physical files are cross-shredded, and digital files are permanently purged from cloud storage.

8. Grievance Redressal and Data Subject Rights

In compliance with the DPDP Act 2023, we provide a robust mechanism for users to exercise their rights.

8.1. User Rights

• Right to Access: Users can request a summary of their personal data processed by us.
• Right to Correction: Users can demand correction of inaccurate data (e.g., spelling errors in names).
• Right to Erasure: Users can request deletion of their data, provided there is no overriding legal requirement to keep it (e.g., pending tax audit).
• Right to Withdraw Consent: Consent can be withdrawn at any time via the Grievance Officer. Note: Withdrawal during an active case may lead to termination of service without refund.

8.2. Grievance Officer

For any complaints, data deletion requests, or privacy concerns, users must contact:

9. Security Architecture

We employ a "Defense in Depth" strategy to secure client data.

• Encryption: All data in transit (from landing page to server) is encrypted via SSL (TLS 1.2/1.3). Data at rest in cloud storage is AES-256 encrypted.
• Access Control: Role-Based Access Control (RBAC) ensures only assigned case officers see sensitive files.
• Regular Audits: We conduct periodic security audits of our digital infrastructure to identify and patch vulnerabilities.

10. Digital Marketing Compliance (Cookies & Pixels)

10.1. Meta Pixel Usage

Our landing pages utilize the Meta Pixel to track conversion events (Lead Form submissions).

• Purpose: To measure ad effectiveness and optimize budget allocation.
• Data Flow: The Pixel sends hashed data to Facebook. We do not receive personally identifiable information from Facebook, only aggregate reports.
• Opt-Out: Users can manage their ad preferences in their Facebook Settings.

10.2. Cookie Consent

By using our landing page, users consent to the use of essential and analytical cookies. A "Cookie Banner" is deployed on the landing page to capture this consent explicitly.

11. Conclusion and Binding Declaration

This section serves as the final, binding summary of the Privacy Policy. By continuing to use the website or submitting any form, the user acknowledges the following:

11.1. Acknowledgement of Non-Guarantee

By submitting your data to Vishawas International, you explicitly acknowledge that Vishawas International is an immigration consultancy and NOT a government authority. You understand that the issuance of any visa (Study or Spouse) is the sole prerogative of the UK Home Office (UKVI). Vishawas International provides guidance and documentation services only; we do not and cannot guarantee the success of any application.

11.2. Waiver of Claims ("No Blame" Clause)

You hereby agree to waive any right to pursue legal action, defamation, or compensation claims against Vishawas International, its directors, or employees in the event of:

• Visa rejection or refusal by the UK High Commission.
• Processing delays caused by the embassy or third-party service providers (VFS Global).
• Changes in immigration laws or financial requirements that occur after your application has been filed.

11.3. Final Consent

You confirm that all personal and financial information provided by you is accurate, genuine, and voluntarily submitted. You authorize Vishawas International to process this data for the specific purpose of visa consultancy and to contact you via Email, SMS, WhatsApp, or Phone regarding your application status and relevant updates.

If you do not agree with any part of this Privacy Policy or the Liability Disclaimer, please do not submit your information or use our services.

12. Strategic Analysis of Liability Shields

12.1. Constructing the "No Blame" Defense

The user’s anxiety revolves around the potential for clients to "put a case" or blame the company for failures. In the legal context of service provision, liability usually arises from three sources: Breach of Contract, Negligence, or Misrepresentation. The policy addresses each:

• Contractual Clarity (Section 6.1): By explicitly defining the service as "advisory" and not "outcome-based," we neutralize the argument that a visa rejection is a breach of contract. If the contract was "to get a visa," a rejection is a breach. If the contract is "to assist in filing," a rejection is not a breach as long as the filing was done.
• Negligence Mitigation (Section 6.3): The "Client Responsibility" clause is pivotal. Most visa rejections stem from the client’s own data (e.g., insufficient funds, unverified documents). By placing the burden of veracity on the client, the consultancy shields itself from negligence claims. If the client supplies a fake document and gets banned, the policy proves the consultancy is not complicit.
• Misrepresentation Defense (Section 6.1): The Disclaimer explicitly states that "past results do not guarantee future success." This prevents clients from suing based on verbal assurances or marketing materials, as the written policy supersedes them.

12.2. The Role of "Informed Consent" in Lead Ads

Facebook Lead Ads are high-frictionless environments. Users often submit data without thinking. The DPDP Act 2023 requires consent to be "informed."

• Risk: If a user claims "I didn't know you would call me," they can file a DND complaint.
• Solution: The policy emphasizes that submission constitutes consent for communication via multiple channels (Email, WhatsApp, Phone). This "omnichannel consent" is crucial for the aggressive follow-up required in sales-driven consultancies.

12.3. Handling the "Refund" Dispute Risk

While primarily a privacy document, the inclusion of "Limitation of Liability" linked to fees (Section 6.2) serves a dual purpose. It acts as a de facto Terms of Service for the data interaction. By stating that government fees are non-refundable and liability is capped at the consultancy fee, the document pre-empts the most common financial dispute: clients demanding full refunds (including visa fees) after a rejection.

12.4. Operationalizing the "Data Fiduciary" Role

For Vishawas International, being a Data Fiduciary means taking ownership of the data pipeline.

• Third-Party Risk: The policy mentions "Third Party Service Providers" (Section 5.2). This is critical because if the cloud provider (e.g., a cheap hosting service) gets hacked, the liability falls on Vishawas. The policy mitigates this by stating we use "trusted" providers and limiting liability for "Force Majeure" or third-party breaches to the extent allowed by law.