Free Consultation

Powered by Provisas

Privacy Policy

What personal information we collect, how we use it, where it is stored, how long we keep it, and your rights under the New Zealand Privacy Act 2020.

Last updated:

Student NZ is a student-visa and education service operated by Professional Visa Solutions Limited, trading as Provisas (NZBN 9429053592996), an Auckland-based immigration advisory firm licensed by the Immigration Advisers Authority of New Zealand. This page explains what personal information we collect about you, how we use it, who has access to it, where it is stored, how long we keep it, and your rights under the New Zealand Privacy Act 2020. If anything here is not clear, ask your adviser. Privacy is not optional, and it is not paperwork.

1. Who we are

Student NZ is the student-visa brand of Professional Visa Solutions Limited (trading as Provisas). Inder Singh (IAA Licence 201301110) is the firm's Principal Adviser and acts as our Privacy Officer. You can contact the Privacy Officer at:

2. What we collect

We collect personal information you give us directly, plus information we generate during your engagement.

Directly from you

  • Identity and contact details: name, date of birth, nationality, address, phone, email
  • Travel and visa history: current and past passports, prior visa records
  • Qualifications: degrees, professional registrations, academic transcripts, English test results
  • Employment: offer letters, contracts, payslips, references
  • Family details where partner or dependent visas apply: relationship evidence, dependent details
  • Health and character documents where Immigration New Zealand requires them
  • Payment information processed through our accounting provider

Generated during your engagement

  • Case notes from consultations and case work
  • Meeting transcripts where you consent to recording
  • Correspondence between you, Immigration New Zealand, and your adviser
  • Draft and final application documents

From third parties (only with your consent or where the law authorises it)

  • Information from Immigration New Zealand regarding your application status
  • Information from third parties named in your case (for example, education providers or employers)

Website visitors

If you submit an enquiry, request a callback, or book a consultation, we collect the information you submit. We also collect basic analytics (page views, referring source, browser type). See Section 10 for details and how to opt out.

3. How we use it

We use your information to:

  • Assess your eligibility for New Zealand visas under current Immigration New Zealand policy
  • Match you with education providers and courses, and prepare and lodge applications on your behalf
  • Respond to Immigration New Zealand queries and Potentially Prejudicial Information letters
  • Communicate case progress to you
  • Process payments for our services and Immigration New Zealand fees
  • Meet our regulatory obligations as IAA-licensed advisers (record-keeping, complaints handling, audit response)
  • Improve our services in aggregate using anonymised, non-identifiable patterns. Your individual data is never used to train AI models.

Information Privacy Principle 1 (New Zealand Privacy Act 2020) requires us to collect information only for a lawful purpose connected with our functions. The purposes above are those purposes.

4. How we use AI with your information

We use AI to support, never replace, the work of your IAA-licensed adviser. Every AI-assisted output that reaches you or Immigration New Zealand is reviewed, edited, and signed off by a licensed human.

  • Drafting. We may use AI to propose drafts of correspondence, submissions, and case notes. Your adviser reviews, edits, and signs every draft before it leaves us.
  • Meeting transcription. With your consent at the start of a consultation, we may record and transcribe meetings for accuracy. You may decline transcription at any consultation.
  • Secure document analysis. Your case documents are processed on private infrastructure located in New Zealand. Cloud-based AI services do not have access to your personal information through this pathway.
  • No model training. Your personal information is never used to train AI models. The tools we use do not learn from your case.
  • Audit logs. AI-assisted outputs are logged. You can request a list of AI-assisted outputs relating to your case at any time.

You can opt out of any specific AI use (drafting, transcription, document analysis) while remaining engaged with us.

5. Who has access

Inside our firm

  • Your assigned IAA-licensed adviser
  • Other named advisers and education advisers where your case work requires it
  • Supporting staff (administration, accounts) under written confidentiality obligations

Outside our firm

  • Immigration New Zealand, where we lodge applications and respond to queries on your behalf
  • Education providers you ask us to enrol you with
  • Our accountants, for billing reconciliation (they see your name and invoice details, not your case substance)
  • Our regulator, the Immigration Advisers Authority of New Zealand, where they audit our records
  • Anyone you give us written consent to share information with

We do not sell or rent your information to anyone, and we do not share it with third parties for marketing purposes. Information Privacy Principle 11 limits when we may disclose your personal information. Our practice follows those limits.

6. Where your data is stored

Your data may be held in the following systems:

  • HubSpot (marketing CRM, used for enquiries, callbacks, and consultation booking; not case management). HubSpot data for our account is held in the United States.
  • Case management and document storage used for active immigration case work. During our current systems migration this may be held in the United States (Zoho) and, once migration completes, in Australia (Microsoft 365).
  • Accounting and invoicing. Held in Australia (Xero).
  • Private inference infrastructure used for AI-assisted document analysis, physically located in New Zealand and never connected to cloud AI for client documents.

Cross-border disclosure (Information Privacy Principle 12)

Some providers above hold data outside New Zealand. Under IPP 12, we ensure the receiving party is subject to comparable privacy protections:

  • Australia (Microsoft, Xero): recognised by the New Zealand Office of the Privacy Commissioner as having comparable privacy protections.
  • United States (HubSpot, Zoho): we hold Data Processing Agreements providing contractual protections equivalent to the Privacy Act 2020 requirements.

If you have questions about a specific cross-border disclosure, contact our Privacy Officer.

7. How long we keep your data

The Immigration Advisers Authority Code of Conduct 2014 requires us to retain client records for seven years from the date of our last action on a case. We follow this requirement.

After seven years, case files are securely destroyed and digital records are deleted from active systems and any backups within a reasonable period. Required regulatory records may be retained longer where the law requires it.

You can request deletion of records that are no longer subject to regulatory retention or active case requirements. We will respond within 20 working days, confirming what can and cannot be deleted.

8. Your rights under the Privacy Act 2020

  • Access (IPP 6): request a copy of the personal information we hold about you
  • Correction (IPP 7): ask us to correct information that is wrong or out of date
  • Deletion: request deletion of records no longer subject to retention requirements (see Section 7)
  • Withdrawal of consent: withdraw consent for any specific AI use or disclosure you previously consented to
  • Complaint: if you believe we have mishandled your information, complain to us first; if it is not resolved, escalate to the Office of the Privacy Commissioner

To exercise any of these rights, contact our Privacy Officer (Section 1). We will respond within 20 working days for access and correction requests.

Office of the Privacy Commissioner (Te Mana Mātāpono Matatapu):

9. Security

Our measures include:

  • Encryption in transit (TLS) for data moving between you, our systems, and our providers
  • Encryption at rest for case documents and case notes
  • Access controls limiting staff access to what each person needs
  • Audit logging of system access and AI-assisted retrievals
  • Two-factor authentication on staff accounts
  • Isolation of the local inference infrastructure so client documents processed by AI never leave our systems

No system is perfectly secure. If we become aware of a privacy breach that has caused or is likely to cause serious harm, we will notify affected clients and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

10. Cookies and website analytics

To keep the site fast, our analytics and chat tools load only after the page has rendered or on your first interaction. We use:

  • Google Analytics 4: measures how visitors use the site (page views, traffic sources, approximate location). Used in aggregate to improve the site.
  • Ahrefs Web Analytics: a privacy-friendly, cookieless traffic measurement tool.
  • HubSpot: powers our enquiry and callback forms, consultation booking, and chat widget, and may set a cookie to recognise return visits.

You can opt out of analytics using your browser's cookie controls, a "Do Not Track" setting, or the Google Analytics Opt-out Browser Add-on. Blocking these cookies does not stop you using the site, booking a call, or submitting a form.

11. Children

Our services are for adults. Where minors are part of family migration applications, we handle their information only as necessary for those applications and only with the consent of a parent or guardian. We do not target marketing at minors and we do not collect minor data through our website forms.

12. Changes to this policy

We update this page when our practices change. The "Last updated" date at the top reflects the most recent change. If we make a material change (for example, adding a new AI use, changing where data is stored, or expanding what we collect), we will notify currently engaged clients by email before the change takes effect.

13. Contact

If you are not satisfied with our response to a privacy concern, you can complain to the Office of the Privacy Commissioner (Section 8).