Privacy Policy

1. About us and about this policy

Nexo Migration (“Nexo Migration”, “we”, “us”, “our”) is a registered business name of HIMALAYAN BUSINESS GROUP GOLD COAST PTY LTD (ABN 90 642 509 617, ACN 642 509 617), an Australian company whose principal place of business is at Suite 30713, Level 7, 9 Lawson Street, Southport, Queensland 4215, Australia.

We provide migration and education agency services, including visa application assistance, skills assessments, student placement and sport-related visa services.

Immigration assistance is provided only by our registered migration agents, who are registered with the Office of the Migration Agents Registration Authority (OMARA). Other members of our team perform client coordination, document collection and administrative support under the supervision of our registered migration agent.

We are committed to protecting the privacy of the people who deal with us. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our registered migration agent is also bound by the confidentiality, document security and record-keeping duties in the Code of Conduct for registered migration agents (Migration (Migration Agents Code of Conduct) Regulations 2021), in particular sections 35, 53 and 56.

This policy explains:

• what personal information we collect and hold;
• how and why we collect it;
• who we disclose it to, including overseas recipients;
• how we keep it secure and how long we keep it;
• how you can access or correct it; and
• how you can complain if you believe we have mishandled it.

This policy applies to our website at www.nexomigration.com and to every way you deal with us: in person, by telephone, email, WhatsApp, video call, online form or social media.

Nothing on our website or in this policy is immigration assistance or legal advice. Immigration assistance is given only by our registered migration agent, after you have entered into a written services agreement with us.

2. Personal information and sensitive information

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.

Sensitive information is a subset of personal information that attracts a higher level of protection under the Privacy Act. It includes information about a person's health, criminal record, racial or ethnic origin, political opinions, religious beliefs or affiliations, membership of a professional or trade association or trade union, sexual orientation or practices, and biometric information.

Because of the nature of Australian visa applications, we routinely need to collect sensitive information about you and, in many cases, about your family members. We collect sensitive information only with your consent and only where it is reasonably necessary for our services, unless the collection is required or authorised by Australian law, for example where the Department of Home Affairs requires character or health information as part of a visa application.

3. The kinds of personal information we collect and hold

The information we collect depends on the service you ask us for. Not every category below applies to every client.

3.1 Identity and contact information

Full name and any former names, date of birth, gender as recorded on your identity documents, country of birth, nationality and citizenship, passport and travel document details, national identity numbers issued overseas, residential and postal address, email address, telephone numbers, WhatsApp number, social media handles, photographs and signature specimens.

3.2 Immigration and travel history

Current visa status and conditions, visa grant numbers, Transaction Reference Numbers (TRN), ImmiAccount details, previous visa applications and their outcomes, previous refusals, cancellations or bars, travel history, arrival and departure records, and any dealings you have had with the Department of Home Affairs, the Administrative Review Tribunal or previous agents or lawyers.

3.3 Education and English language information

Academic transcripts, certificates, diplomas and degrees, course enrolment and attendance records, Confirmation of Enrolment (CoE) details, study plans and statements of purpose, and English language test results (IELTS, PTE, TOEFL, Cambridge, OET).

3.4 Employment, skills and professional information

Curriculum vitae, employment history, position descriptions, employment references and payslips, professional registrations and licences, trade and professional qualifications, skills assessment applications and outcomes, and information about your sponsor or nominating employer.

3.5 Family and relationship information

Details of your partner, spouse, children and other dependants or family members, including their personal and sensitive information; marriage, de facto, birth, divorce and death certificates; relationship evidence such as joint financial records, correspondence, photographs and statutory declarations from third parties.

3.6 Financial information

Evidence of financial capacity required for visa applications (bank statements, income evidence, loan and sponsorship documents), billing and invoicing details, and records of payments you make to us. Card payments are processed by our payment provider; we do not store full payment card numbers.

3.7 Sensitive information

Where it is relevant to your matter, we collect:

• Health information: medical history, immigration medical examinations and health undertakings, results and referrals arranged through panel physicians, disability information, and information relevant to the health requirement or to a waiver request.
• Criminal record and character information: police clearance certificates from Australia and overseas, character declarations, and information about charges, convictions, or matters relevant to the character test under the Migration Act 1958.
• Biometric information: photographs and fingerprints where required for a visa application.
• Racial or ethnic origin, religious beliefs, political opinions, membership of a professional or trade association or trade union, and sexual orientation, but only where these are relevant to a claim you are making, for example in a partner visa, a religious worker visa, or a protection-related matter.

3.8 Sport-related visa information

For applicants in sport (including subclass 408 and other sport-related pathways), we collect sporting history and achievements, rankings and tournament records, playing and coaching contracts, club and academy letters, endorsements or support letters from national sporting organisations, training schedules, and related media and performance records.

3.9 Website and communications information

If you complete an enquiry or free assessment form on our website, we collect the information you enter in that form. Our web host and email provider also record technical information such as your IP address, browser type, device type, referring page and the date and time of your visit. We collect records of our communications with you, including emails, messages and file notes of telephone and video calls.

4. How we collect personal information

4.1 Directly from you

Most information is collected directly from you when you complete our enquiry or assessment form, sign our services agreement, send us documents, or speak with us by phone, email, messaging app, video call or in person.

4.2 From third parties

Where it is unreasonable or impracticable to collect information only from you, and where you have consented or would reasonably expect us to do so, we may collect personal information from:

• your sponsor, nominator or employer;
• education providers, schools, universities and course placement partners;
• skills assessing authorities;
• national and international sporting organisations, clubs and agents;
• your family members or the other applicants in your application;
• previous migration agents or lawyers;
• referral partners who introduce you to us;
• the Department of Home Affairs and other government agencies;
• translators, panel physicians, and other service providers involved in your matter; and
• publicly available sources.

If we collect information about you from someone else, we take reasonable steps to make sure you are aware that we have done so and why.

4.3 Information you give us about other people

If you give us personal information about another person (for example your partner, a dependent child, a referee or an employee), you confirm that you are authorised to provide it, and that you have told that person that their information will be given to us and how we will use it in accordance with this policy.

4.4 Unsolicited personal information

If we receive personal information we did not ask for, we will determine within a reasonable period whether we could have collected it under the Privacy Act. If we could not, and the information is not contained in a Commonwealth record, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

4.5 Dealing with us anonymously or under a pseudonym

You may make a general enquiry anonymously or using a pseudonym. However, we cannot assess your eligibility, provide immigration assistance, or prepare or lodge an application on your behalf without your true identity and supporting documents, because Australian migration law requires it.

4.6 Children and young people

Many of our services involve applicants under 18, including school students, secondary exchange students and dependent children included in a family application. Where an applicant is under 18, we collect and handle their personal information through their parent, legal guardian or nominated carer, and we rely on that person's consent. We take particular care with information about young people and limit access to it within our team. If you are under 18 and you contact us directly, please ask a parent or guardian to deal with us on your behalf.

4.7 If you do not provide the information we ask for

You are not obliged to give us your personal information. However, if you choose not to provide what we request, or the information you give us is incomplete or inaccurate, we may not be able to assess your eligibility, prepare or lodge your application, or continue acting for you. Incomplete or inaccurate information may also cause your application to be delayed, refused or cancelled by the Department of Home Affairs.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

1. Assessing your eligibility for Australian visas and other migration pathways.
2. Preparing, lodging and managing visa applications, sponsorship and nomination applications, skills assessments, and related requests through our registered migration agent.
3. Communicating and corresponding with the Department of Home Affairs, the Administrative Review Tribunal, skills assessing authorities, education providers, sponsors and sporting organisations on your behalf.
4. Arranging student enrolments, Overseas Student Health Cover and related education services.
5. Responding to your enquiries and providing you with information about our services.
6. Preparing and issuing services agreements, invoices and receipts, and processing payments.
7. Maintaining our client records and meeting our record-keeping, professional and regulatory obligations under the Migration Act 1958, the Code of Conduct for registered migration agents and Australian taxation and corporations law.
8. Managing and improving our services, our website and our internal training, and conducting quality assurance.
9. Sending you marketing and service information, where you have not opted out (see section 8).
10. Investigating and responding to complaints, disputes, audits and legal proceedings.
11. Complying with our obligations under Australian law and responding to lawful requests from courts, regulators and government agencies.

We will only use or disclose your personal information for a secondary purpose where you have consented, where you would reasonably expect us to do so and the secondary purpose is related (or, for sensitive information, directly related) to the primary purpose, or where the use or disclosure is required or authorised by law.

6. Who we disclose personal information to

To deliver our services we routinely disclose personal information, including sensitive information, to:

• the Department of Home Affairs and its ImmiAccount systems, including overseas posts and processing centres;
• the Administrative Review Tribunal, courts, and the Commonwealth Ombudsman, where relevant to your matter;
• the Office of the Migration Agents Registration Authority (OMARA), where required for a complaint, audit or regulatory enquiry;
• skills assessing authorities (for example VETASSESS, ACS, TRA, Engineers Australia, AITSL and other relevant bodies);
• education providers, universities, colleges, CRICOS-registered institutions and course placement partners;
• English language testing organisations;
• panel physicians, medical clinics and health service providers engaged for immigration medical examinations;
• Overseas Student Health Cover and other insurance providers;
• sponsors, nominating employers and their representatives;
• national and international sporting organisations, federations, clubs and academies, for sport-related visa endorsements and support letters;
• NAATI-accredited translators and interpreters;
• lawyers, barristers, accountants and other professional advisers engaged in connection with your matter;
• our staff and contractors, including client coordinators, on a need-to-know basis;
• our referral partners, but only to the limited extent described in section 7;
• our IT, cloud hosting, customer relationship management (CRM), email, file storage, videoconferencing and cybersecurity providers;
• our payment processors, banks and accounting providers; and
• any other person or organisation you authorise us in writing to deal with.

Our registered migration agent may only disclose your personal information to a third party with your written consent, or where disclosure is required by a law of the Commonwealth, a State or a Territory (Code of Conduct, s 35).

We do not sell, rent or trade your personal information, and we do not disclose it for the direct marketing purposes of any other organisation.

Government related identifiers. Some of the documents you give us contain government related identifiers, such as tax file numbers, Medicare numbers, or identifiers issued by an overseas government. We do not adopt a government related identifier as our own way of identifying you, and we use or disclose one only where it is reasonably necessary to verify your identity, to prepare or lodge an application on your behalf, or where the use or disclosure is required or authorised by Australian law.

7. Disclosure of personal information overseas

Because of the nature of migration work, your personal information will in many cases be disclosed to recipients located outside Australia. This may include:

• Australian Government offices and visa processing centres located overseas;
• education providers, sporting organisations, employers, referees and assessing bodies in your home country or elsewhere;
• our referral partners located overseas, currently in Spain and elsewhere in Europe, who introduce potential clients to us. Referral partners do not manage your file and do not receive your documents. Where a referral partner has introduced you to us, we may confirm to them that you have engaged our services so that we can calculate the commission payable to them; and
• our cloud hosting, email, customer relationship management, file storage, messaging and videoconferencing providers, whose servers are located in Australia, the United States and the European Union.

Before disclosing personal information overseas we take steps that are reasonable in the circumstances to ensure the overseas recipient does not breach the Australian Privacy Principles, for example by using contractual protections with our service providers.

Where you ask us to lodge or progress an application, or where disclosure is required or authorised by Australian law, we may disclose your information overseas without those steps applying, for example when your information is provided to the Department of Home Affairs, which may in turn share it with overseas agencies under Australian law and international agreements.

By instructing us to act for you, you acknowledge that your personal information will be disclosed overseas as described in this section.

8. Direct marketing, testimonials and your choices

8.1 Marketing communications

We may use your contact details to send you information about our services, updates on Australian migration policy, and offers that may be relevant to you. We do this in accordance with the Privacy Act, the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

We will not use or disclose sensitive information for direct marketing without your express consent.

You can opt out of marketing at any time by:

• clicking the unsubscribe link in any marketing email;
• replying “STOP” to a marketing message; or
• emailing us at hello@nexomigration.com.

Opting out of marketing does not stop us sending you messages about your active matter, such as document requests, deadlines and decisions.

You may also ask us to tell you where we obtained your information, and we will respond within a reasonable period unless it is impracticable or unreasonable to do so.

8.2 Testimonials, success stories and social media

We publish client testimonials, reviews, success stories and photographs or videos on our website and social media channels.

We will only publish content that identifies you (including your name, image or likeness, nationality, visa outcome, course or employer, or sporting achievements) if you have given us prior written consent for that specific use. Giving consent is entirely voluntary. It is not a condition of engaging us, and refusing has no effect on the service you receive or on how we handle your application.

You may withdraw your consent at any time by contacting us. We will remove the content from the channels we control as soon as practicable. We cannot recover copies that other people have downloaded, shared or re-posted, and we cannot control material that remains cached by search engines or stored by third-party platforms.

Where a testimonial concerns a client under 18, we obtain written consent from a parent or legal guardian.

9. Our website

Enquiry and assessment forms. When you complete a form on our website, the information you submit is sent to us by email and stored in our client management systems, and is handled in accordance with this policy.

Server logs and essential cookies. Our website host records standard technical information about visits (such as IP address, browser and device type, and pages viewed) for security and performance purposes. Our website uses cookies that are strictly necessary to operate the site, such as session and security cookies.

Analytics and advertising. We do not currently use third-party analytics or advertising tracking on our website. If we introduce them, we will update this policy before doing so.

Third-party links and social media. Our website and social media profiles may link to sites we do not control. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

10. How we hold, secure and retain personal information

10.1 How we hold it

We hold personal information in electronic form in our client management, email and cloud storage systems, and in physical form in hard-copy files where documents are provided to us on paper.

10.2 Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• restricting access to client information to staff who need it to perform their role;
• individual user accounts, strong passwords and multi-factor authentication on our key systems;
• encryption of data in transit and at rest with our service providers;
• secure, access-controlled cloud storage rather than personal devices or removable media;
• confidentiality obligations in our staff and contractor agreements;
• storing hard-copy files in locked cabinets in secured premises;
• staff training on privacy, confidentiality and cyber security; and
• secure destruction of documents that are no longer required.

No method of transmission or storage is completely secure. While we take our obligations seriously, we cannot guarantee absolute security, particularly for information you send us over the internet or by messaging apps.

10.3 Email, messaging apps and video calls

We communicate with clients by email, WhatsApp and other messaging and videoconferencing services. Those services are operated by third parties under their own terms and privacy policies, and we do not control how they store or transmit your information. Email and messaging apps are convenient, but they are not fully secure. If you would prefer to send sensitive documents such as passports, police certificates or medical results by another method, please tell us and we will arrange one.

We do not record telephone or video consultations, and we do not use automated or artificial intelligence transcription or note-taking services. If we introduce either, we will update this policy and tell you before any recording or transcription takes place.

10.4 How long we keep it

Our registered migration agent is required to keep each client file for at least 7 years after the last action taken on that file (Code of Conduct, s 56). We may need to keep certain financial and taxation records for a similar or longer period under Australian law, or where the information is relevant to an actual or anticipated complaint, audit, dispute or legal proceeding.

When we no longer need personal information for any purpose for which it may be used or disclosed, and we are not required by law or a court or tribunal order to retain it, we take reasonable steps to destroy it or de-identify it securely.

11. Data breaches

We maintain a data breach response plan. If we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information we hold, we will contain and assess the incident promptly.

Where a data breach is likely to result in serious harm to any individual whose information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

12. Accessing and correcting your personal information

12.1 Access

You may request access to the personal information we hold about you at any time. To make a request, contact our Privacy Officer using the details in section 15. We will ask you to verify your identity before releasing any information.

We will respond to your request within 30 days. We do not charge a fee for making a request, but we may charge a reasonable fee for the time and cost of retrieving and providing the information. We will tell you about any fee before we proceed.

In limited circumstances the Privacy Act allows us to refuse access, for example where giving access would have an unreasonable impact on the privacy of another person, where the information relates to anticipated legal proceedings, or where access would be unlawful. If we refuse, we will tell you in writing why, and how you can complain.

12.2 Correction

If any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell us and we will take reasonable steps to correct it. If we have disclosed the incorrect information to a third party, you can ask us to notify that third party, and we will do so unless it is impracticable or unlawful.

If we decide not to make a correction, we will tell you in writing why, and you may ask us to attach a statement to the record noting that you consider the information to be inaccurate.

12.3 Your Department of Home Affairs file

We hold your file, not the Department's. If you want the Department of Home Affairs' own records about you, you can make a request under the Freedom of Information Act 1982 (Cth) directly to the Department. We can explain the process, and we can assist you with it as a separate service.

13. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please tell us first so that we have the opportunity to fix it.

Step 1: Contact us. Send your complaint in writing to our Privacy Officer using the details in section 15. Please describe what happened and what outcome you are seeking. We will acknowledge your complaint within 5 business days and give you a written response within 30 days. If we need more time, we will tell you why and agree a new timeframe with you.

Step 2: Contact the OAIC. If you are not satisfied with our response, or we do not respond within 30 days, you may complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Telephone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

Complaints about our registered migration agent. A complaint about the professional conduct of a registered migration agent, including a breach of the Code of Conduct, can be made to the Office of the Migration Agents Registration Authority (OMARA) at www.mara.gov.au.

14. Changes to this policy

We review this policy regularly and may update it to reflect changes in our services, our systems or the law. The current version is always available at www.nexomigration.com/privacy-policy.

Where a change is significant, we will take reasonable steps to notify you, for example by email or by a notice on our website. The effective date at the top of this policy tells you when it was last updated.

15. Contact us

If you have a question about this policy, want to access or correct your information, or wish to make a privacy complaint, contact:

This policy is provided for the information of clients and website visitors. It is not legal advice.