Privacy policy

This Privacy Policy (the “Policy”) explains how Ambott (“Ambott”, “we”, “us”, or “our”) collects, uses, shares, stores, and protects personal information when you visit https://ambott.com (the “Website”), submit an enquiry or assessment request, download a free resource, communicate with us, or use any mentorship, evidence-strategy, document-preparation, assessment, or related services we offer (together, the “Services”). It also explains the choices and rights you have over your information.

This Policy forms part of our Terms and Conditions (the “Terms”) and is available at https://ambott.com/privacy-policy-for-users. Capitalised terms not defined here have the meanings given in the Terms.

Our clients live and work in many countries, and our Services relate to merit-based visa routes in the United States, the United Kingdom, and Australia. We therefore aim to meet the standards of the main data protection laws that may apply to you, including the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”), the Australian Privacy Act 1988 and Australian Privacy Principles (“APPs”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). Section 10 explains the rights that may apply to you depending on where you live.

If you do not agree with this Policy, please do not use the Website or provide personal information to us.

Ambott is a talent visa mentorship and evidence-strategy practice. For the personal information described in this Policy, Ambott is the “controller” under the UK GDPR and EU GDPR, the “business” under the CCPA, and the “APP entity” under Australian law.

Privacy contact: info@ambott.com (please put “Privacy” in the subject line). We have not appointed a Data Protection Officer. If we are required to appoint one, or to appoint a UK or EU representative, we will publish their details here.

Independent third parties. Partners (the independent immigration attorneys, regulated advisers, and registered migration agents described in section 8 of the Terms) are separate from Ambott. Once you choose to proceed with a Partner and we share your case file with them, the Partner handles your information as an independent controller under its own privacy notice. We are not responsible for how a Partner handles your information.

The information we collect depends on how you interact with us. It falls into the categories below.

3.1 Information you give us

• Identity and contact details: your name, email address, phone number, country and city of residence, nationality or citizenship, preferred language, and links to professional or social profiles (for example, LinkedIn).
• Enquiry and assessment details: the route or routes you are considering, your goals and timeline, answers you give in eligibility check requests or the three-route self-check, how you heard about us, and the content of any message you send.
• Professional and evidence information: your CV or résumé, employment and education history, current role and employer, publications, patents, citations, awards, memberships, judging and peer-review activity, speaking engagements, press and media coverage, compensation and funding information, project and impact metrics, letters of recommendation, and contact details for potential referees, endorsers, or nominators.
• Immigration information: your current and previous visa or residence status, immigration and travel history, prior applications, refusals, and requests for evidence (RFEs), identity documents such as passport copies, and, where relevant to your route, details about dependants.
• Billing and transaction information: your billing name and address, the plan you select, invoices, and payment status. Card and bank details are entered with our payment processors and are not stored by us.
• Communications: emails, messages, call or meeting notes, feedback, survey responses, and, with your express written consent, testimonials. We will tell you in advance if we need to record a call.
• Preferences: your marketing and communication choices.

3.2 Information collected automatically

When you use the Website, we and our service providers may automatically collect technical and usage information, including your IP address and approximate location derived from it, device type, browser type and version, operating system, language settings, referring website, pages viewed, time spent, links clicked, resources downloaded, unique identifiers (such as cookie IDs), and error and security logs. Section 5 explains cookies and similar technologies.

3.3 Information from other sources

• Referees, endorsers, and nominators who respond to our outreach on your behalf, and Partners who tell us about the status of your matter.
• Public sources, such as publication and citation databases, news and media sites, company websites, professional profiles, and government websites, which we use to verify and build your evidence record.
• People who refer you to us, where they give us your contact details with your knowledge.
• Service providers, such as payment processors (confirming a payment), scheduling and communication tools, and analytics providers.

3.4 Sensitive information

Some information we handle is sensitive or falls into “special categories” under data protection law. Depending on your route and circumstances, this may include passport and national identification numbers, nationality (which may reveal racial or ethnic origin), immigration history, criminal-record or police-certificate information, financial information, and, in rare cases, health information relevant to an application.

We ask for sensitive information only where it is necessary to provide the Services. Where the law requires your consent to process it, we rely on your explicit consent, which you give when you choose to provide it to us. You may withdraw consent at any time (see section 10), although we may then be unable to continue some or all of the Services.

As stated in section 11 of the Terms, please do not send passport numbers, national identifiers, or financial account details through the open contact form or by unencrypted email. Contact us first and we will agree a secure method with you.

3.5 If you choose not to provide information

You are not obliged to give us any information. However, we cannot assess your record, prepare evidence, or deliver the Services without the information relevant to them, and the quality of our work depends on the accuracy and completeness of what you provide.

We use personal information only for the purposes below. Where the UK GDPR or EU GDPR applies, we must have a legal basis for each purpose, which we also set out.

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You can ask us about this balancing and may object to the processing (see section 10). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We will not use your personal information for a purpose that is incompatible with those above without telling you and, where required, obtaining your consent. We do not sell your personal information, and we do not use your case documents or evidence for advertising.

Cookies are small files placed on your device when you visit a website. We also use similar technologies such as pixels, local storage, and software development kits. We use them for the following purposes:

• Strictly necessary: needed for the Website to function, remember security settings, and protect against misuse. These cannot be switched off in our systems.
• Functional: remember your choices, such as language or form entries, to provide a more personal experience.
• Analytics and performance: help us understand how visitors use the Website, which pages are useful, and where problems occur, so we can improve it.
• Marketing: if enabled, used to measure the effectiveness of our outreach. Where the law requires, we use non-essential cookies only with your consent.

Where required by law, we show a cookie notice that lets you accept or reject non-essential cookies, and you can change your choice at any time. You can also block or delete cookies in your browser settings, although parts of the Website may not work properly as a result. We respond to browser-based opt-out preference signals, such as Global Privacy Control, where the law requires us to do so. Some embedded content, such as scheduling tools or videos, may set their own cookies, which are governed by those providers’ policies.

We do not share your personal information except as described below, and only to the extent necessary for the purpose.

• Partners. If you choose to proceed with a Partner, we share your case file in a clean and indexed form with that Partner, as described in section 8 of the Terms.
• Referees, endorsers, and nominators. With your consent, we share the information needed for them to understand your work and support your application, as described in section 7 of the Terms.
• Service providers (processors). We use trusted providers for website hosting and infrastructure, cloud document storage, email and communications, video conferencing, scheduling, forms, customer and project management, payment processing, accounting, analytics, security, and IT support. They may access personal information only to perform services for us, under written agreements requiring confidentiality, appropriate security, and processing only on our instructions.
• Professional advisers, such as lawyers, accountants, auditors, and insurers, where reasonably necessary.
• Authorities and legal requests. We may disclose information where required by law, court order, or regulatory request, or where necessary to protect the rights, safety, or property of you, us, or others, as stated in section 11 of the Terms. Ambott does not file applications with government authorities on your behalf. Filings are made by you or by a suitably licensed Partner.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred to the successor, which will be required to protect it in line with this Policy. We will notify you of any resulting change in who controls your information.
• With your consent or at your direction, for any other purpose you approve.
• Aggregated or anonymised information that cannot reasonably identify you may be shared for analysis or reporting.

We do not sell personal information and do not “share” it for cross-context behavioural advertising as those terms are defined in the CCPA.

Because our clients, Partners, referees, and service providers are located in many countries, your information may be transferred to, stored in, or accessed from countries other than your own, including the United States, the United Kingdom, the European Economic Area, and Australia. Those countries may have data protection laws that differ from those where you live.

Where required, we protect transferred information using safeguards recognised by law, such as adequacy decisions, the UK International Data Transfer Agreement or UK Addendum, EU Standard Contractual Clauses, certification of the recipient under an applicable data privacy framework, or other lawful transfer mechanisms. For Australian residents, we take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs, unless an exception applies, such as where you consent to a disclosure to a Partner of your choosing. For India, transfers are made in line with the DPDP Act and any restrictions notified under it. You may ask us for more information about the safeguards we use by contacting us at info@ambott.com.

We keep personal information only for as long as needed for the purposes in this Policy, including to meet legal, accounting, and reporting requirements and to establish or defend legal claims. The periods below are our standard retention periods.

If information is needed for a legal claim, regulatory inquiry, or investigation, we may keep it longer. When information is no longer required, we delete it, anonymise it, or securely destroy it. Copies held in backups are overwritten in the ordinary backup cycle.

We use technical and organisational measures that are appropriate to the sensitivity of the information we hold, including:

• encryption of data in transit (HTTPS/TLS) and, where offered by our providers, at rest;
• access controls that limit information to people who need it, supported by confidentiality obligations and authentication measures;
• secure document-sharing methods for sensitive material;
• due diligence on service providers and written data protection terms with them;
• regular backups and measures to restore access after an incident; and
• periodic review of our security practices and training for people who handle client information.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You can help protect your information by using a secure channel for sensitive documents, keeping your own accounts and devices secure, and telling us immediately if you believe your information has been compromised.

Data breaches

If a personal data breach occurs that is likely to result in risk to your rights or interests, we will take prompt steps to contain it and will notify affected individuals and the relevant authorities where required by law. For example, this includes notification to the UK or EU supervisory authority within 72 hours where feasible, to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and to the Data Protection Board of India under the DPDP Act.

10.1 Rights available to you

Depending on where you live and the law that applies, you may have some or all of the following rights:

• Access: to know whether we process your personal information and to receive a copy.
• Correction: to have inaccurate or incomplete information corrected.
• Deletion: to ask us to delete your information, subject to legal exceptions.
• Restriction: to ask us to limit how we use your information in certain circumstances.
• Objection: to object to processing based on legitimate interests and to any direct marketing at any time.
• Portability: to receive information you gave us in a structured, commonly used, machine-readable format and to have it sent to another provider where technically feasible.
• Withdrawal of consent: to withdraw consent at any time where we rely on it.
• Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make such decisions (see section 12).

10.2 How to exercise your rights

Email info@ambott.com with the subject “Privacy Request” and describe what you would like us to do. We may ask for information to verify your identity, and we will only ask for what is reasonably necessary. You may use an authorised agent where the law allows, and we may require proof of their authority.

We aim to respond within one month, or within the period required by the law that applies to you. We may extend this period where permitted for complex or numerous requests, and will tell you if we do. We do not normally charge a fee, but may charge a reasonable fee or decline a request that is manifestly unfounded or excessive, where the law allows. We may refuse or limit a request where an exemption applies, for example where information is subject to legal privilege or confidentiality, contains another person’s information, or must be kept to comply with law. We will explain our reasons.

10.3 Residents of the United Kingdom and European Economic Area

You have all the rights in section 10.1. You also have the right to lodge a complaint with your supervisory authority (see section 15).

10.4 California residents

In the past 12 months, we have collected the following categories of personal information described in the CCPA: identifiers (such as name, email, and IP address); customer records and contact information; professional, employment, and education information; commercial information (such as plans purchased); internet and network activity; approximate geolocation; and sensitive personal information (which may include government identification numbers and citizenship or immigration status that you provide). We collect these from you, from referees and Partners, from public sources, and from our service providers, for the business purposes described in section 4, and we disclose them to the categories of recipients described in section 6.

California residents have the right to know what personal information we collect, use, and disclose; to request deletion and correction; to opt out of the “sale” or “sharing” of personal information; to limit the use of sensitive personal information in certain cases; and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined in the CCPA, and we use sensitive personal information only for purposes permitted by law, such as providing the Services you requested. We do not disclose personal information to third parties for their own direct marketing purposes. We aim to respond to verifiable requests within 45 days, extendable once by a further 45 days where reasonably necessary.

10.5 Residents of other US states

Residents of other US states with comprehensive privacy laws may have similar rights of access, correction, deletion, portability, and opt-out. You can exercise them as described in section 10.2. If we decline your request, you may appeal by replying to our decision email with the word “Appeal”, and we will respond within the period required by applicable law.

10.6 Australian residents

Under the APPs, you may request access to, and correction of, the personal information we hold about you. We will respond within 30 days. Where it is lawful and practicable, you may deal with us anonymously or by pseudonym for general enquiries, but this is generally not practicable once you engage us for the Services. If you are not satisfied with how we handle a complaint, you may contact the Office of the Australian Information Commissioner (see section 15).

10.7 Residents of India

Under the DPDP Act, you may have the right to obtain a summary of the personal data we process and the identities of those with whom we share it, to request correction, completion, updating, and erasure of your personal data, to have access to readily available grievance redressal, and to nominate another person to exercise your rights in the event of your death or incapacity. Please send grievances to info@ambott.com. If we do not resolve your grievance, you may approach the Data Protection Board of India.

10.8 Other locations

If you live elsewhere and local law gives you privacy rights, please contact us and we will respect those rights as required.

We send marketing messages only where you have opted in or where permitted by law, as stated in section 21 of the Terms. You can unsubscribe at any time by using the link in any marketing email or by emailing info@ambott.com. We will keep a minimal record to ensure we respect your opt-out. We will still send non-marketing messages that are necessary to deliver the Services, such as invoices, appointment details, and service notices. We contact you by phone or text for marketing only with your prior consent where the law requires it. We do not sell or rent our mailing lists.

The Website’s self-check and eligibility tools may produce an indicative score or result based on your answers. As the Terms explain, a score is an opinion about the strength of your record at a point in time, is for general information, and is not a prediction or promise of success. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our assessments and recommendations involve review by our team.

We may use software tools, including AI-assisted drafting and productivity tools, to help us operate and prepare materials. Where we use such tools with client information, we choose providers whose terms restrict them from using your content to train their general-purpose models, we limit the sensitive information we enter into them, and our team reviews all output before it is used. Drafts remain subject to your review and approval, as set out in section 6 of the Terms.

To deliver the Services, you may give us personal information about other people, such as referees, colleagues, employers, co-authors, or family members who are dependants on your application. By doing so, you confirm that you have the right to share that information with us, that you have told those people that you are doing so and that we may contact them where relevant, and that the use described in this Policy is consistent with their reasonable expectations.

We use information about other people only to provide the Services. We contact referees, endorsers, and nominators only on your behalf and with your consent, as stated in section 7 of the Terms.

If you are a referee, endorser, or nominator whom we have contacted, we obtained your contact and professional details from the person we are assisting, or from public sources. We use them only to ask for your support and to help prepare materials that you review, adopt, and sign in your own voice. You may ask us to stop contacting you, or to access, correct, or delete your details, by emailing info@ambott.com.

Redacted evidence samples on the Website are drawn from filed cases with identifying details removed. As stated in section 5 of the Terms, you must not attempt to identify any individual from them.

The Website and the Services are not directed to anyone under 18, and, as set out in section 22 of the Terms, you must be at least 18 to purchase the Services. We do not knowingly collect personal information directly from children. Where a client’s application includes dependent children, we process their information only as provided by the parent or legal guardian and only to the extent necessary. If you believe a child has given us personal information without parental consent, please contact us and we will delete it.

We would like the chance to address your concerns first. Please contact us at info@ambott.com and we will aim to resolve your complaint promptly and in good faith. You also have the right to complain to a data protection authority, including:

• United Kingdom: the Information Commissioner’s Office (ICO), https://ico.org.uk;
• European Economic Area: the supervisory authority in the country where you live, work, or where you believe an infringement occurred;
• Australia: the Office of the Australian Information Commissioner (OAIC), https://www.oaic.gov.au;
• California: the California Attorney General, https://oag.ca.gov/privacy, and the California Privacy Protection Agency; and
• India: the Data Protection Board of India, after first raising your grievance with us.

The Website links to government websites, publications, and other third-party resources, and may contain embedded content from third parties. We do not control these third parties and are not responsible for their privacy practices. As stated in section 15 of the Terms, a link is not an endorsement. We encourage you to read the privacy notices of any site you visit. If you interact with us through social media, that platform’s policies also apply.

We may update this Policy from time to time to reflect changes in our practices, the Services, or the law. The “Last updated” date at the top shows the latest version. We will notify you of material changes on the Website or by email where appropriate and, where the law requires, obtain your consent to new uses of your information. Your continued use of the Website after an update takes effect means that you accept the updated Policy, but this does not override any right you have under applicable law.

If you have questions about this Policy or want to exercise your privacy rights, please contact us:

Email

info@ambott.com

Phone

+1 945 378 0427

Website

https://ambott.com