Privacy policy

To prepare your request we collect information you provide, including:

• Identity and application details — full legal name, date of birth, country of birth, UCI, and application number;
• Identity documents — such as a passport bio page or other government-issued ID;
• Consent documentation — the signed IMM 5744 form and, where applicable, court orders;
• Representative details — for professional requests, the named authorized representative and firm;
• Contact and account information — email address and authentication credentials;
• Payment-related information — processed by our payment provider; we do not store full card numbers.

We use your information solely to prepare, validate, and help you submit your ATIP request to IRCC or CBSA, to operate your account and dashboard, to communicate about your requests, and to meet our legal obligations. We do not sell your personal information, and we do not use it for any purpose unrelated to your request without your consent.

We collect, use, and disclose your personal information with your consent. Where you request records on behalf of another person, a valid, signed IMM 5744 consent is required. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice; doing so may prevent us from completing your request.

Your information is encrypted in transit (TLS) and at rest (AES-256). Documents are stored in Canada (AWS ca-central-1) in a private object store that blocks all public access; files are served only through short-lived signed links and are never cached in a content delivery network. Access is limited to authorized personnel and logged. We are migrating all database storage to a Canadian region to complete end-to-end Canadian data residency.

We disclose your request package to IRCC or CBSA as necessary to fulfil your request through the official Government of Canada ATIP Online Request Service. We rely on a small number of service providers (for hosting, database, object storage, email, and payments) who process data on our behalf under contractual safeguards. We do not otherwise disclose your personal information except where required or permitted by law.

We retain your information only as long as necessary to fulfil the purposes described here or as required by law. A signed IMM 5744 consent is valid for one year from the applicant's signature date and may be reused for further requests within that period; we prompt for re-signature as expiry approaches. You may request deletion of your information, subject to legal retention requirements.

Under PIPEDA you have the right to access the personal information we hold about you, to request corrections, and to ask about our handling of your information. To exercise these rights, contact us at privacy@mygcms.com.

We use strictly necessary cookies — a secure session cookie to keep you signed in and a preference cookie to remember your language. We do not use advertising cookies.

Transactional messages about your requests are sent as part of the service. We will only send marketing communications with your express consent, and every such message includes an unsubscribe option, in accordance with Canada's Anti-Spam Legislation (CASL).

In the event of a breach of security safeguards involving a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA, and maintain records of breaches.

We may update this policy from time to time. Material changes will be posted here with a revised effective date.

Privacy questions or requests: privacy@mygcms.com. Zahata Global Inc. (Corporation no. 1784465-4).