Privacy Policy

Shoreline Migration Pty Limited (ACN 700 192 829, ABN 64 700 192 829) trades as Shoreline Migration. In this policy, "we", "us" and "our" mean that company. "You" means anyone who visits this website, makes an enquiry, attends a consultation or engages us to act.

Two sets of standards govern how we handle personal information, and we want to be precise about which is which.

The first is binding. Immigration assistance is regulated, and the Code of Conduct made under the Migration Act 1958 (Cth) imposes a strict duty of confidentiality on a registered migration agent: client information is not disclosed to a third person without the client's written consent, unless a law requires it. The Code also governs how client documents are kept, returned and retained. Those duties bind us in the work we do, and they are stricter than general privacy law.

The second we adopt by choice. The Privacy Act 1988 (Cth) applies by threshold: to businesses with an annual turnover above $3 million, and to smaller businesses in defined categories such as health service providers and credit reporting bodies. A new practice of our size sits below that threshold.

We think that is beside the point. A migration file holds health information, criminal history, family relationships and financial records, and the standard that should govern it does not depend on our turnover. We handle personal information in accordance with the Australian Privacy Principles, and this policy is written on that basis. Where the Act applies to us as a matter of law, we comply with it as a matter of law. If our position changes, through growth, through a change to the threshold, or by our own election to opt in, nothing about how we handle your information changes, because we already work to the standard.

What we hold depends entirely on how far our dealings go. Someone who reads this site and leaves gives us almost nothing. Someone whose application we prepare gives us a great deal.

• If you only visit the website: nothing that identifies you. The site sets no tracking cookies and runs no analytics.
• If you send an enquiry: your contact details and what you choose to tell us.
• If you attend a consultation: information about your circumstances, immigration history and objectives.
• If you engage us: the identity, personal, family, employment, qualification, financial, health and character information that the relevant visa criteria and our professional obligations require.

We ask for what the applicable criteria and our obligations require, and not more. If you are unsure why something is needed, ask, and we will tell you which requirement it goes to.

Some of what a migration matter requires is sensitive information under the Privacy Act. Health information is the clearest example, because most visas involve health examinations. Criminal record information is another, because the character requirement asks for it. In protection, humanitarian and partner matters, information about a person's race, ethnic origin, religious beliefs, political opinion or sexual orientation may also be central to the claim.

We collect sensitive information only with your consent, and only where it is reasonably necessary for the work you have asked us to do. You may decline. We will tell you plainly what the consequence is for your application, which is sometimes that it cannot proceed.

Children, and people who need assistance. Where an applicant is a child, their information is given to us by a parent or guardian, and we deal with that parent or guardian. Where an adult client needs assistance to give instructions, we take instructions from the client and arrange an interpreter or other support as required. We do not take instructions about an adult from someone else.

Wherever we can, we collect personal information directly from you – in what you send us, what you tell us in a consultation, and the documents you provide.

• From people you authorise, such as a partner, sponsor, employer or family member who is part of the same matter.
• From the Department of Home Affairs, where you have authorised us to act and to obtain your records.
• From skills assessing authorities, education providers, panel physicians and other bodies involved in your application, with your authority.
• From public registers, where a matter requires it, for example to verify a business or a qualification.

People sometimes send us more than we need, particularly early on. If we receive personal information we did not ask for and could not lawfully have collected, we destroy it or de-identify it, unless the law requires us to keep it.

A migration matter almost always involves information about people other than our client: a sponsor, a nominating employer, a family member, a referee, a business partner, sometimes a former partner. We hold that information because the visa criteria require it.

If you give us information about someone else, you should tell them you have done so, and you should be satisfied you are entitled to give it to us.

If information about you has been given to us by someone else as part of their matter, you may ask us what we hold about you and why. We will tell you what we can, and we will say where we cannot, because our duty of confidentiality is owed to our client and we do not set it aside because someone else asks.

Migration work cannot be done anonymously, and we would rather say so plainly than let you discover it later.

We can answer a general question about how a visa works without knowing who you are. But a general answer is all it can ever be. We cannot assess your position without the facts of your position, we cannot advise you without knowing whose circumstances we are advising on, and we cannot act for you at all without verifying your identity, which the Code of Conduct requires before we give immigration assistance on a matter.

Our enquiry form asks for your name and an email address for that reason. An enquiry we cannot reply to, from a person we cannot identify, is of no use to you and of no use to us.

If someone else contacts us for you, such as a family member, a friend, an employer or an education agent, we are required to take reasonable steps to verify who they are, and to be satisfied that you have agreed in writing to them dealing with us on your behalf. The same applies to anyone dealing with us for a sponsor or nominator. That is not a formality we invented. It exists so that nobody speaks for you, or receives information about you, without your authority.

We use your personal information to do the work you have engaged us to do, and for nothing else.

• To assess your position against the law as it stands and to advise you on it.
• To prepare, lodge and manage applications, and to respond to requests from decision-makers.
• To act for you in a review, where you have asked us to.
• To keep the client records our professional obligations require.
• To answer your questions, and to contact you about your matter.

We do not sell personal information. We do not disclose it for anyone else's marketing. We do not use your matter as a case study or an example without your written consent.

The Code of Conduct sets the rule here, and it is a strict one: we must not disclose personal information about a client or former client to a third person without that client's written consent, unless a law of the Commonwealth, a State or a Territory requires it.

Migration work nonetheless requires disclosure, because an application is information given to a decision-maker. That is why, when you engage us, your written authority covers the disclosures your matter needs. Within that authority, recipients may include:

• the Department of Home Affairs, and the Administrative Review Tribunal where a review is on foot;
• skills assessing authorities, State and Territory nominating bodies, panel physicians and the health assessment service used by the Department, English language test providers, registration boards, police and character checking agencies, education providers, and translators or interpreters;
• a sponsor, employer or family member party to the same application, where you have authorised it;
• regulators and other bodies, where required or authorised by law;
• our insurers and professional advisers, where reasonably necessary.

Beyond the purposes described in this policy, we disclose personal information only with your written consent or where a law requires it.

Client records are held in access-controlled business systems under our own administrative control, selected with Australian data residency where it is available. This website holds no client files.

We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps cover our systems, our accounts and our handling of documents, and we review them as the practice develops. We do not publish the detail of our security arrangements, for the obvious reason.

Some providers we rely on are global businesses that may process limited information outside Australia. Before engaging a provider we consider where information will be held, the protections that apply to it and whether the arrangement is consistent with our cross-border disclosure obligations.

If you want to know which providers we use, and where information given to them is held, ask us and we will tell you.

No system can be guaranteed secure, and we do not suggest otherwise.

We do not record consultations or meetings. If either of us wants a recording made, we will both agree to it in writing first.

We do make written notes. A registered migration agent is required to make a contemporaneous written record of what a client says and what the agent advises, and those notes go on the file.

The website is deliberately quiet. As published, it sets no tracking cookies, runs no analytics, carries no advertising pixels and shares nothing with third parties for marketing.

No cookie is set. The only thing this site keeps is the choice you make in the cookie notice, stored in your own browser (not in a cookie) so that the notice does not ask again; it records the date of your choice and nothing that identifies you.

Our hosting provider keeps standard server logs, which include IP addresses, for security and reliability.

The enquiry form sends what you write to us by email. It is not stored on the website.

Booking a consultation. Consultations are booked through Microsoft Bookings, a scheduling service within our Microsoft 365 subscription that we administer and that opens from this website as a separate page. What you enter there, your name, contact details and your answers to the booking questions, is held in our Microsoft 365 tenant with our other business records (see section 10), not on this website, and Microsoft processes it only as our service provider. The booking page sends you a one-time code by email before it accepts a booking, is kept out of search engines, and sets no tracking cookies on this website. Please do not put passport numbers, documents or medical details into the booking form; we ask for them separately, when they are needed, through a secure channel.

If we start measuring how the site is used. We may want to know which pages people actually read, so that we write more of what helps and less of what does not. If we do, we will set out here what tool we use, what it collects, whether it sets a cookie, and where the data is held. We will take the most privacy-preserving option that answers the question, which for our purposes means aggregate, cookieless measurement rather than tracking individuals across visits. We will not add advertising pixels, and we will not share usage data with advertising networks.

If we later add anything else that changes this, such as embedded media, a payment facility or a chat function, we will update this policy and put the appropriate controls in place before it goes live, not afterwards.

The Code of Conduct requires a registered migration agent to keep a client file for seven years after the last action on that file. That is an obligation on us, not a preference, and it is there so that a client's matter can be accounted for long after it closes.

It follows that we cannot delete your file on request during that period, and we will tell you so plainly rather than agree and not do it. You may of course ask us to correct information that is wrong.

You can ask us at any time to return the documents you gave us. Where you make that request in writing we return them promptly, and we do not hold client documents as security for payment.

Enquiries that do not become matters are kept only while there is a reason to keep them. When a retention period ends, records are securely destroyed or de-identified.

If we suspect a data breach, we assess it promptly. Where an eligible data breach is likely to result in serious harm, we notify the individuals affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

You may ask for access to the personal information we hold about you, and you may ask us to correct it if it is wrong. Ask in writing.

We aim to respond within 30 days. That is the standard we set ourselves rather than a deadline imposed on us, and where a request is complex we will tell you why more time is needed and when to expect an answer.

There are limited circumstances in which access may properly be refused or given in another form – for example where providing it would unreasonably affect another person's privacy, which arises more often than you might expect in matters involving families and sponsors. If we refuse, we will tell you why in writing and how to take the matter further.

If you believe we have mishandled your personal information, tell us first. Put the complaint in writing and send it to the email address on our contact page. We will acknowledge it, look into it properly and aim to respond within 30 days – again, our own standard.

If you are not satisfied with our response, a complaint about the professional conduct of a registered migration agent may be made to the Office of the Migration Agents Registration Authority. Where the Privacy Act applies to us, you may also complain to the Office of the Australian Information Commissioner.

Raising a complaint does not affect how we act for you.

If you ask us to send you our updates, we keep your name and email address for that purpose and for nothing else. We do not add people who have not asked, we do not buy or exchange lists, and we do not pass ours to anyone.

Every update carries an unsubscribe link that works. We act on an unsubscribe within five working days, and the link keeps working for at least 30 days after the message is sent. Every update identifies us by our business name with contact details that stay accurate.

Unsubscribing from updates does not affect anything else. If we act for you, you keep receiving correspondence about your matter, because that is not marketing.

Migration practice and privacy law both change, and this policy will change with them. The current version is always the one published here, with the date it was last updated shown below.