Security and data protection
What we can send your COLP or DPO.
Your clients' data, handled on your instructions.
Your firm stays in control of client data and every application
Updated October 2026 · v5
You are the controller, Immigrationist is your processor, and your solicitor or adviser reviews and submits everything. For firms considering Immigrationist and anyone recommending it.
Download one-pager (PDF)Who does what
- Your firm is the controller. You decide what is collected, how long it is kept and what is submitted.
- Immigrationist is your processor (IMIGRACIONIST DOO NOVI SAD, Serbia), acting only on your documented instructions under a data processing agreement you receive before anything is uploaded.
- UK representative (Art. 27 UK GDPR): Broadway International Law Limited, 229 The Broadway, London SW19 1SD.
- No AI training. Client data is never used for our own purposes or to train AI models, ours or anyone else's.
A person reviews every application
Immigrationist prepares drafts. It does not give legal advice or decide anything.
- The client answers a guided questionnaire and uploads documents.
- Immigrationist pre-fills the visitor or Skilled Worker application and flags gaps and discrepancies.
- Your solicitor or adviser checks the draft, advises the client and decides what is submitted.
- Your firm signs off and submits. We may pre-fill the GOV.UK form, but never submit, pay or sign the declaration.
Where client data is held
| Service | Provider | Location |
|---|---|---|
| Application hosting | Vercel | United Kingdom (London) |
| Database | Neon | United Kingdom (London) |
| Processing | Modal Labs | United Kingdom, network routing via Ireland |
| Transactional email | Resend | European Union (Ireland) |
| AI drafting, document reading | Anthropic | United States |
US processing relies on standard contractual clauses and a transfer risk assessment. Our team in Serbia accesses matter data only to provide and support the service, under the ICO's International Data Transfer Agreement (IDTA) and a UK to Serbia transfer risk assessment your firm can review and adopt.
Security
- Encryption in transit and at rest.
- Access limited to named personnel under written confidentiality; access to matter files is logged.
- Each firm sees only its own matters.
Retention, breaches and requests
- Your firm sets retention. We delete or return data on request and at the end of the contract.
- Breach notice to your firm within 48 hours of our becoming aware.
- Data subject requests passed to your firm within 5 working days.
DPA with IDTA and transfer risk assessment available on request: info@immigrationist.io. privacy notice
Transfers from the UK
No tracking on this website
Request our data processing agreement and sub-processor list
Try it.
A 30-minute demo, then three applications on us so you can judge it on real work rather than a slide deck.
Book a demoThis opens Calendly, which sets its own cookies under its own privacy notice.