Privacy Policy

CONSLINQ

Last updated: 18 October 2026 · Version 1.1

1. Who we are

CONSLINQ is an operational platform for licensed immigration and relocation consulting firms in the European Union. It is operated by:

Gresys Hub Unip. Lda. Industrial Zone, Lote 4, Door 1 Cadaval 2550-171 Lisbon, Portugal

NIF: 517174065

For any privacy-related enquiry, contact us at legal@conslinq.com.

We are established in Portugal and therefore fall under the supervision of the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority.

2. Two different relationships — please read this section first

This policy covers two distinct situations, and which one applies to you determines your rights and who you should contact.

2.1 If you are a consulting firm using CONSLINQ

When a licensed consulting firm signs up for and uses CONSLINQ, we act as a data controller in respect of that firm's own account information — the details of the firm and its team members, billing information, and support correspondence. Sections 3, 5 and 6 of this policy describe how we handle that data.

2.2 If you are a client of a consulting firm that uses CONSLINQ

If you are an individual receiving immigration, visa or relocation services, and your consultant uses CONSLINQ to manage your case, then the consulting firm is the data controller of your personal data. We act only as a data processor on that firm's behalf. We process your data solely on their documented instructions, as set out in a Data Processing Agreement between us and them.

Your data protection rights — access, correction, deletion, portability, restriction, and objection — must be exercised with the consulting firm directly. They are the controller of your data and the party legally responsible for responding to you. We cannot act on your request without their instruction.

If you contact us at legal@conslinq.com in error, we will forward your enquiry to the relevant consulting firm and let you know that we have done so. We will not respond to the substance of your request ourselves.

Section 4 describes what we process in this capacity, for transparency.

3. Data we collect as a controller

We collect and process the following categories of personal data in our own right:

We do not operate advertising, behavioural profiling, or automated decision-making that produces legal or similarly significant effects. We do not use analytics or tracking cookies. See Section 10.

4. Data we process on behalf of consulting firms

When a consulting firm uses CONSLINQ, we store and process personal data relating to their clients and those clients' family members. Depending on the services the firm provides, this may include:

• Identifying information — name, date of birth, nationality, contact details
• Family relationships and details of dependants or accompanying persons
• Documents uploaded in support of an application, which may themselves contain a wide range of personal data
• Case progress records, correspondence notes, and status history
• Payment records and proof-of-payment documents

A consulting firm, or one of its clients, may invite a family member to create their own account so they can follow specific cases. That family member sees only what the firm and the client allow, and their account details are processed in the same way as other account data described in Section 3.

Passport numbers are held under specific additional safeguards. They are encrypted at the application layer, separately from general database encryption. They are never displayed by default in list views; each individual reveal requires a deliberate action and is recorded in an audit log identifying who accessed the record and when.

Some of this data constitutes sensitive or high-risk personal data, particularly where a case involves special-category information such as health data for medical visas or family status for reunification cases. We apply the safeguards described in Section 8.

What we do not process on behalf of firms. Firms should not use the platform to store or process payment card data, biometric data, internal legal advice or privileged communications not intended for client cases, or any other data outside the scope of the case management purposes for which the platform is designed.

We process this data only on the instructions of the consulting firm. We do not use it for our own purposes, do not sell it, and do not disclose it to third parties except as described in Section 7 or where required by law (see Section 11).

5. Legal bases for processing

Where we act as a controller (Section 3), we rely on the following legal bases under Article 6 GDPR:

6. How long we keep data

Account and firm data (as controller): retained for the duration of the customer relationship and for a reasonable period afterwards to handle any residual contractual or legal matters.

Enquiry data (as controller): retained for as long as needed to handle the enquiry and any follow-up.

Client case data and documents (as processor). Immigration case records in Portugal are subject to a statutory retention period of seven years. The platform is architected so that case data and documents persist until they are deliberately deleted by the consulting firm as controller. The firm is responsible for exercising deletion in accordance with its own retention policy and applicable law. Automated retention enforcement — under which the platform would itself delete case data after a defined period — is in development and will be introduced in a future release. Until it is deployed, no automated deletion of case data occurs beyond the following:

• Soft-deleted documents (documents deleted by a user through the interface) are permanently deleted after a 30-day recovery period.
• The consulting firm may delete individual documents, cases, or client records at any time. Such deletions are audit-logged.

Consulting firms are reminded through the Data Processing Agreement that where a statutory retention period applies, they must not delete records within that period.

Audit and access logs (as processor). The platform retains an append-only audit log of state changes, document access, and sensitive-data reads. These logs are retained for the duration of the customer relationship and are used to demonstrate accountability over the lifetime of a case record. A defined maximum retention period for audit records has not yet been set; this is under review and will be introduced in a future release.

7. Sub-processors and international transfers

We use a small number of infrastructure providers to deliver the service. Each is bound by a written agreement containing GDPR-compliant data processing terms.

Data residency. Customer and client case data at rest is stored on infrastructure located within the European Union. Application compute is region-pinned to Frankfurt so that case data does not routinely leave the EU in the course of normal operation.

International transfers. Some of our sub-processors are incorporated in the United States, and in the case of Resend, delivery logs are stored there. Where a transfer of personal data outside the European Economic Area occurs, it is carried out under an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or an adequacy decision. The mechanism relied upon for each sub-processor is identified at conslinq.com/subprocessors.

Changes to sub-processors. We will update this list before engaging a new sub-processor or making a material change to an existing sub-processor relationship. Consulting firms will be notified at least 30 days before the change takes effect and may object under the terms of the Data Processing Agreement between us.

8. How we protect data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold.

Technical measures.

• Encryption of passport numbers. Passport numbers are encrypted at the application layer, separately from general database encryption. Every decryption is individually recorded in an audit log identifying who accessed the record and when. Passport numbers are never displayed by default in list views; they must be deliberately revealed, and each reveal is logged.
• Encryption in transit and at rest. All connections use HTTPS. Uploaded documents are stored encrypted at rest and are accessible only via short-lived signed links.
• Tenant isolation. Each consulting firm's data is logically isolated. Users of one firm cannot access another firm's records. Isolation is enforced at the application layer and backstopped by database-level policies.
• Access controls within a firm. Access within a firm is governed by role — consultants, affiliates, and clients each see only what their role permits.
• Audit logging. State changes, document downloads, and sensitive-data reads are recorded in an append-only audit log.
• EU data residency. As described in Section 7.

Organisational measures.

• CONSLINQ is currently operated by a small team. Access to production infrastructure is limited to named individuals whose actions in production systems are themselves logged. As the team grows, access will remain governed by the principle of least privilege and new personnel will be subject to appropriate background checks and confidentiality obligations.
• We review these measures as the platform develops and as the risk profile of the customer base evolves.

Breach notification. In the event of a personal data breach affecting a consulting firm's data, we will notify the affected firm without undue delay and in any event within 72 hours of becoming aware of the breach, together with the information required under Article 33(3) GDPR to the extent then known. The firm, as controller, is then responsible for any onward notification to affected data subjects or to the supervisory authority.

No system can be guaranteed absolutely secure, but we take these obligations seriously and treat security as an ongoing programme rather than a fixed state.

9. Your rights

Under the GDPR you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and to object to processing based on legitimate interests.

How to exercise these rights depends on which relationship applies to you:

• If you are a consulting firm or a member of a firm's team — contact us at legal@conslinq.com. We will acknowledge your request without undue delay and respond substantively within one month, as required by the GDPR. That period may be extended by up to a further two months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension within one month.
• If you are a client of a consulting firm — contact your consulting firm directly. They are the controller of your data and are responsible for responding. If you contact us in error, we will forward your enquiry to the firm and confirm to you that we have done so; we will not respond to the substance of the request ourselves.

You also have the right to lodge a complaint with a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. You may also complain to the supervisory authority in your own country of residence.

10. Cookies

CONSLINQ uses only strictly necessary cookies — those required to keep you signed in and to maintain your session and interface preferences. We do not use advertising, tracking, or analytics cookies. Because these cookies are strictly necessary for the service to function, no consent banner is required under Article 5(3) of the ePrivacy Directive as implemented in Portugal.

11. Requests from public authorities

We may receive requests for access to personal data from courts, law enforcement, or other public authorities. When we do:

• We assess each request for legal validity, and we resist requests that are overbroad or that we consider unlawful.
• Where a request concerns data we process on behalf of a consulting firm, we will notify the affected firm of the request without undue delay, unless we are legally prohibited from doing so.
• We disclose only what we are legally required to disclose.
• We maintain a record of all such requests received.

We do not provide bulk access, direct database access, or standing surveillance capabilities to any authority.

12. Data protection officer

We have not appointed a Data Protection Officer. Article 37 GDPR requires appointment of a DPO where a controller or processor's core activities involve large-scale regular and systematic monitoring of data subjects, or large-scale processing of special-category or criminal-conviction data. Our current scale of processing — a bounded number of licensed consulting firms and a correspondingly bounded number of data subjects — does not, in our assessment, meet the "large-scale" threshold as elaborated by the European Data Protection Board.

We will revisit this position at each material stage of growth.

As an entity established in Portugal, we are not required to appoint an EU representative under Article 27.

13. Age

CONSLINQ accounts are only available to people aged 18 or over, and we check this when an account is created. Information about younger people, such as children included in a family application, may be held within a case on behalf of the consulting firm, but they cannot hold an account.

14. Changes to this policy

We may update this policy as the platform develops or as legal requirements change. The version and date at the top of this document indicate when it was last revised. Where changes are material, we will notify subscribing firms directly by email to the tenant owner, at least 30 days before the change takes effect where the change is reasonably capable of that notice period. Historical versions will be made available on request.

15. Contact

Gresys Hub Unip. Lda. Industrial Zone, Lote 4, Door 1 Cadaval 2550-171 Lisbon, Portugal NIF: 517174065

Email: legal@conslinq.com