Privacy Policy

Notice at Collection

Pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), we provide this notice at or before the point of collection. The Law Offices of M. Riaz Musani, LLC ("we", "our", "the Firm") collects the following categories of personal information:

• Identifiers: name, postal address, email address, telephone number, IP address, passport / A-number, date of birth.
• Customer records: immigration history, family relationships, employment history, financial information necessary for legal representation.
• Sensitive personal information (CPRA §1798.140(ae)): government-issued identifiers, citizenship and immigration status, racial or ethnic origin where required by an underlying application, biometric data submitted to USCIS.
• Internet activity: browsing activity on this website, device identifiers, and interaction with our contact form.
• Professional / employment information: employer details, job title, wage history (where relevant to employment-based petitions).
• Inferences: none used for profiling or automated decision-making.

Purposes: to provide legal representation, comply with immigration and court rules, communicate with you, and operate this website. Retention: see "Data Retention" below. Sale / sharing: we do NOT sell or share personal information as those terms are defined under the CCPA/CPRA.

Information We Collect

We collect information you provide directly to us, including:

• Personal Information: Name, address, phone number, email address, date of birth, and other identifying information.
• Immigration-Related Information: Details related to your immigration case, visa documents, passport information, financial records, employment history, and family information necessary for legal representation.
• Communication Records: Emails, correspondence, phone call records, and other communications between you and our firm.
• Website Usage Data: IP addresses, browser information, device identifiers, and browsing activity when you visit our website.
• Financial Information: Payment processing information, billing details, and fee arrangements.

Sources of Personal Information

We collect personal information from:

• Direct interactions with you during consultations and case management.
• Immigration forms and supporting documents you provide.
• Third-party service providers such as translation services and document authentication services.
• Government agencies and immigration courts as required for legal proceedings.

How We Use Your Information

We use your personal information to:

• Provide Legal Services: Represent you in immigration matters, prepare applications, and communicate with government agencies.
• Legal Compliance: Meet our obligations under immigration law, court rules, and professional conduct requirements.
• Communication: Keep you informed about your case status, appointments, legal updates, and important deadlines.
• Improve Services: Analyze service delivery and enhance our legal representation capabilities.
• SMS Communications: If you opt in, we may send appointment reminders, case updates, and urgent notifications via text message. You can opt out anytime by replying "STOP".

Lawful Basis for Processing (GDPR)

Where the EU General Data Protection Regulation (Regulation (EU) 2016/679) or the UK GDPR applies, we rely on the following lawful bases (Article 6) and special-category bases (Article 9) for processing:

• Performance of a contract (Art. 6(1)(b)): To provide legal services under our engagement letter with you.
• Legitimate interests (Art. 6(1)(f)): To operate and secure our website, prevent fraud, respond to inquiries, and (where permitted) send firm news to existing clients. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)): For non-essential cookies, marketing emails, and for the processing of special-category data (e.g. ethnicity where required by an immigration form). You may withdraw consent at any time without affecting the lawfulness of earlier processing.
• Legal claims (Art. 9(2)(f)): Processing of special-category data necessary for the establishment, exercise, or defense of legal claims, including immigration matters.
• Legal obligation (Art. 6(1)(c)): To comply with court orders, U.S. immigration law, anti-money-laundering rules, and professional-conduct obligations.

Information Sharing and Disclosure

We maintain strict confidentiality as required by attorney-client privilege. We do not sell, trade, or otherwise transfer your personal information without your consent, except:

• Legal Requirements: When required by law, court order, or government agencies for legitimate immigration purposes.
• Professional Services: With authorized third-party providers (translators, expert witnesses, court reporters) who assist with your legal matter and are bound by confidentiality agreements.
• Emergency Situations: To protect your safety or comply with legal obligations.

Third-Party Processors and Service Providers

We rely on a small number of vetted third-party service providers ("processors" under GDPR, "service providers" under CCPA/CPRA) who are contractually prohibited from selling or using your personal information for their own purposes:

• Google Analytics (Google LLC): Aggregate, IP-anonymized website usage statistics. Loaded only after analytics-cookie consent. Google Privacy Policy.
• Firebase (Google LLC): Storage and routing of contact-form submissions. Firebase Privacy.
• Hosting provider: Serves this website and stores form submissions in transit. All traffic is encrypted with TLS.
• Email provider: Used to deliver consultation correspondence to our staff. Messages are protected by transport-layer encryption.

A current list of sub-processors is available on request by writing to riaz@musanilaw.com.

Do Not Sell or Share My Personal Information

International Data Transfers

We are based in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with cross-border transfer restrictions, your personal data will be transferred to and processed in the United States.

Where required, we rely on appropriate safeguards under GDPR Articles 44 - 49, including the European Commission's Standard Contractual Clauses (2021/914) with our processors and supplementary measures (TLS encryption in transit, access controls, contractual confidentiality). A copy of the safeguards is available on request.

Where you instruct us to submit immigration filings to U.S. government agencies (USCIS, DOS, EOIR, ICE, CBP), that disclosure is necessary for the performance of our engagement and is a derogation under Article 49(1)(b) GDPR.

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes set out in this policy and to comply with legal, regulatory, and professional-conduct obligations.

• Active client files: for the duration of the engagement.
• Closed client files: at least seven (7) years from the date the matter is closed, consistent with Connecticut and New York attorney recordkeeping rules and IRS Circular 230.
• Prospective-client inquiries: up to 24 months unless you ask us to delete sooner.
• Website analytics: aggregated and retained for up to 26 months by Google Analytics; raw logs are rotated within 30 days.
• Cookie-consent records: 12 months from the date of consent.

After the applicable retention period, records are securely deleted or anonymized unless we are required to keep them longer by law or court order.

Children's Privacy

This website is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). For users between 13 and 16, we do not engage in any "sale" or "sharing" of personal information as defined under CPRA §1798.120(c). If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly delete it. Parents or guardians who believe their child has provided personal information to us may contact riaz@musanilaw.com.

Note: where a parent or guardian engages our Firm on behalf of a minor (e.g. derivative beneficiary, U-visa, SIJS), we will collect information about the minor as necessary for the legal representation. That collection is governed by attorney-client privilege and our engagement agreement.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), as amended by the California Privacy Rights Act, grants you the following rights:

• Right to Know (§1798.110, §1798.115): Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we have disclosed it, in the past 12 months (or longer where you so request).
• Right to Delete (§1798.105): Request deletion of personal information we have collected from you, subject to statutory exceptions (e.g. completion of the engagement, compliance with legal obligations, security incidents, and exercise of free speech).
• Right to Correct (§1798.106): Request correction of inaccurate personal information we maintain about you, taking into account the nature and purposes of the processing.
• Right to Opt Out of Sale or Sharing (§1798.135): We do not sell or share your personal information. You may nonetheless exercise this right at any time; doing so will have no effect because no sale or sharing occurs. We honor Global Privacy Control browser signals automatically.
• Right to Limit Use of Sensitive Personal Information (§1798.121): Direct us to use sensitive personal information only as necessary to perform the services or as otherwise permitted. We do not use sensitive personal information for purposes beyond those reasonably necessary to provide legal services and comply with law.
• Right to Non-Discrimination (§1798.125): We will not deny services, charge different prices, or provide a different level of service because you exercised your privacy rights.
• Right to Authorized Agent: You may designate an authorized agent to submit a request on your behalf. We will require written authorization, signed and dated, plus verification of your identity.

EU / UK Privacy Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the GDPR / UK GDPR grants you the following rights (Articles 15 - 22):

• Right of Access (Art. 15): Obtain confirmation of whether we process your data and receive a copy together with information on the processing.
• Right to Rectification (Art. 16): Have inaccurate or incomplete personal data corrected without undue delay.
• Right to Erasure (Art. 17): Request deletion where the data is no longer necessary, consent has been withdrawn, or processing is unlawful. Subject to exemptions for legal claims and compliance with legal obligations.
• Right to Restriction (Art. 18): Restrict our processing where the accuracy is contested, the processing is unlawful, or you have objected to processing pending verification.
• Right to Data Portability (Art. 20): Receive a structured, commonly-used, machine-readable copy of data you provided to us on the basis of consent or contract, and have it transmitted to another controller where technically feasible.
• Right to Object (Art. 21): Object to processing based on our legitimate interests, including direct marketing. We will cease processing for direct-marketing purposes upon receipt of your objection.
• Automated Decision-Making (Art. 22): We do not engage in solely automated decision-making, including profiling, that produces legal or similarly significant effects on you.
• Right to Withdraw Consent (Art. 7(3)): Withdraw any consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint (Art. 77): Lodge a complaint with a supervisory authority - typically the one in your habitual residence or place of work. UK residents may contact the Information Commissioner's Office (ICO).

Submit a Privacy Request

To exercise any of the rights described above, use one of the following methods. We will verify your identity using information already on file (and, where necessary, additional documentation) before fulfilling a request.

Notice of Right to Know and Notice of Right to Delete:this section, together with the "Your California Privacy Rights" section above, constitutes the firm's combined Notice of Right to Know and Notice of Right to Delete under Cal. Civ. Code §§1798.105 and 1798.110.

Data Security

We implement comprehensive security measures including encryption, secure storage systems, access controls, and regular security assessments to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

Policy Updates

We review and update this privacy policy at least annually. Any material changes will be communicated to you via email or website notice.

Contact Information

For questions about this Privacy Policy or to exercise your privacy rights, contact our Privacy Officer at:

• Email (Privacy Officer): riaz@musanilaw.com
• Phone: (860) 938-1850
• Mailing Address (Privacy Requests):
  Attn: Privacy Officer
  Law Offices of M. Riaz Musani, LLC
  41 S Main Street, Suite 6
  West Hartford, CT 06107