Privacy Policy

1. Controller and privacy contact

EstaEta.com is operated by Arc Techno Pty Ltd (ABN 64 643 149 848; ACN 643 149 848), 47 Hill Road, Wentworth Point, NSW 2127, Australia. Arc Techno Pty Ltd controls the private EstaEta platform information described in this policy, subject to applicable law and professional obligations for regulated Canadian immigration services. Privacy and data-rights requests can be sent to hello@estaeta.com.

2. Canada eTA information we may collect

A Canada eTA matter may involve account and contact details, applicant identity information, date of birth, address, passport and travel-document details and uploads, nationality and immigration-status information, trip details, answers to eligibility and background questions, information about refusals, criminality, health or admissibility where relevant to the matter, customer communications, application status information, declarations and consents, professional client-service and review records where applicable, transaction metadata, device/browser information, security logs and other information you choose or are required to provide for the requested service.

3. Information about minors and other applicants

Children and other people may need an individual eTA. If you provide information for another applicant, you must have authority to do so. We may collect information required for that applicant's service while using the parent, guardian or authorized person's contact and consent information where appropriate.

4. Purposes and lawful bases

We use personal information to provide the requested Canada eTA assistance service, create and secure accounts, preserve application progress, perform permitted administrative checks, communicate with customers, support regulated professional review and individualized eligibility assessment where required, administer authorized representation or submission steps, process and reconcile payment, prevent fraud and misuse, maintain professional/client records, resolve disputes and comply with legal or professional obligations. Depending on the processing activity and applicable law, the basis may include performance of a contract or requested pre-contract steps, compliance with legal or professional obligations, legitimate interests that are appropriately assessed and balanced for security, fraud prevention or service administration, and consent for optional analytics where consent is required. We do not rely on one blanket lawful basis for every processing purpose.

5. Administrative and regulated professional access

Arc Techno administrative and support personnel access application information only as reasonably required for permitted factual intake, administrative checks, customer support, billing, security and file administration. They do not independently provide Canadian immigration advice or make individualized eligibility assessments. The regulated professional and authorized support personnel may access relevant information as required for professional review, eligibility assessment, immigration advice, supervision, representation or authorized submission, subject to applicable professional and client-service obligations.

6. Government submission and official authorities

When a customer properly authorizes an application or representative process, application information may be provided to Immigration, Refugees and Citizenship Canada or another competent Canadian authority as required for that matter. Government systems and records are controlled by the relevant authority, not EstaEta.

7. Payment information

Payment-card details are processed through Stripe or another payment provider used by the active checkout workflow. EstaEta may receive transaction identifiers, payment status, amount, currency, payer identity and related metadata needed to administer the order, reconcile payment, issue receipts, handle refunds and respond to disputes. EstaEta does not store raw payment-card numbers or card security codes. Do not send full card numbers or security codes by email.

8. Technology and service providers

Current production service providers include Netlify for website hosting and delivery; Supabase for authentication, database services and private document storage; Stripe for payment processing; Google Workspace for business communications; and Google Analytics/Google Tag Manager only where optional analytics is affirmatively allowed. Access and disclosures are limited to the relevant service purpose. Providers are governed by their applicable contracts, processing terms, technical controls and legal obligations. Additional providers must be assessed before they are introduced to production personal-data processing.

9. Cookies, analytics and technical logs

Essential cookies or similar browser storage are used for requested account and application functions, authentication, security, session continuity, preferences and the record of your cookie choice. Google Analytics and Google Tag Manager are optional: analytics storage is denied by default and Google analytics scripts are not loaded for analytics use until you choose 'Allow analytics'. If you choose 'Essential only', optional analytics remains disabled and you can change the choice later through Cookie settings in the footer. Advertising storage, ad-user-data and ad-personalisation remain denied by default. Passport details, eTA answers and uploaded immigration documents must not be sent to advertising analytics.

10. No sale of passport or application data

EstaEta does not sell passport details, Canada eTA application answers or uploaded immigration documents to data brokers or advertisers. Application information is used for service delivery, security, legal/professional obligations and authorized government or representative processes described in this policy.

11. Other disclosures

Information may be disclosed to service providers, professional advisers, regulators, courts, law-enforcement bodies or other parties where reasonably necessary to provide the service, protect customers and systems, investigate fraud, enforce legal rights, comply with law, respond to valid legal process or satisfy professional/regulatory obligations.

12. International processing and safeguards

Arc Techno Pty Ltd is established in Australia, the service concerns Canadian immigration processes and technical providers may process information in other countries. Where European, UK or other cross-border data-transfer rules apply, we assess the relevant provider contract, processing location and transfer mechanism and use applicable safeguards, which may include data-processing agreements, Standard Contractual Clauses, an applicable adequacy decision, an applicable data-privacy framework or another recognised mechanism. Information about applicable safeguards can be requested from hello@estaeta.com, subject to protection of confidential and security-sensitive terms.

13. Security

EstaEta uses HTTPS with SSL/TLS encryption in transit, HSTS, a restrictive Content Security Policy, authentication, PostgreSQL Row Level Security, role-based access controls, private document storage, restricted browser capabilities, MFA/AAL2 controls for sensitive staff functions, security logging, deployment secret scanning and no-store caching instructions on sensitive account/application routes. The exact TLS cipher strength is negotiated between the visitor's browser and the delivery network, so EstaEta does not publish a fixed encryption-bit claim. No internet, email, device or storage system can be guaranteed completely secure.

14. Retention and deletion

An application draft that is abandoned and never becomes a retained client matter is automatically eligible for deletion after 90 days from its last save, provided it has no service agreement, payment record, professional review, submission unit or legal hold. A regulated client file is retained for at least six years after the file is closed to meet Canadian immigration-professional record-keeping requirements. Related service agreements and service/payment records are retained with that file where required. A legal hold, complaint, dispute or other applicable obligation can extend retention. After the mandatory period expires, the file is placed into controlled disposal review for secure deletion or appropriate minimisation rather than retained indefinitely without reason.

15. Your privacy choices and rights

Depending on the law that applies to you, you may have rights to request access to personal information, correction, erasure, restriction, portability, objection to certain processing or withdrawal of consent where consent is the legal basis. Send a request to hello@estaeta.com using the email connected with the account or order where possible. We may request proportionate information to verify identity. Where the GDPR or UK GDPR applies, we aim to respond without undue delay and within one month; a lawful extension may be used for a complex or numerous request and will be explained within the initial period. Erasure is not absolute and does not require deletion of records that must be retained under an applicable legal or professional obligation.

16. Marketing communications

Service messages about an active order are different from promotional communications. Where marketing messages are sent, you may use the available unsubscribe mechanism or contact us to stop marketing, subject to service communications still required for an active application or legal obligation.

17. Personal-data incidents

EstaEta maintains an incident register and response procedure. Suspected personal-data breaches are assessed for containment, affected information, likely consequences, evidence preservation and notification duties. Where the GDPR applies and supervisory-authority notification is required, the target is without undue delay and, where feasible, within 72 hours after awareness. Where applicable law requires affected individuals to be notified, that communication is handled without undue delay.

18. EEA and UK representation

Because Arc Techno is established in Australia, processing connected with an intentional offer of services to people in the EEA or UK can trigger additional territorial and representative requirements. Where a statutory EEA or UK representative is required for the relevant processing, the representative must be formally appointed in writing and its contact details must be published in the applicable privacy notice. No statement on this page should be read as claiming that an EEA or UK representative has already been appointed before a real appointment exists.

19. External websites

EstaEta links to Canada.ca and other external official sources for authoritative information. Those websites are operated by third parties and have their own privacy, cookie and security practices.

20. Changes to this policy

We may update this Privacy Policy to reflect changes in the Canada eTA service, technology providers, law, professional requirements or data practices. The current version and effective date will be published on this page. Material changes may also be communicated through the service where required.

21. Contact and complaints

Privacy requests or complaints can be sent to hello@estaeta.com with the subject 'Privacy request'. Include enough information to identify the relevant account or order and the request you are making. Do not send full payment-card details or passwords by email. If applicable law gives you the right to complain to a competent privacy or data-protection authority, that right is not limited by contacting us first.

Official Government of Canada alternative

Using EstaEta is optional. Official Canada eTA information and the direct government application are available from Canada.ca.

Official Government of Canada eTA application