Privacy Policy

Effective Date: November 24, 2025
Last Updated: November 24, 2025

1. Introduction and Scope

Elizabeth Rosario Law ("we," "us," "our," or "the Firm") is committed to protecting the privacy and confidentiality of all individuals who visit our website or use our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with applicable laws, including but not limited to:

• California Consumer Privacy Act (CCPA)
• General Data Protection Regulation (GDPR) for EU citizens
• Attorney-client privilege and professional responsibility rules
• Federal and state data protection laws
• International privacy standards for clients accessing from Mexico and other countries

By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide to us, including:

• Contact Information: Name, email address, phone number, mailing address
• Immigration Case Information: Visa type, immigration status, country of origin, case details, supporting documents
• Identification Information: Date of birth, passport information, social security number (when necessary for legal services)
• Family Information: Information about family members relevant to your immigration case
• Employment Information: Current and past employment history
• Financial Information: Payment information for legal services (processed through secure third-party payment processors)
• Communications: Emails, messages, form submissions, phone call recordings (with consent), and any other correspondence

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, referring website
• Location Data: General geographic location based on IP address
• Cookies and Tracking Technologies: Session cookies, persistent cookies, web beacons, and similar technologies

2.3 Information from Third Parties

We may receive information about you from government agencies (USCIS, immigration courts), background check services, and other sources necessary for providing legal representation.

3. How We Use Your Information

We use your information for the following legitimate purposes:

• Legal Services: Providing immigration legal representation, preparing applications, court representation
• Case Evaluation: Assessing your eligibility for immigration benefits
• Communication: Responding to inquiries, providing case updates, sending appointment reminders
• Billing and Payments: Processing payments and maintaining financial records
• Legal Compliance: Complying with court orders, government requests, and legal obligations
• Website Improvement: Analyzing website performance and user experience
• Marketing: Sending newsletters and promotional materials (only with your consent, and you may opt out at any time)
• Security: Protecting against fraud, unauthorized access, and security threats
• Professional Development: Case studies and testimonials (only with explicit written consent and anonymization)

4. Legal Basis for Processing (GDPR)

For individuals in the EU or subject to GDPR, we process your data based on:

• Contract Performance: Processing necessary to provide legal services you requested
• Legal Obligation: Compliance with legal and regulatory requirements
• Legitimate Interests: Operating our business, preventing fraud, improving services
• Consent: Where you have given explicit consent for specific purposes

5. Information Sharing and Disclosure

5.1 We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5.2 Authorized Disclosures

We may share your information with:

• Government Agencies: USCIS, Department of State, Immigration Courts, and other relevant government entities as required for your case
• Service Providers: Document translation services, court reporters, expert witnesses, process servers, background check services
• Technology Providers: Cloud storage providers, email services, payment processors, website hosting (all contractually bound to protect your data)
• Legal Obligations: When required by law, court order, subpoena, or legal process
• Professional Consultants: Other attorneys, accountants, or experts necessary for your representation (under confidentiality agreements)
• Business Transfers: In the event of a merger, acquisition, or sale of assets (your data would remain subject to this Privacy Policy)
• With Your Consent: Any other disclosure you specifically authorize

5.3 Protection During Disclosure

All third parties who receive your information are contractually obligated to maintain confidentiality and security. We use Business Associate Agreements and Data Processing Agreements as appropriate.

6. Data Security and Protection

We implement comprehensive security measures including:

• Encryption: SSL/TLS encryption for data transmission, encrypted storage for sensitive documents
• Access Controls: Multi-factor authentication, role-based access, password policies
• Physical Security: Secure office premises, locked file cabinets, restricted access areas
• Technical Safeguards: Firewalls, antivirus software, intrusion detection systems, regular security updates
• Employee Training: Regular training on confidentiality, data protection, and security best practices
• Incident Response: Procedures for detecting, responding to, and reporting security incidents
• Secure Disposal: Secure destruction of documents and data when no longer needed

Important Notice: While we implement strong security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for different periods depending on the purpose:

• Client Files: Maintained for at least 7 years after case completion, as required by professional responsibility rules
• Financial Records: Retained for 7 years for tax and accounting purposes
• Marketing Data: Until you opt out or request deletion
• Website Analytics: Typically 26 months
• Legal Holds: Indefinitely when required by litigation or investigation

After retention periods expire, we securely delete or anonymize your information unless longer retention is required by law.

8. Your Privacy Rights

8.1 Rights for All Users

• Access: Request copies of your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your information (subject to legal retention requirements)
• Opt-Out: Unsubscribe from marketing communications at any time
• Object: Object to certain types of processing
• Withdraw Consent: Withdraw consent for processing based on consent

8.2 California Residents (CCPA/CPRA Rights)

If you are a California resident, you have additional rights:

• Right to Know: Categories and specific pieces of information we collect
• Right to Delete: Deletion of personal information (with exceptions)
• Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell)
• Right to Non-Discrimination: Equal service regardless of exercising privacy rights
• Right to Correct: Correction of inaccurate personal information
• Right to Limit: Limit use of sensitive personal information

8.3 EU Residents (GDPR Rights)

• Right of Access: Obtain confirmation of processing and access to data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: "Right to be forgotten" under certain circumstances
• Right to Restrict Processing: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Rights Related to Automated Decision-Making: Protection from solely automated decisions
• Right to Lodge a Complaint: File a complaint with your local data protection authority

8.4 Limitations on Rights

These rights are subject to legal limitations. For example, we cannot delete information required for legal compliance, active litigation, or maintaining attorney-client privileged communications. We may need to verify your identity before processing requests.

8.5 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: privacy@elizabethrosariolaw.com
• Phone: (855) 627-2292
• Mail: Elizabeth Rosario Law, Privacy Officer, 545 28th St SW, Wyoming, MI 49509

We will respond to verified requests within 45 days (or as required by applicable law). You may designate an authorized agent to make requests on your behalf.

9. International Data Transfers

Our servers are located in the United States. If you are accessing our services from outside the U.S. (including Mexico, EU, or other countries), your information will be transferred to, stored, and processed in the United States. U.S. data protection laws may differ from those in your country.

For EU residents, we rely on Standard Contractual Clauses approved by the European Commission for international transfers. By using our services, you consent to the transfer of your information to the United States.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

• Essential Cookies: Required for website functionality, security, and navigation
• Analytics Cookies: Help us understand website usage and improve user experience
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track effectiveness of advertising campaigns (only with consent)

10.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality. Most browsers allow you to refuse cookies, delete cookies, or receive warnings before cookies are stored.

10.3 Do Not Track

Some browsers include "Do Not Track" features. Our website does not currently respond to Do Not Track signals.

11. Third-Party Links and Services

Our website may contain links to third-party websites, including government agencies (USCIS.gov), payment processors, and other resources. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing any information.

12. Children's Privacy

Our website is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately so we can delete it.

When we represent minor children in immigration matters, we work with their parents or legal guardians and handle their information in accordance with applicable laws and professional ethics rules.

13. Marketing Communications

We may send you marketing emails about our services, immigration news, and legal updates. You can opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Emailing us at info@elizabethrosariolaw.com
• Calling us at (855) 627-2292

Even if you opt out of marketing communications, we may still send you transactional emails related to your case or account.

14. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify you and relevant authorities as required by applicable law. Notification will typically occur within 72 hours of discovering the breach (or as required by law) and will include:

• Description of the breach and types of information affected
• Steps we are taking to address the breach
• Recommendations for protecting yourself
• Contact information for questions and assistance

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised Privacy Policy on our website
• Notify you via email if the changes are significant (for active clients)
• Provide at least 30 days' notice for material changes

Your continued use of our services after the effective date of changes constitutes acceptance of the updated Privacy Policy.

16. Attorney-Client Privilege and Confidentiality

This Privacy Policy does not diminish or alter the attorney-client privilege and confidentiality protections that apply to our relationship with clients. Once you become a client:

• All communications are protected by attorney-client privilege
• Information cannot be disclosed without your consent (except as required by law or ethics rules)
• We are bound by professional responsibility rules regarding confidentiality
• Attorney-client privilege survives this Privacy Policy and continues indefinitely

17. Compliance and Regulatory Information

We comply with:

• State Bar ethical rules and professional responsibility requirements
• Federal and state privacy laws including CCPA, GDPR, and sector-specific regulations
• Immigration practice confidentiality requirements
• Anti-money laundering (AML) and Know Your Customer (KYC) regulations
• Data localization requirements where applicable

18. Contact Information and Privacy Officer

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

19. Dispute Resolution

Any disputes regarding this Privacy Policy shall be resolved in accordance with the dispute resolution provisions in our Terms of Service. For EU residents, you have the right to lodge a complaint with your local supervisory authority.

20. Accessibility

We are committed to ensuring this Privacy Policy is accessible to all individuals. If you need this policy in an alternative format (large print, audio, different language), please contact us.