Privacy policy

2.1 Website visits

When you open our website, the web server automatically records technical access data (server logs), in particular IP address, requested URL, date and time of access, volume of data transferred, browser type and version, and operating system. This data is technically required to deliver and protect the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free operation of the website). Log data is deleted as soon as it is no longer required for these purposes, unless statutory obligations prevent deletion.

2.2 Contact by form, email or phone

If you contact us by contact form, email or phone, we process your contact details and the content of your enquiry. For a visa enquiry, this includes name, email address, phone number, nationality and destination country. For enquiries about consular services or invitations, we also process the selected service and the additional details you provide. Processing is necessary to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps or contract performance) or Art. 6(1)(f) GDPR (legitimate interest in answering other enquiries). The data is deleted once your enquiry has been fully handled, unless statutory retention obligations prevent this.

2.3 Contact through WhatsApp

If you contact us through WhatsApp, we process your mobile number, visible profile details, the content of your message and any files you send. We use this information to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract negotiations or contract performance. For other enquiries, Art. 6(1)(f) GDPR applies; our legitimate interest lies in answering your enquiry.

For users in the European region, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In addition to communication content, WhatsApp processes account, device, connection and usage data. According to WhatsApp, messages and media sent are end-to-end encrypted. WhatsApp may also process data outside the European Economic Area and cites, among other things, the EU-US Data Privacy Framework and standard contractual clauses for this purpose.

Using WhatsApp is voluntary. You can reach us by phone or email instead. A normal visit to our website sends no data to WhatsApp. You leave our website only when you open the WhatsApp link.

Further information: WhatsApp privacy policy

2.4 Online application

In the online application, we process the contact and order data you provide. This includes in particular name, email address, phone number, customer type and company name where applicable, nationality, country of residence and destination country, visa type, travel date, travellers' birth and passport details, billing address and, depending on the service, further required application details. For the first entry guidance, your browser sends only nationality and destination country to our server. Our server checks these two country codes through an external visa-requirements service via RapidAPI. Names, passport numbers and application answers are not sent to that service. Further preliminary questions are evaluated in the browser. Processing serves pre-contractual steps and contract performance under Art. 6(1)(b) GDPR. Where required for the commissioned service, we send data and documents to the competent embassies, consulates, visa centres or other authorities. Visa documents may contain sensitive information, such as details of health or religion. We process such information only where it is required for the commissioned service and a specific legal basis or your explicit consent under Art. 9(2)(a) GDPR exists. For information on criminal convictions, the conditions of Art. 10 GDPR also apply. Consent alone does not replace these conditions.

2.5 Passport images and other documents

After placing your order, you can upload required passport images, facial images and other documents through protected order access. The files are transmitted to us with each upload. We automatically scan the files for malware before storing them, store them securely with the relevant order and use them for processing. Where the booked service includes submission, we send the approved information and images to the competent authority, for a UK ETA to UK Visas and Immigration. The legal basis is Art. 6(1)(b) GDPR. Passport copies, facial images and files uploaded as visa application documents are normally deleted six months after completion of the order or two months after cancellation. The period after completion allows us to handle questions, corrections and follow-up work on that order. Earlier deletion dates already set remain in place. This concerns the files; entered or extracted application information follows the storage criteria in section 5.

2.6 Unsubmitted application draft

So that you can continue later, your browser saves a local draft of your entries. It is not automatically saved as a draft on our server. The transmission for entry guidance and the anonymous step counting are described in sections 2.4 and 2.7. A draft can be restored for up to 14 days after it was last saved. Older drafts are discarded the next time they are loaded; after a successful order, the local draft is deleted. You can also remove it yourself in your browser settings. Any remaining server drafts previously saved with consent are deleted in regular cleanup after 90 days without changes, unless they must be retained as contractual or tax records.

2.7 Anonymous usage statistics

We count which steps are triggered in the online application. For this purpose, the browser sends only the type of step, whether it is the first step on the opened page, the result of the visa check and, where applicable, the marker for a submitted personal enquiry. No visitor identifier, exact timestamps or contact, passport, nationality, destination or device data are sent to the statistics.

The database immediately increments a daily counter. Individual visits or page changes are not stored and cannot be reconstructed. The anonymous counters help us improve the application process and identify technical problems. We neither set nor read cookies or other browser storage for the statistics. They are not linked to customer, application or order data.

As with every page view, the technical transmission generates connection data. This data is processed solely to provide and protect the route and is not included in the usage statistics.

2.8 Storage of application data with Supabase

Your application and customer data is stored in a database of the provider Supabase. The provider is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The project's database region is Stockholm, Sweden. Supabase and its sub-processors may process data outside the European Economic Area. Where no adequacy decision exists, Supabase relies under its data processing agreement in particular on the European Commission's standard contractual clauses. Processing serves contract performance under Art. 6(1)(b) GDPR; Supabase is used as a processor under Art. 28 GDPR on the basis of its Data Processing Addendum.

2.9 Payment processing through Stripe

If you pay for an order online, the payment is processed by the payment service provider Stripe. Payment takes place on a page operated by Stripe: you enter your payment data (such as your card number) only there. It does not reach our servers, and we neither store nor see it.

Stripe receives your email address, the amount payable, the order number and a short description of the service. Stripe returns to us whether and when payment was made, the amount, the currency and a payment identifier, but no payment data. The legal basis is Art. 6(1)(b) GDPR (performance of the contract with you); retention of payment records follows commercial and tax law periods.

For a Stripe account held in Germany, the contracting party to the data processing agreement is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Depending on the processing, Stripe may also act as an independent controller, for example for fraud prevention or to meet legal obligations. Stripe uses affiliated companies and service providers, including outside the European Economic Area. Such transfers are subject to the safeguards set out in Stripe's data processing agreement, in particular adequacy decisions and standard contractual clauses.

2.10 Sending email through Resend

We use Resend for order-related emails and marketing emails. We send marketing emails only with separate consent. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. In particular, name, email address, message content, attachments and technical delivery data are processed. Depending on the message, processing is based on Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR or your consent under Art. 6(1)(a) GDPR. Resend processes data in the USA and relies under its data processing agreement in particular on standard contractual clauses. We do not analyse opens or clicks. Corresponding event messages are not stored in our application.

2.11 Online cancellation

If you use the online cancellation function, we process your name, your order or contract reference, your email address, an optional message and the date and time of receipt. We use this information to process the cancellation and immediately send you an acknowledgement of receipt through Resend. The legal bases are Art. 6(1)(b) and (c) GDPR. The information is retained for the duration of statutory limitation and evidence periods.

2.12 Order status

On the status page, you can check the progress of your order through a personal link or with your order number, email address and a six-digit code sent by email. The page shows the order number, destination, service, processing stage, last update and outstanding steps. In protected order access, you can complete required information and submit documents for open orders and retrieve visas and permits provided. You can also see the total price and payment status and pay approved outstanding amounts through Stripe. Invoices are sent by email. For questions, please use email, phone or WhatsApp. We process the information entered, files submitted, payment details and related technical transaction data to perform the contract under Art. 6(1)(b) GDPR. Internal notes and employee names are not shown.

Personal links remain valid during an active order. They remain available for seven days after completion and three days after cancellation, and can be revoked earlier. A personal link always opens exactly one order. After expiry or revocation, it leads to the status page, where you can sign in again with your order number, email address and a new email code. Staff can issue a new personal link for a further seven days when needed. All customer access is blocked no later than 30 days after completion or cancellation, including existing sessions, email codes and newly issued links. A new link cannot extend this period.

For companies, access also applies to the specific order. The contact person can complete the travelling employees' information and documents there.

Access attempts are limited. For this purpose, we process technical attributes stored only as hashes for the duration of the relevant protection window. Processing serves contract performance and the protection of access under Art. 6(1)(b) and (f) GDPR.

Translation and speech output of documents

If we translate documents for your order or prepare them as speech output, we use the OpenAI API. The provider for customers in the European Economic Area is OpenAI Ireland Ltd., Ireland. We transfer the texts or complete documents we select and, for speech output, the text to be read. Input and results are stored in our administration application at Supabase and are accessible to authorised staff. Processing serves to provide the commissioned service under Art. 6(1)(b) GDPR. For special categories of data, the conditions stated in section 2.4 also apply.

OpenAI does not use API content for model training by default. For security and abuse monitoring, content may generally be stored by the provider for up to 30 days; legal or security-related exceptions may require longer periods. Processing may also take place outside the European Economic Area. It is based on the data processing agreement and the adequacy decisions or standard contractual clauses provided for in it.