Privacy Policy

To comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (GDPR), PASSPORTA informs Clients about the principles of personal data processing and their rights.

1. The Personal Data Controller is PASSPORTA, with its registered office at ul. Jana III Sobieskiego 2, 40-082 Katowice, Poland, NIP: 6343050934, KRS: 0001150100.
2. The Client may contact the Data Controller regarding personal data protection via email: [email protected] or by phone at:
   1. Polish language +48 32 431 00 23
   2. German language +37 260 934 30
   3. English language +44 20 8089 4595
   4. French language +33 187 650 033
3. For matters related to personal data protection, the Client may also contact PASSPORTA’s Data Protection Officer by sending an email to [email protected].
4. The Client’s Personal Data is processed for the purpose of executing the Agreement to which the Client is a party or taking pre-contractual actions at the Client’s request, based on Article 6(1)(b) GDPR.
5. In certain cases, PASSPORTA may process Personal Data based on:
   1. A legal obligation (Article 6(1)(c) GDPR),
   2. Protection of the vital interests of the Client or another natural person (Article 6(1)(d) GDPR),
   3. PASSPORTA’s legitimate interests (Article 6(1)(f) GDPR), including:
      • Marketing of PASSPORTA’s services,
      • Monitoring service quality, including analyzing Platform traffic,
      • Handling legal disputes, defense against claims,
      • Ensuring security in service provision and transactions.
6. Data may be processed based on the Client’s consent when no other legal basis applies, in accordance with Article 6(1)(a) GDPR.
7. PASSPORTA processes Sensitive Personal Data only based on the Client’s explicit consent, particularly regarding health information or criminal records, if required in the visa application process (Article 9(2)(a) GDPR).
8. If the visa process requires criminal records data (e.g., for visa applications to Australia, Canada, or Kenya), the processing is based on Article 10 GDPR and the national regulations of the relevant visa authority.
9. PASSPORTA may contact the Client via email to collect service feedback. For this purpose, it may entrust data processing to Trustpilot A/S, to which it provides the Client’s name, email address, and order number.
10. Personal Data may be shared with the following entities:
    1. Public authorities authorized to process visa applications,
    2. State institutions fulfilling legal obligations,
    3. Entities processing electronic payments and banking transactions,
    4. Companies supporting PASSPORTA in service provision, including:
       • Hosting service providers,
       • Law firms and accounting offices,
       • Customer service providers and quality monitoring entities.
11. Personal Data is retained for the necessary period to fulfill the purposes for which it was collected. After the Agreement is completed, PASSPORTA may retain data for the legally required period or for a legitimate interest, but no longer than 6 years from collection.
12. The Client has the right to:
    1. Access their data,
    2. Rectify incorrect or incomplete data,
    3. Request data erasure ("right to be forgotten") in specific cases,
    4. Restrict data processing,
    5. Data portability, if processing is based on consent or contract,
    6. Object to processing in justified cases.
13. The Client has the right to withdraw consent for data processing at any time. Withdrawal of consent does not affect the legality of processing prior to withdrawal.
14. In case of data protection violations, the Client has the right to file a complaint with the relevant supervisory authority.
15. PASSPORTA may transfer data to countries outside the European Economic Area (EEA) to fulfill the Agreement. In such cases, standard contractual clauses of the European Commission are applied to ensure an adequate level of data protection.
16. For visa applications to certain non-EEA countries (Australia, Bahrain, Cambodia, Egypt, India, Kenya, Myanmar, Oman, Sri Lanka, Tanzania, Turkey, USA, Vietnam), the Client’s data may be transferred to relevant government authorities in accordance with the applicable regulations of that country. Transfers to the USA and the UAE may occur based on standard contractual clauses approved by the European Commission, ensuring high-level personal data protection. For transfers to Canada, data processing is necessary for the execution of the visa intermediary service agreement, and the European Commission's decision of December 20, 2001, confirms that Canada ensures an adequate level of data protection.
17. The Client has the right to obtain a copy of their personal data provided to PASSPORTA.
18. Providing Personal Data is voluntary but necessary to conclude and execute the Agreement for Visa Services. Failure to provide the required data will prevent the service from being performed.