Privacy Policy

1. Who are we?

The controller of your personal data is Kondoria — EURL, a EURL (entreprise unipersonnelle à responsabilité limitée) with a share capital of 1 000 €, registered with the RCS Paris 931 960 280 under number 931 960 280, whose registered office is located at 60 rue François Ier, 75008 Paris, France, which operates the Visaska service available at https://visaska.com ("Visaska", "we").

For any question relating to your personal data or to exercise your rights, you may write to our data protection contact: dpo@visaska.com, or by post to Kondoria — EURL, Data Protection, 60 rue François Ier, 75008 Paris, France.

This policy describes how we collect and use your data when you consult the Site, prepare a visa or travel authorisation application, place an order, create an account or contact our customer service. It has been drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

2. Our principles

• We collect only what the official form requires. The questions we ask you are those of the destination authority's portal, plus only the information needed to contact you and invoice you.
• Your passport data is used only for your application. It is never used for marketing, profiling or advertising purposes, and is never sold or rented out.
• We delete it promptly. Copies of your documents are erased shortly after your application is closed, in accordance with the periods indicated in Article 8.
• We protect it. Encryption, access restricted to the people handling your application, and access logging.

3. The data we process

Category	Examples	Source
Identification and contact	Surname, first name, email address, telephone number, language, country of residence	You
Passport data	Name as shown in the passport, nationality, date and place of birth, sex, number, dates of issue and expiry, issuing authority, MRZ strip	You, or automatic extraction from the scan you provide, validated by you
Documents and images	Scan of the passport identity page, identity photograph, supporting documents (booking, ticket, letter of invitation, bank statements, certificate of employment)	You
Travel data	Destination, arrival and departure dates, purpose of stay, accommodation address, itinerary, point of entry	You
Answers to the official questionnaire	Marital status, occupation, employer, address, contact person's details, previous travel, previous visa refusals, and any other question required by the authority	You
Application data	Plan chosen, status, official portal references, authority's decision, visa or authorisation issued	Us, the authority
Payment data	Amount, currency, date, last four digits and type of card, issuing country, transaction identifier, result of anti-fraud checks	Stripe
Communications	Messages exchanged with customer service, emails, complaints	You, us
Account data	Email address, Google or Apple technical identifier, login dates	You, Google, Apple
Technical data	IP address, browser and device type, connection and activity logs, cookie identifiers	Your device
Preferences and consents	Language, currency, passport country, choices regarding cookies and marketing	You

3.1 Passport data: data requiring particular protection

Passport data does not fall within the "special categories" of data within the meaning of Article 9 of the GDPR, but it makes it possible to identify a person with certainty and its misuse may facilitate identity theft. We therefore apply enhanced rules to it:

• strict minimisation: only the data required by the official form is collected;
• encryption of documents at rest and in transit;
• access restricted to the agents handling your application, on a need-to-know basis, with logging;
• no use for any purpose other than preparing, submitting and tracking your application, handling complaints and complying with our legal obligations;
• deletion of scans and photographs 30 days after the application is closed, and anonymisation of extracted data at the end of the period indicated in Article 8.

3.2 Sensitive questions asked by certain official forms

Certain official forms ask questions relating to health (for example, communicable diseases) or to any criminal convictions. We collect these answers only where the authority requires them, solely in order to transmit them to it, and do not use them for any other purpose. Answers relating to health are collected with your explicit consent, obtained at the relevant step of the questionnaire; if you do not wish to answer them through us, you may submit your application directly on the official portal. These answers are subject to the same retention rules as the other answers to the questionnaire.

3.3 Data of other travellers

When you place an order for other persons (members of your family, children, relatives or friends), you transmit their data to us. You must be authorised to act on their behalf and must inform them of the content of this policy.

3.4 Mandatory data

The information required by the official form is mandatory: without it, we cannot submit your application. Optional fields are marked as such.

4. Why we use your data and on what legal basis

Purpose	Legal basis (Art. 6 GDPR)
Preparing, checking and submitting your application, paying the government fees in your name, tracking the application and delivering the visa or authorisation to you	Performance of the contract (Art. 6(1)(b))
Automatically extracting data from your documents to pre-fill the questionnaire	Performance of the contract (Art. 6(1)(b))
Managing your account, your logins and your tracking areas	Performance of the contract (Art. 6(1)(b))
Saving your unpaid draft application so that you can resume it	Steps taken at your request prior to entering into a contract (Art. 6(1)(b))
Collecting payments, issuing invoices, making refunds	Performance of the contract (Art. 6(1)(b))
Sending you transactional messages (confirmation, document requests, status, delivery)	Performance of the contract (Art. 6(1)(b))
Answering your questions and handling your complaints and disputes	Performance of the contract (Art. 6(1)(b)) and legitimate interest in defending our rights (Art. 6(1)(f))
Keeping our accounts and retaining supporting documents	Legal obligation (Art. 6(1)(c)), in particular Article L123-22 of the French Commercial Code
Responding to requisitions from authorised judicial or administrative authorities	Legal obligation (Art. 6(1)(c))
Retaining evidence of contracts concluded with consumers	Legal obligation (Art. 6(1)(c)), Articles L213-1 and D213-1 of the French Consumer Code
Preventing fraud (fraudulent payments, false documents, identity theft)	Legitimate interest (Art. 6(1)(f)) in protecting our customers, the service and the authorities
Ensuring the security of the Site, logging access to and actions on files	Legitimate interest (Art. 6(1)(f)) in ensuring security and traceability
Improving the service (aggregated internal statistics on processing times, questionnaire completion rates, causes of document non-compliance)	Legitimate interest (Art. 6(1)(f)) in improving the quality of the service
Measuring the Site's audience without cookies (Vercel Web Analytics: page viewed without its query string, referring site, country, browser and device type; no visitor identified from one day to the next)	Legitimate interest (Art. 6(1)(f)) in knowing how the Site is used, with no tracker on your device
Measuring the Site's audience by means of third-party tools (Google Analytics)	Consent (Art. 6(1)(a))
Measuring the effectiveness of our advertisements and showing you personalised advertisements (Google Ads, Meta)	Consent (Art. 6(1)(a))
Sending you marketing emails (offers, travel tips)	Consent (Art. 6(1)(a) and Article L34-5 of the French Postal and Electronic Communications Code)
Retaining evidence of your consents	Legal obligation (Art. 6(1)(c) and Art. 7(1) GDPR)

For answers relating to health required by certain official forms, the additional condition for lawfulness is your explicit consent (Art. 9(2)(a) GDPR).

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal. Where processing is based on our legitimate interest, you may object to it on grounds relating to your particular situation (Article 11).

4.1 Automated decisions

We do not take any decision producing legal effects concerning you or similarly significantly affecting you based solely on automated processing, within the meaning of Article 22 of the GDPR. The automatic extraction of data from your documents is a data-entry aid: you check and validate the extracted data, and our agents review the application before it is submitted. The automated anti-fraud checks of our payment service provider may result in a payment being rejected; you may then contact us to obtain human intervention.

5. Who receives your data?

Your data is accessible to:

• the members of our team responsible for handling your application, customer service, accounting and security, each to the extent relevant to their role;
• the authority of the destination country to which your application is addressed (see Article 7.2);
• our processors, who act on our instructions (Article 6);
• Google and Apple, if you choose to log in with these services, to the extent necessary for authentication;
• advertising and audience measurement partners, only if you have consented (see the Cookie Policy);
• where applicable, our advisers (lawyers, chartered accountants, statutory auditors), the consumer mediator to whom a dispute has been referred, and authorised judicial or administrative authorities, in the cases provided for by law.

We do not sell or rent out your data.

6. Our processors

Service provider	Role	Data location	Safeguards in the event of transfer outside the EU
Supabase, Inc.	Database, authentication, document storage	European Union: Ireland (eu-west-1); company established in the United States	European Commission standard contractual clauses for any access from the United States
Stripe Payments Europe, Ltd.	Payment processing and fraud prevention	Ireland; possible transfers to the United States (Stripe, Inc.)	EU–US Data Privacy Framework and standard contractual clauses
Resend, Inc.	Sending transactional emails	United States	Standard contractual clauses
Mindee SAS	Automatic reading of documents (character recognition)	France	Not applicable (European Union)
Anthropic, PBC	Vision model used as a fallback solution for reading documents when the first tool fails	United States	Standard contractual clauses; data transmitted is not used to train its models, in accordance with the applicable contractual terms
Vercel Inc.	Hosting of the Site: processing of requests and delivery of its pages; audience measurement without cookies	Processing in Ireland (Dublin); pages delivered from its worldwide network, including outside the European Union; company established in the United States	EU–US Data Privacy Framework and European Commission standard contractual clauses

Where applicable, if you have consented to the corresponding cookies: Google Ireland Limited and Google LLC (audience measurement and advertising) and Meta Platforms Ireland Limited (advertising), which may transfer data to the United States on the basis of the Data Privacy Framework. Details are given in the Cookie Policy.

Each processor is bound by a contract complying with Article 28 of the GDPR, which requires it to process your data only on our instructions, to ensure its security and confidentiality, and to delete it or return it to us at the end of the service. The list of our processors may change; the up-to-date version is set out in this policy.

7. Transfers outside the European Union

7.1 Transfers to our service providers

Some of our service providers are established outside the European Union, mainly in the United States. These transfers are subject to the safeguards provided for by the GDPR: the European Commission's adequacy decision on the EU–US Data Privacy Framework for certified companies, and standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures (in particular encryption). You may obtain a copy of these safeguards by writing to dpo@visaska.com.

7.2 Transfers to the authority of the destination country: please read carefully

In order to obtain your visa or travel authorisation, we must transmit your data to the authority of the country you wish to travel to. This is the very purpose of the service you request from us.

That country may be located outside the European Union and may not offer a level of data protection equivalent to that guaranteed in Europe. There is not always a European Commission adequacy decision for that country, and we cannot impose contractual safeguards on a foreign government body. In practice, this means that:

• your data will be processed in accordance with the law and practices of that country;
• it may be retained by that authority for a period that it determines, and shared with other departments of that country (border police, immigration, security);
• you may not have rights of access, rectification or redress equivalent to those provided for by the GDPR.

This transfer is based on Article 49(1)(b) of the GDPR: it is necessary for the performance of the contract you have concluded with us. We transmit to the authority only the data required by its form. This risk exists in the same way when you submit your application yourself on the official portal.

8. How long we keep your data

Data	Retention period
Unpaid draft application (answers, uploaded documents)	7 days after the last modification, then deletion
Passport scans, photographs and supporting documents	30 days after the application is closed (delivery, refusal or cancellation), then deletion
Visa or authorisation issued	90 days after delivery, then deletion from our systems
Data extracted from the passport, answers to the questionnaire, messages exchanged	12 months after the application is closed, then anonymisation
Invoices and accounting records (including the payment data they contain)	10 years from the end of the financial year (Article L123-22 of the French Commercial Code)
Evidence of the contract concluded with a consumer	Period provided for by Article L213-1 of the French Consumer Code
Account	Until it is closed, or 3 years after the last login or order, after prior notice
Audit logs (access to and actions on files) and security logs	12 months
Evidence of your cookie choices	13 months
Marketing data (if you have consented)	Until you withdraw your consent, or 3 years after your last contact with us
Cookies and trackers	See the Cookie Policy

In the event of a dispute or complaint, the necessary data may be retained, in restricted-access archives, until the expiry of the limitation periods or the conclusion of the proceedings. Anonymised data, which no longer allows you to be identified, may be retained for statistical purposes.

We recommend that you save your visa or authorisation as soon as it is delivered: after the period indicated above, we will no longer be able to provide you with a copy.

9. Security

We implement technical and organisational measures appropriate to the risk, in particular:

• encryption of communications (HTTPS/TLS) and of stored data;
• storage of documents in private areas, accessible only via links of limited validity;
• passwordless authentication (single-use link, Google, Apple) and strong authentication for our agents;
• management of access rights in accordance with the principle of least privilege and logging of access to files;
• segregation of environments and regular backups;
• confidentiality undertakings from all persons with access to the data;
• selection of service providers offering sufficient guarantees and a data breach management procedure.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the CNIL under the conditions laid down in Article 33 of the GDPR and, if the risk is high, we inform you without undue delay.

10. Minors

The Site is not intended for use by minors. An application for a minor child must be made by one of the child's parents or by the child's legal representative, who provides the child's data and exercises the child's rights on the child's behalf. We may request evidence of this capacity. The data of minors is processed according to the same strict rules as that of adults and solely for the application concerned.

11. Your rights

You have the following rights over your data:

• right of access: to obtain confirmation that we are processing your data and to receive a copy of it;
• right to rectification: to have inaccurate data corrected or incomplete data completed;
• right to erasure: to obtain the deletion of your data, except where its retention is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
• right to restriction: to obtain the temporary suspension of the use of your data, for example while its accuracy is being verified;
• right to data portability: to receive the data you have provided to us in a structured, commonly used format, or to have it transmitted to another controller, where the processing is based on the contract or on your consent;
• right to object: to object at any time to marketing and, on grounds relating to your particular situation, to processing based on our legitimate interest;
• right to withdraw your consent at any time, for processing based on it (cookies, marketing, answers relating to health);
• right to give instructions regarding what happens to your data after your death (Article 85 of the French Data Protection Act (loi Informatique et Libertés)), which you may send to us or entrust to a certified trusted third party.

Please note: if you request the erasure of your data or withdraw your consent to the answers relating to health while your application has not yet been submitted, we will no longer be able to submit it. Once the application has been transmitted to the authority, we cannot have the data it holds erased: you should then contact it directly.

11.1 How to exercise your rights

Write to us at dpo@visaska.com or by post to Kondoria — EURL, Data Protection, 60 rue François Ier, 75008 Paris, France. You may also manage some of your data directly from your account (viewing, correction, account deletion) and your cookie choices via the "Cookie settings" link in the footer. To unsubscribe from our marketing emails, use the link included in each message.

To protect your data, we may ask you to confirm your identity, for example by replying from the email address associated with your order; we will ask you for an identity document only in the event of reasonable doubt.

We respond within one month of receipt of your request. This period may be extended by two months owing to the complexity or number of requests; in that case we inform you within the first month. Exercising your rights is free of charge, except in the case of a manifestly unfounded or excessive request.

11.2 Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL):

• by post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07;
• online: www.cnil.fr.

If you reside in another Member State of the European Union, you may also contact the data protection authority of your country.

12. Marketing communications

We send you marketing emails only if you have expressly consented to them, by means of a checkbox that is not pre-ticked. You may withdraw your consent at any time by clicking on the unsubscribe link included in each message, from your account, or by writing to dpo@visaska.com. Messages relating to the performance of your application are not marketing messages and are sent to you while the application is in progress.

13. Cookies

We use cookies and similar technologies, some of which require your consent. Their list, purpose, duration and how to change your choices are detailed in our Cookie Policy.

14. Changes to this policy

We may amend this policy to take account of changes to our services, our service providers or the regulations. The date of the latest update is shown at the top of the page. In the event of a material change, we inform you by email or by a message on the Site before it comes into force.