Privacy policy

1. Controller

Avesta Interactive
Owner: Amin Sepehri
Hauptstraße 208C
28816 Stuhr
Germany

Email: info@visaparo.de
Phone: +49 4206 4460745 – Mon–Fri, 4 pm–7 pm (CET/CEST)

VAT ID: DE294421179. We have not appointed a data protection officer; please send data protection enquiries to the contact address above.

2. Overview: who we are and what we do

Visaparo helps travellers prepare an application for the UK ETA (Electronic Travel Authorisation) (see T&C). The decision on the application is made exclusively by the UK Home Office. To provide this service, we necessarily have to process information from your passport and about your trip.

3. Which data we process for which purpose

3.1 Visiting the website, server logs (hosting)

When you visit the website, our web server (operated by our hosting provider, see section 4) processes technically necessary connection data, in particular IP address, date and time, the address accessed (URL), the amount of data transferred, status code and browser/operating system information (server log files). These data are necessary for secure and stable operation and are kept for no more than 14 days.

In addition, for forms and login attempts our application stores your IP address or your email address together with a counter for a short period (time windows of minutes to hours; expired counters are removed by a regular deletion run) to prevent misuse and brute-force attacks (rate limiting).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security, stability and prevention of misuse).

3.2 Customer account and login

To pay for and manage your application, you create a customer account. In doing so, we process your name, your email address and your password (only as a cryptographic hash, not in plain text). When you log in, the system also stores session data (session token, expiry time, IP address and browser identifier of the device). A session is valid for 7 days.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract or pre-contractual measures); for session logging Art. 6(1)(f) GDPR (security of the account).

3.3 Application data

To prepare and check your UK ETA application, we process the information you enter in the application assistant, for yourself or as an authorised representative for other travellers (e.g. children, family members – please obtain their consent or, as a person with parental responsibility, the necessary authority):

• personal details: name, any other names, date of birth, place and country of birth, sex, nationality or nationalities, including any other nationalities, occupation,
• passport details: passport number, issuing country, expiry date (optionally date of issue),
• contact details: address, telephone number, email address,
• travel details: purpose of travel and planned date of arrival,
• answers to the questions on criminal convictions and immigration history ("Yes"/"No"),
• uploaded documents: photo of the passport data page (mandatory) and facial photo (mandatory), each as JPEG, PNG or PDF.

Information about other persons (Art. 14 GDPR): if you provide information for other travellers, we receive their data from you. Please inform these persons about this privacy policy (purposes, legal bases, recipients including the Home Office, storage period, rights). For children, the persons with parental responsibility act.

As long as you are not logged in, your entries are only held in your browser's storage (sessionStorage, see section 8) and are not transmitted to us. When you create the account and as you progress through the assistant, the information is stored on our server; from that point on, the draft is kept only there and the information (including passport number, dates of birth, address) is removed from the browser storage.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Without this information we cannot prepare the application; you are contractually, but not legally, obliged to provide it.

3.4 Sensitive information (Art. 9 and 10 GDPR)

The questions in the UK ETA application concern, among other things, convictions, criminal proceedings and immigration breaches (data relating to criminal convictions and offences, Art. 10 GDPR) and, where applicable, circumstances from which special categories of personal data (Art. 9 GDPR) can be inferred. We store your answers ("Yes"/"No") exclusively in order to check and submit your application. The legal basis is your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give in the application assistant before answering these questions and which we document with a time stamp and version. You can withdraw your consent at any time with effect for the future (see contact above); we will then no longer be able to process the application. The lawfulness of the processing carried out until then remains unaffected. Consent is voluntary; if you do not give it, an application through us is not possible, but you can then apply directly on gov.uk. We process information on criminal convictions and immigration breaches only because the Home Office requires it for the application, and only for as long as is necessary for the submission. We automatically delete this information, as well as the passport copy and the facial photo, no later than 30 days after receipt of payment – even if the order has not been completed by then (section 6). Invoice and payment data are excluded from this.

We do not analyse your facial photo biometrically ourselves; we check the passport photo and passport copy only for legibility and consistency with your information. We transmit the facial photo to the Home Office because it is required for the UK ETA; according to its own information, the Home Office uses it to match your identity against your passport (automatically, and by a caseworker if necessary) and generally stores facial biometrics for 3 years (gov.uk, "Electronic travel authorisation: privacy information notice" and ETA guidance, accessed on 17.10.2026).

3.5 Security of passport uploads

Uploaded documents are not stored in a publicly accessible directory but in the database, where they are encrypted with AES-256-GCM (encryption at rest; the key is kept separately from the database). Transmission takes place via HTTPS. Only selected staff roles (caseworkers/checking, administration) have access to documents; every access is recorded in the audit log. Staff with pure support or accounting roles see passport numbers only in masked form and no documents. Likewise, particularly sensitive application data – passport number, date of birth, place and country of birth, date of issue and expiry of the passport, address, answers to the questions on criminal convictions and immigration history – are stored in the database encrypted field by field with AES-256-GCM (key separate from the database, versioned for a later key change). Only you and the staff roles with document access receive them in plain text. To search for a passport number (e.g. in the event of queries), an irreversible check value (HMAC) is stored, not the number itself.

3.6 Order, payment and invoice

When you place an order, we process the selected package, the amount, the payment status, invoice data (invoice number, date, amount, name and address of the invoice recipient) and the record of your consents in the ordering process (consent to the T&C/privacy policy, acknowledgement of the withdrawal information, express request for performance to begin, time and version of the texts). We provide the order confirmation in your customer account and also send it by email (see 3.9).

You pay by bank transfer (prepayment). To match your payment, we process the details from the incoming payment: name of the account holder, IBAN, amount, date and payment reference. The recipient is our bank, Sparkasse Bremen, Bremen, which is independently responsible for account management. Legal basis: Art. 6(1)(b) GDPR; for the retention of bank statements and accounting records Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB. We transfer refunds to the account from which the payment was made. We pay the Home Office's official fee included in the total price ourselves, in our own name and for our own account; we do not transmit any customer payment data for this purpose.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for the retention of invoices and accounting records Art. 6(1)(c) GDPR (§ 147 AO, § 257 HGB, § 14b UStG); for the documentation of consents Art. 6(1)(c) and (f) GDPR (obligations to provide evidence, legitimate interest in legal defence).

3.7 Messages, status enquiry and contact form

Messages in the customer account, status notifications and the history of your case (event log) are stored so that we can answer queries and trace the processing. For the public status enquiry, we check the case number and surname and show you only the processing status.

If you use the contact form, we store your name, email address, subject and message in order to answer your enquiry. The information in the form is voluntary; without it we cannot answer your enquiry. Please do not send passport numbers or other sensitive data via the form. We delete the enquiry no later than 180 days after receipt, unless retention obligations (e.g. for business letters) prevent this or it leads to a contract.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual enquiry), otherwise Art. 6(1)(f) GDPR (efficient handling of enquiries).

3.8 Audit log and prevention of misuse

Significant changes to applications and accounts as well as staff access (including document access and role changes) are recorded in the audit log so that access can be traced and misuse investigated. Legal basis: Art. 6(1)(f) GDPR (data security and accountability), Art. 32 GDPR.

3.9 Sending emails (order confirmation)

After your order, we send an order confirmation to the email address stored in the customer account. It contains the order data (case number, package, total price, invoice number), the T&C, the withdrawal information and the model withdrawal form (pre-filled with your order data) as well as confirmation of your consent to early performance. In this way, we fulfil our obligation to confirm the content of the contract to you on a durable medium (§ 312f(3) BGB). The email does not contain any passport, birth or address data.

So that a confirmation is not lost in the event of temporary delivery problems, it is stored in a queue ("outbox") in our database (recipient, subject, content, sending status, times of sending attempts) and re-sent several times in the event of errors. We delete these entries after 180 days. Emails are sent via our hosting provider Hetzner Online GmbH, Gunzenhausen (see section 4); transmission is encrypted in transit (TLS) where the receiving server supports this.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and (c) GDPR (legal obligation under § 312f(3) BGB).

3.10 Withdrawal via the "Withdraw from contract" function

If you withdraw from your contract using our online function "Withdraw from contract", we process your name, your email address, the case number (if provided), an optional message, the content of your withdrawal declaration, the date and time of receipt and the selected language. We assign the withdrawal to your order on the basis of the case number and your email address or surname, record it in the case and in the audit log and send you an acknowledgement of receipt stating its content, date and time by email (via our email service provider, see section 4).

Legal basis: Art. 6(1)(c) GDPR in conjunction with the statutory requirements for the withdrawal function (§ 356a BGB) (legal obligation to provide the withdrawal function and to acknowledge receipt) and Art. 6(1)(b) GDPR (unwinding of the contract); for documentation Art. 6(1)(f) GDPR (proof of receipt, defence of legal claims).

Storage period: we keep the withdrawal record until the end of the regular limitation period (3 years from the end of the year of receipt); if it forms part of the accounts (e.g. in the case of a refund), the statutory retention periods apply (up to 8 years, § 147 AO, § 257 HGB). We delete the acknowledgement of receipt in the sending queue after 180 days (see 3.9).

4. Recipients and processors

• Hosting: Our website and the associated data are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in the EU. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.
• E-mail sending and mailboxes: Order confirmations, other order-related e-mails, messages from the contact form and our mailboxes are also handled by Hetzner Online GmbH (address see above) on the basis of the same data processing agreement (Art. 28 GDPR). The recipient and sender addresses, subject and content of the e-mail are processed. No data is transferred to a third country in this process.
• Home Office (United Kingdom): see section 5.
• Staff: internally, only the persons who need access for their tasks receive it (role-based authorisation concept).
• Tax and legal obligations: where required by law, we pass on data to authorities, courts or advisers engaged for legal proceedings (Art. 6(1)(c) or (f) GDPR).

Data are not passed on for advertising purposes. We do not sell any data.

5. Transfer to the Home Office in the United Kingdom (third country)

The purpose of the contract is to apply for an electronic travel authorisation (UK ETA) from the UK Home Office (UK Visas and Immigration). For this purpose, your application data – in particular personal details, passport details, facial photo and answers to the questions on criminal convictions and immigration history – are transmitted in your name and at your request to the Home Office in the United Kingdom. There is an adequacy decision of the EU Commission for the United Kingdom (Implementing Decision (EU) 2025/2574 of 19.12.2025, valid until 27.12.2031), which since its renewal also covers transfers for the purposes of immigration control (Art. 45 GDPR). You are the applicant vis-à-vis the Home Office; we transmit the data in your name as a service provider commissioned by you. The Home Office processes the data under its own responsibility in accordance with British law; information on this can be found in the privacy notices on the Home Office website gov.uk/eta. If you do not want your data to be transmitted to the Home Office, you cannot apply through us.

6. Storage period

• Server log files: no more than 14 days.
• Support chat: no content; anonymous counters with a random conversation ID for 30 days, see section 10.
• Rate limit counters: briefly (until the time window expires, then removal by the deletion run).
• Uploaded documents (passport, passport photo): for completed orders, automatically deleted 30 days after the last change to the case, but in any event no later than 30 days after receipt of payment (even if the order has not been completed). You can remove documents yourself in the application assistant beforehand.
• Email sending queue (outbox): 180 days after sending or final failure. The order confirmation also remains available in your mailbox and as an invoice in your customer account.
• Unpaid, abandoned applications: completely deleted after 60 days without activity, including uploaded files, messages and event log.
• Data of paid orders (application details, invoice and payment data, messages, records of consent): we store them for as long as this is necessary to process the contract, to defend or enforce claims (regular limitation: 3 years from the end of the year) and to fulfil statutory retention obligations (accounting records and invoices 8 years, business letters 6 years, §§ 147 AO, 257 HGB, 14b UStG). After that, or at your request where no obligations prevent this, we delete them.
• Answers to the questions on criminal convictions and immigration history (Art. 9/10 GDPR): deleted together with the documents no later than 30 days after receipt of payment. Invoice and payment data are excluded.
• Contact enquiries: 180 days after receipt (see 3.7).
• Withdrawal declarations (online function): 3 years from the end of the year of receipt; parts relevant for accounting up to 8 years.
• Database backups: overwritten after 14 days at the latest; until then, data that have already been deleted may still be contained in backups.
• Customer account: until you request deletion, unless statutory retention obligations prevent this.

The deletion runs mentioned take place automatically at regular intervals; within these intervals, data may briefly be available for longer.

7. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation; we will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

An informal message to the contact address above is sufficient to exercise your rights. We do not currently offer an automated self-service procedure (e.g. data export). There is no automated decision-making, including profiling (Art. 22 GDPR).

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony, the competent supervisory authority)
Prinzenstraße 5, 30159 Hannover
https://www.lfd.niedersachsen.de

You can also contact the supervisory authority at your place of residence.

8. Cookies, browser storage and third-party content

• Session cookie: after login, we set a technically necessary session cookie (__Host-grok-auth.session_token; HttpOnly, Secure, SameSite=Lax, lifetime up to 7 days). Its sole purpose is to recognise you as a logged-in user.
• sessionStorage in the browser: the application assistant keeps your entries (before login including passport number, dates of birth and address), the selected package and, where applicable, a login token in your browser's sessionStorage. As soon as your draft is stored on our server, only the package, step and application ID remain there, but no personal information. After the order is submitted and on logout, the draft is deleted; it is discarded after no more than 2 hours of inactivity. The data are also deleted when the browser tab is closed. Please do not use the application on other people's or public devices.
• No advertising or analytics tools: we currently do not use any tracking, analytics or marketing services. Fonts are delivered from our own server (no retrieval from Google Fonts).

Legal basis for the cookie and the browser storage: § 25(2) no. 2 TDDDG (strictly necessary, no consent required) in conjunction with Art. 6(1)(b) and (f) GDPR.

9. Data security

We take technical and organisational measures in accordance with Art. 32 GDPR, including encrypted transmission (HTTPS/HSTS), hashed passwords, encryption of uploaded documents and sensitive application data in the database (AES-256-GCM), limitation of login attempts, role-based access restrictions for staff and logging of sensitive access, firewall and server hardening (only necessary ports, protection against brute-force login attempts, automatic security updates), regular database backups and automated deletion runs. No system is absolutely secure; please choose a strong password that you use only here (at least 10 characters).

10. Support chat (AI assistant)

You can use a chat assistant on our website. The assistant is an AI in the sense of an automated system, not a human; it is labelled as such. It runs entirely on our own server and matches your question to a knowledge base maintained by us on the basis of keywords and similarity. No external AI model and no AI provider is used; your questions are not transmitted to anyone. It only answers service questions about the UK ETA and gives no legal advice and no promise that the ETA will be approved.

• Purpose and legal basis: answering your questions and protection against misuse (Art. 6(1)(f) GDPR, legitimate interest in a functioning customer service).
• No chat logs: your messages and the answers are not stored. We only record anonymous counters (e.g. number of questions, unanswered questions, blocked messages, your "helpful/not helpful" rating) with a random conversation ID that is deleted after 30 days.
• Passport data: your browser already detects passport numbers, dates of birth, payment or health data; such messages are not sent. Please enter such data only in the application.
• Forwarding to support: if the assistant cannot help, it refers you to our email support (info@visaparo.de). If you use the contact form in the chat, we process your name, email address and message to handle your request (Art. 6(1)(b) GDPR) and delete them after 180 days.
• Order status: on request, we query the status in read-only mode using your case number and the email address of the order; neither is stored.
• Browser storage: the visible history is held only in the sessionStorage of your browser tab (ends when the tab is closed); no cookies, no tracking.
• No automated decision: the assistant does not make any decisions with legal effect (Art. 22 GDPR).

11. Changes to this policy

We adapt this privacy policy when processing operations or the legal situation change. The version available here applies.