1. Who is responsible (the controller)
R. do Capelão 8, Lisboa, Portugal
Privacy contact: support@visaontrip.com · Phone: +351 920 792 826
This policy applies to our website, customer portal, mobile app, e-mails and WhatsApp messages. We follow Regulation (EU) 2016/679 (GDPR) and the Portuguese Law 58/2019. We have not appointed a Data Protection Officer because the law does not require it for our activity; write to the privacy contact above for anything about your data.
2. The data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and profile | Name, e-mail, phone, password (stored only as a hash), date of birth, gender, nationality, passport number and expiry, language, sign-in method (e-mail, Google or Apple) | You; Google or Apple when you choose to sign in with them (name, e-mail, account identifier) |
| Travellers you add | Names, date of birth, passport details of family or colleagues you book for | You (you must be allowed to give us their data) |
| Visa applications | Country and visa type, answers to our questions, supporting documents you upload (passport pages, photos, bank or employment documents, travel plans), status and notes | You; the embassy or visa centre (status) |
| Flights and itineraries | Route, dates, passengers, PNR, ticket numbers, fare, baggage, payment status, e-ticket and invoice | You; the airline system through our ticketing supplier |
| Payments | Amount, date, status, Stripe payment references and the last digits and brand of the card. We do not receive or store the full card number. | Stripe; you |
| Messages and support | Contact forms, support tickets, e-mails, WhatsApp conversations and call notes | You; our team |
| Technical and security | IP address, browser and device type, pages and times, sign-in events, anti-spam checks, a record of the terms you accepted (time, IP address, version), change logs of records | Your browser and our servers |
Passport scan helper. When you press "Scan passport" the machine-readable lines of the passport are read inside your browser and only the resulting text fields are filled in. The scan helper does not upload or keep the picture. Documents you upload for a visa application are a separate action and are stored as described below.
We do not ask for special categories of data (such as health or religion). Please do not send them to us. We do not knowingly collect data from children under 16 other than for a child travelling with a parent or guardian who books for them.
3. Why we use your data and on which legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; process visa applications; reserve, ticket and deliver flights and itineraries; take payments, refund and issue invoices; send reservation, payment-deadline and ticket messages; customer support | Performance of a contract with you, or steps you ask for before it (Art. 6(1)(b)) |
| Accounting, tax and invoicing records; answering authorities; consumer-law duties | Legal obligation (Art. 6(1)(c)) |
| Fraud, abuse and spam prevention (for example the Cloudflare Turnstile check), security of our systems, keeping proof of the terms you accepted, defending legal claims, improving the service | Our legitimate interests (Art. 6(1)(f)); you can object (section 8) |
| Sign-in with Google or Apple; marketing messages if we ever send any; optional features you switch on | Your consent (Art. 6(1)(a)); you can withdraw it at any time |
We do not use automated decisions that have legal or similarly significant effects on you, and we do not profile you for advertising.
4. Who receives your data
We share data only where needed for the purposes above, under contracts that bind the recipients to protect it:
- Airlines and our ticketing supplier (the consolidator that issues the ticket): passenger names, date of birth, passport details and contact data, to reserve and issue the ticket.
- Embassies, consulates and visa centres: the data and documents needed for your visa application.
- Stripe Payments Europe, Ltd. (Ireland) and its group: card payments and refunds. Stripe is an independent controller for its own legal and fraud-prevention duties.
- Hosting and infrastructure providers for our website, database, servers and encrypted backups; e-mail delivery providers.
- WhatsApp (Meta) through our customer-service tool, to send and receive the messages you ask for or that concern your booking.
- Google and Apple, when you use their sign-in; Cloudflare (Turnstile anti-spam check on public forms).
- Professional advisers (accountants, lawyers), authorities and courts when the law requires or to protect our rights.
We never sell your personal data and we do not share it with advertisers.
5. Transfers outside the European Economic Area
Airlines, embassies and some providers are outside the EEA, including in countries without an EU adequacy decision. We transfer data there only where needed to perform your contract (GDPR Art. 49(1)(b)), or under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified. You can ask us for a copy of the safeguards in use.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account is open. We delete or anonymise it when you ask, except what we must keep below. |
| Documents you upload for a visa application | Up to 12 months after the application is completed, then deleted. |
| Visa application, flight booking and payment records | Up to 5 years after the order ends (to answer claims within the legal limitation periods). |
| Invoices and accounting records | 10 years (Portuguese tax and commercial law). |
| Support tickets and messages | Up to 3 years after the last message. |
| Security and access logs | Up to 12 months. |
| Marketing consent (if any) | Until you withdraw it. |
| Backups | Encrypted backups are overwritten on a rolling cycle; deleted data leaves them within that cycle. |
After a period ends we delete the data or make it anonymous. Longer retention applies only if the law requires it or a legal claim is pending.
7. Cookies and similar technologies
We use only what the service needs. We do not use advertising, tracking or analytics cookies, and we do not load advertising pixels, so no cookie banner is needed (Law 41/2004, ePrivacy rules).
| Name / technology | Purpose | Duration |
|---|---|---|
| Session cookie and XSRF-TOKEN cookie (ours) | Keep you signed in, protect forms against forgery, hold your flight search and cart while you book | Session, up to 2 hours of inactivity |
Browser storage: theme, recent flight searches, "install app" tip | Remember your light / dark choice and your last searches on your device only | Until you clear it |
| Cloudflare Turnstile | Tell people from robots on public forms (security) | Session / short |
| Stripe (on the Stripe payment page) | Secure payment and fraud prevention, set by Stripe | As set by Stripe |
| Google / Apple sign-in | Only when you choose to sign in with them | As set by them |
Our pages also load fonts from Google Fonts, flag pictures from flagcdn.com and airline logos from a logo service. When your browser loads them, those servers see your IP address. You can block them in your browser; the site still works.
8. Your rights
You have the right to: access your data and get a copy; rectify what is wrong; erase it; restrict its use; receive it in a portable format; object to processing based on our legitimate interests; and withdraw consent at any time (this does not affect what was done before).
- How: change most data yourself in your customer portal; for anything else e-mail support@visaontrip.com or use the data deletion request. We may ask you to prove who you are.
- When: we answer within one month, free of charge (the law allows an extension for complex requests, and we tell you).
- Limits: we cannot delete data we must keep by law (for example invoices) or need to defend a legal claim; we then restrict its use.
9. Complaints
You may complain to the Portuguese supervisory authority, or to the authority of your country of residence:
Av. D. João II, n.º 1.08.01 E, 1998-028 Lisboa, Portugal
Phone: +351 213 928 400 · E-mail: geral@cnpd.pt · www.cnpd.pt
10. Security
- All traffic is encrypted with HTTPS. Passwords are stored only as hashes; sensitive fields such as passport numbers can be stored encrypted; payment card data is handled only by Stripe.
- Access is limited by roles: our team sees only what the task needs. You can switch on two-step verification in your account.
- Changes to records are logged, backups are encrypted, and our systems are kept updated and monitored.
- If a personal data breach is likely to put you at risk, we notify the CNPD within 72 hours and tell you without undue delay where the law requires.
11. Other people’s data and children
If you give us data about another person (a co-traveller, a family member) you confirm that you are allowed to, and that you told them about this policy. Our services are for adults; for a child we process data only as given by a parent or guardian for the trip.
12. Changes to this policy
We update this policy when our services or the law change. The date and version are at the top. If a change is important we tell you by e-mail or in your account.
13. Contact
R. do Capelão 8, Lisboa, Portugal
Privacy: support@visaontrip.com
Phone / WhatsApp: +351 920 792 826