To comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (GDPR), PASSPORTA informs Clients about the principles of personal data processing and their rights.

1. The Personal Data Controller is PASSPORTA, with its registered office at ul. Jana III Sobieskiego 2, 40-082 Katowice, Poland, NIP: 6343050934, KRS: 0001150100.
2. The Client may contact the Data Controller regarding personal data protection via email: support@passporta.com or by phone at:
   1. Polish language +48 32 431 00 11
   2. German language +49 30 209 930 611
   3. English language +44 20 8089 4595
3. For matters related to personal data protection, the Client may also contact PASSPORTA’s Data Protection Officer by sending an email to data-protection@passporta.com.
4. The Client’s Personal Data is processed for the purpose of executing the Agreement to which the Client is a party or taking pre-contractual actions at the Client’s request, based on Article 6(1)(b) GDPR.
5. In certain cases, PASSPORTA may process Personal Data based on:
   1. A legal obligation (Article 6(1)(c) GDPR),
   2. Protection of the vital interests of the Client or another natural person (Article 6(1)(d) GDPR),
   3. PASSPORTA’s legitimate interests (Article 6(1)(f) GDPR), including:
      • Marketing of PASSPORTA’s services,
      • Monitoring service quality, including analyzing Platform traffic,
      • Handling legal disputes, defense against claims,
      • Ensuring security in service provision and transactions.
6. Data may be processed based on the Client’s consent when no other legal basis applies, in accordance with Article 6(1)(a) GDPR.
7. PASSPORTA processes Sensitive Personal Data only based on the Client’s explicit consent, particularly regarding health information or criminal records, if required in the visa application process (Article 9(2)(a) GDPR).
8. If the visa process requires criminal records data (e.g., for visa applications to Australia, Canada, or Kenya), the processing is based on Article 10 GDPR and the national regulations of the relevant visa authority.
9. PASSPORTA may contact the Client via email to collect service feedback. For this purpose, it may entrust data processing to Trustpilot A/S, to which it provides the Client’s name, email address, and order number.
10. Personal Data may be shared with the following entities:
    1. Public authorities authorized to process visa applications,
    2. State institutions fulfilling legal obligations,
    3. Entities processing electronic payments and banking transactions,
    4. Companies supporting PASSPORTA in service provision, including:
       • Hosting service providers,
       • Law firms and accounting offices,
       • Customer service providers and quality monitoring entities.
11. Personal Data is retained for the necessary period to fulfill the purposes for which it was collected. After the Agreement is completed, PASSPORTA may retain data for the legally required period or for a legitimate interest, but no longer than 6 years from collection.
12. The Client has the right to:
    1. Access their data,
    2. Rectify incorrect or incomplete data,
    3. Request data erasure ("right to be forgotten") in specific cases,
    4. Restrict data processing,
    5. Data portability, if processing is based on consent or contract,
    6. Object to processing in justified cases.
13. The Client has the right to withdraw consent for data processing at any time. Withdrawal of consent does not affect the legality of processing prior to withdrawal.
14. In case of data protection violations, the Client has the right to file a complaint with the relevant supervisory authority.
15. PASSPORTA may transfer data to countries outside the European Economic Area (EEA) to fulfill the Agreement. In such cases, standard contractual clauses of the European Commission are applied to ensure an adequate level of data protection.
16. For visa applications to certain non-EEA countries (Australia, Bahrain, Cambodia, Egypt, India, Kenya, Myanmar, Oman, Sri Lanka, Tanzania, Turkey, USA, Vietnam), the Client’s data may be transferred to relevant government authorities in accordance with the applicable regulations of that country. Transfers to the USA and the UAE may occur based on standard contractual clauses approved by the European Commission, ensuring high-level personal data protection. For transfers to Canada, data processing is necessary for the execution of the visa intermediary service agreement, and the European Commission's decision of December 20, 2001, confirms that Canada ensures an adequate level of data protection.
17. The Client has the right to obtain a copy of their personal data provided to PASSPORTA.
18. Providing Personal Data is voluntary but necessary to conclude and execute the Agreement for Visa Services. Failure to provide the required data will prevent the service from being performed.
19. Opt-out options, cookies and marketing preferences

    In order to ensure transparency and compliance with applicable data protection and advertising regulations, PASSPORTA informs that users have the right to opt out of certain types of data processing, including processing for marketing and advertising purposes.

    1. Advertising and profiling

       Where personal data are processed for the purposes of direct marketing or profiling, the data subject has the right to object to such processing at any time. Upon objection, PASSPORTA will cease processing personal data for such purposes unless there are compelling legitimate grounds overriding the interests, rights and freedoms of the data subject.

    2. Cookies and tracking technologies

       PASSPORTA uses cookies and similar technologies to ensure proper functioning of the website, improve user experience and, where applicable, for analytical and marketing purposes.

       Users have the possibility to manage or disable cookies at any time through their browser settings. Limiting the use of cookies may affect certain functionalities of the website.

       Where required by law, users are provided with a cookie consent mechanism allowing them to accept or reject non-essential cookies.

    3. Email communications

       If personal data are used for sending marketing communications, the data subject has the right to withdraw consent or unsubscribe at any time. Each marketing message contains an appropriate unsubscribe mechanism.

       Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

    4. Right to object and restriction of processing

       In addition to the rights described above, the data subject has the right to object to the processing of personal data for marketing purposes and to request restriction of such processing.

       Requests regarding opt-out, objection or restriction of processing may be submitted to PASSPORTA using the contact details indicated above.

    5. Automated decision-making

       Where applicable, PASSPORTA informs that personal data are not subject to fully automated decision-making producing legal effects concerning the data subject without appropriate safeguards, unless explicitly stated otherwise.

20. Use of tracking technologies and remarketing

    PASSPORTA may use tracking technologies, including cookies, pixels and similar tools, to collect information about user interactions with the website for analytics and advertising purposes.

    This includes the use of third-party advertising services, such as Microsoft Advertising, which may collect data through technologies like the Universal Event Tracking (UET) tag to enable remarketing and audience segmentation.

    As a result, information about user activity on the website may be shared with third-party partners for the purpose of delivering personalized advertisements (interest-based advertising).

    Personal data collected for visa processing is never used for advertising purposes.

    1. Interest-Based Advertising opt-out

       Users have the right to opt out of interest-based advertising by visiting the following resources:

       • https://optout.aboutads.info/
       • https://optout.networkadvertising.org/

       These platforms allow users to control how their data is used for personalized advertising across multiple providers.

       PASSPORTA does not use sensitive personal data (such as information about health, religion, political views or similar categories) for advertising or remarketing purposes.