Privacy Policy

1. Controller details

The data controller is:

Nova Group Sp. z o.o.
Tax ID / VAT ID: PL7011215529
KRS: 0001117840
REGON: 529224431
Registered address: Żurawia 6/12 Lok. 745, 00-503 Warszawa, Poland

Website: https://evisa-immigration.com
Privacy contact: privacy@evisa-immigration.com
Customer support: support@evisa-immigration.com
Security contact: security@evisa-immigration.com

2. Scope of this Policy

This Policy applies to personal data processed through eVisa Immigration websites, online forms, customer accounts, payment flows, mobile applications, support channels, document-upload tools, analytics tools, marketing tools, and related services.

It applies to customers, travelers, account users, website visitors, app users, support contacts, business contacts, applicants, payment users, and persons whose information is submitted by another authorized person.

3. Categories of personal data we process

Depending on the service and order, we may process:

• Identity data: name, date of birth, nationality, gender where required for a travel document, passport or identity-document details, photograph, signature, and identification information.
• Contact data: email address, address, country, language preference, and customer-support details.
• Travel data: travel dates, destination, purpose of travel, itinerary, accommodation details, flight information, transit information, prior travel information, and border-entry information.
• Application data: answers to visa, authorization, arrival-card, health, customs, immigration, embassy, consular, airline, or authority questions.
• Document data: passport scans, photographs, supporting documents, invitation letters, proof of accommodation, flight confirmations, proof of funds, employment documents, family documents, student documents, or other documents required for the chosen product.
• Special-category or sensitive data where required for a specific application: biometric-style photographs, health declarations, criminal-history answers, immigration-history answers, religious or family information, or other sensitive data required by an authority.
• Account data: login identifiers, authentication status, session information, account activity, order history, app activity, and preferences.
• Payment and transaction data: amount, currency, billing details, payment status, payment method type, processor reference, refunds, disputes, fraud-screening signals, and tax information. Full card data is handled by payment processors and is not stored by us.
• Technical data: IP address, device identifiers, browser type, operating system, log files, cookie identifiers, analytics events, consent choices, security logs, and fraud-prevention information.
• Communication data: emails, support messages, attachments, notes, complaint records, customer instructions, consent records, and service-performance records.
• Marketing data: newsletter preferences, advertising consent, campaign source, conversion events, and remarketing preferences where permitted.

4. How we collect data

We collect data when:

• A customer visits the website or app.
• A customer creates an account or signs in.
• A customer starts, saves, or submits an application.
• A customer uploads documents or photographs.
• A customer pays, requests a refund, or opens a payment dispute.
• A customer contacts support.
• Another authorized person submits traveler information.
• Service providers, payment processors, analytics providers, fraud-prevention providers, authorities, or technical systems generate data necessary for the service.

5. Purposes and legal bases

We process personal data for the following purposes and legal bases under GDPR / RODO:

Where consent is the legal basis, the customer may withdraw consent at any time. Withdrawal does not affect processing already performed lawfully before withdrawal.

6. Special-category and sensitive data

Some travel-document or immigration processes may require sensitive information, such as health declarations, biometric-style photographs, criminal-history answers, religious information, family information, or other sensitive details. We process such data only where needed for the selected service, where permitted by law, and where an appropriate legal basis applies, such as explicit consent, substantial public-interest requirements, legal claims, or another applicable basis.

If the customer submits sensitive data about another traveler, the customer confirms that they have authority to do so.

7. Payment processor role

Payments may be processed by Stripe, Worldline, card networks, banks, wallet providers, app stores, fraud-prevention providers, or other payment partners. These providers may act as independent controllers, processors, or both, depending on the processing activity.

We receive limited payment information such as payment status, processor reference, payment method type, billing details, fraud signals, dispute details, and refund status. We do not store full card numbers or card security codes on our own systems.

Payment providers may process data for fraud prevention, transaction security, authentication, payment processing, regulatory compliance, dispute handling, and their own legally required purposes.

8. Analytics, advertising, and tracking tools

Public website and application analytics use PostHog after analytics permission, subject to browser Do Not Track and Global Privacy Control. We measure page visits, coarse validation categories, application steps, active time and verified outcomes using pseudonymous browser and attempt identifiers.

Where analytics permission is enabled, we use PostHog session replay on application pages and pages that lead to an application, and for a 15% session sample on other public pages. Analytics is enabled by default in some regions; elsewhere, recording starts only after you allow analytics. Recordings can show page text, public images, layout, questions, clicks, buttons, links, application step changes, validation errors and application answers. Application answers may include identity and contact details. On public pages, inputs remain masked except non-personal selectors such as nationality and destination. Passport numbers, health and criminal-history responses, passwords and tokens are masked or blocked. Passport, portrait and document images and previews, camera, video and canvas content, and embedded frames—including payment frames—are blocked. URL queries and fragments, network bodies and headers, and console logs are excluded. Recordings are kept for up to 30 days. You can stop future recording by turning off analytics in Cookie settings or the application’s Site analytics control. We respect withdrawal, Do Not Track and Global Privacy Control.

Account, authentication, admin, staff, Preview and test surfaces are excluded. First-party consented analytics records are kept for up to 90 days; the browser delivery queue expires after 24 hours. Private application and payment records follow their separate retention rules.

With an explicit advertising choice, eVisa Immigration sends OpenAI Ads an advertising click reference, application progress events and paid-order amount/currency for campaign measurement. After a fresh choice covering conversion matching, we may also send SHA-256-hashed contact email and a customer identifier to help match those events to ads. These hashes are personal data; raw email, raw customer identifiers, passport details and application answers are not sent. Earlier choices support basic measurement only. Withdrawal stops future advertising events and matching. You can change your choice in Cookie settings.

The website uses proprietary Nova Cookies, Google Consent Mode v2, eligible Google Ads conversion measurement, PostHog, Stripe and related account and payment technologies. Google conversion measurement sends permitted advertising click identifiers, stable business transaction IDs and payment currency/value after stored VAT and collected government fees. Refunds and lost disputes may correct earlier conversions. For eligible confirmed purchases, we may share the adult purchaser’s SHA-256-hashed email with Google to match the purchase to an advertisement. The hash remains personal data. In the EEA, United Kingdom and Switzerland, and when the visitor’s location is unknown, email matching requires a fresh explicit advertising choice covering this use. In other recognized locations, email matching is enabled by regional default where permitted by applicable law. Regional-default permission is recorded separately from an explicit choice and applies only to purchases made after that permission was recorded. Existing opt-outs, browser privacy signals and withdrawals stop matching. You can change your advertising choice in Cookie settings. Purchaser identity and adult status must be established; uncertain cases receive no email enhancement. Google receives no raw email, passport data, dates of birth, application answers, documents or private application URLs. Automatic detection of customer data is not used. This implementation does not enable Google remarketing or personalized advertising.

Analytics and marketing tools use Nova’s applicable regional privacy choices. EEA, United Kingdom and Switzerland visitors, and visitors whose location is unknown, start with optional permission denied and require an applicable fresh choice. Known other countries use regional defaults without a cookie banner. Existing opt-outs, Global Privacy Control, Do Not Track and server-recorded withdrawal are honored. Google permission is checked again before conversion delivery or refund correction; ad personalization stays denied.

The thirteen country-specific launch-partner pages use a separate, cookieless PostHog configuration to measure whether invited professionals reach and engage with the partnership information. It keeps identifiers in browser memory only, does not create an identified PostHog profile, does not call `identify`, and respects browser Do Not Track and Global Privacy Control signals. An invitation URL may carry a cryptographically random opaque code; the page removes it from the address before analytics and masked replay start. PostHog receives that code, country, language, page, scroll thresholds, section reach and active-time totals, video coverage, and application start or submission status. Names and email addresses remain in Nova's protected local campaign manifest and are not sent to PostHog.

Session replay is sampled at 100% on these low-volume pages and retained for up to 30 days. Form inputs and private areas are masked; images, video pixels, canvas content, request and response bodies, headers, console logs, URL queries and fragments, referrers, campaign parameters, and sensitive element attributes are excluded. The replay is used to understand page friction and the effectiveness of the invitation, not to make legal or similarly significant decisions. A footer control pauses partner-page analytics for the remainder of the open page visit; Do Not Track or Global Privacy Control pauses it automatically. A forwarded invitation remains associated with the opaque invitation link and does not prove who used it.

More information is available in the Cookies Policy.

9. Customer support

When a customer contacts support, we process the content of the message, order reference, customer identity, attachments, prior communications, and related service records. Support records are used to respond to the customer, resolve complaints, prevent fraud, maintain service quality, and evidence service performance.

eVisa Vision

When you use eVisa Vision while signed in, we use your messages and the application you select to help explain recorded status and published service information. OpenAI, our AI provider, processes the latest support message to identify the type of help you need. We do not include stored application answers or passport fields in classifier requests. We block recognised sensitive values in chat messages. Please do not include passport numbers, passwords, payment details or verification codes in chat.

We encrypt eVisa Vision transcript content stored on our servers and set each message to expire 90 days after its creation. Expired messages become unavailable immediately and daily cleanup removes their stored content. Starting a new conversation or adding a message does not extend older messages' retention. You can delete a chat from its support window; this blocks access immediately, and scheduled cleanup removes its stored content. Backup copies follow the applicable backup lifecycle. Contact privacy@nova-group.co about your privacy rights or requests.

We keep limited usage and cost records to operate the service and enforce spending limits. These records do not contain chat content. Settled detailed records are retained for 13 months; unresolved cost records and aggregate balances may remain while accounting issues are reconciled. We do not record audio in this release.

eVisa Vision provides factual support. It does not give personalised immigration or legal advice, decide eligibility, or predict a government decision. Our support team or the relevant government authority can help with questions requiring an individual assessment. The AI provider's separate retention and international-transfer terms still apply; disabling provider response storage does not mean all provider logs are immediately erased.

10. Processors and subprocessors

We may share personal data with service providers necessary for operating eVisa Immigration, including:

• Hosting, cloud infrastructure, databases, storage, backup, logging, and security providers.
• Authentication and account providers such as Clerk.
• Payment processors such as Stripe and Worldline.
• Fraud-prevention, identity-verification, sanctions-screening, and risk providers.
• Analytics and product-improvement providers such as GA4, Plausible Analytics, and PostHog.
• Advertising and measurement providers such as Google Ads.
• Cookie-consent providers such as Cookiebot CMP.
• Customer-support and communication providers.
• Email, notification, and delivery providers.
• Document-processing, OCR, translation, AI-assisted, and quality-control providers.
• Government authorities, embassies, consulates, immigration authorities, border authorities, airlines, app stores, banks, card networks, regulators, courts, and professional advisers where necessary.

Processors are required to process data according to contractual obligations, confidentiality requirements, security obligations, and applicable data-protection law.

Possible non-EU OCR processing

We use Modal to read passport and identity-card images and prepare document previews. Processing normally takes place in Europe. If European processing is unavailable, we may use another region, including outside the European Economic Area. This processing route does not store document images or recognition results at Modal. Operational logs may be stored in the United States; they contain technical timings, not document contents or applicant details. International transfers are covered by Modal's data-processing agreement and applicable Standard Contractual Clauses. Our own copies follow the retention periods below.

11. International transfers

Because travel-document services are international by nature, personal data may be transferred outside Poland, the European Economic Area, the United Kingdom, Switzerland, or the customer’s country. Transfers may occur when:

• The destination government, embassy, consulate, airline, border authority, or related authority is located outside the EEA.
• A service provider, payment provider, app-store provider, analytics provider, support provider, or technical provider processes data internationally.
• The customer requests a service for a destination outside the EEA.

Where GDPR applies, we use appropriate transfer mechanisms where required, such as adequacy decisions, Standard Contractual Clauses, additional safeguards, necessity for contract performance, explicit consent where applicable, legal claims, or other lawful transfer bases.

12. Retention periods

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical retention periods include:

We may retain limited records for longer if necessary to establish, exercise, or defend legal claims, prevent fraud, respond to payment disputes, comply with sanctions or regulatory obligations, or protect the service.

Passport scans and OCR copies

We keep passport scans and the copies created when reading them for three years from your most recent application, payment, sign-in or use of a saved traveller. After three years without activity, we delete these copies automatically, unless an active application or a legal, financial or worker hold requires us to keep them longer. You can request deletion at any time through your account or by contacting privacy@nova-group.co. Where a hold applies, we retain only the records still required and review them for deletion when the hold ends. Application, consent, payment and government-result records follow their separate retention periods.

13. Data subject rights

Where GDPR applies, data subjects have the right to:

• Access personal data.
• Rectify inaccurate personal data.
• Erase personal data where the legal conditions are met.
• Restrict processing.
• Object to processing based on legitimate interests or direct marketing.
• Data portability.
• Withdraw consent where processing is based on consent.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.

Requests should be sent to privacy@evisa-immigration.com. We may need to verify the requester’s identity and authority. We will respond within the period required by GDPR, normally within one month, with extensions where permitted for complex requests.

14. Complaint to the Polish supervisory authority

A person who believes that their personal data has been processed in violation of data-protection law may contact us first at privacy@evisa-immigration.com. They also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland:

Prezes Urzędu Ochrony Danych Osobowych
ul. Stawki 2
00-193 Warszawa
Poland

15. Automated decision-making

We may use automated tools to support fraud prevention, risk scoring, document classification, error detection, analytics, customer routing, and operational efficiency. These tools assist service performance and security. We do not use solely automated decisions that produce legal or similarly significant effects for customers unless permitted by law and accompanied by required safeguards.

16. Security

We use technical and organizational measures designed to protect personal data, including access controls, authentication controls, encryption in transit where appropriate, logging, restricted access, provider due diligence, backups, monitoring, and payment-security practices. No online service can be guaranteed to be completely secure.

Security concerns should be reported to security@evisa-immigration.com.

17. Children’s data

The service may process data of minors where a parent, guardian, or authorized adult orders a service for a minor traveler. The person submitting the data must have legal authority to do so.

18. Marketing choices

Customers may unsubscribe from marketing communications using the unsubscribe mechanism in the message or by contacting support@evisa-immigration.com. Service communications relating to orders, payments, security, legal notices, and account administration may still be sent where necessary.

19. Changes to this Policy

We may update this Policy to reflect service changes, legal changes, provider changes, technology changes, or operational improvements. The latest version will be available on the website.

20. Working Holiday 417 preparation

For the Working Holiday 417 preparation service, Supabase provides account authentication and encrypted case storage. DeepL API Free translates descriptive answers and address text into British English for staff and migration-agent review. Identity details, identifiers, dates, numbers and contact information are preserved. Ambiguous name renderings require staff review. Your completed application is shared directly with our MARA registered migration agent, Andrzej Kurowski, after the required preparation checks. Saving a draft does not initiate agent delivery. Answers and documents are not shared with advertising providers. This preparation service does not collect government visa fees or lodge a government application.