To comply with the obligations arising from the Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016 on protection of natural persons in relation to the processing of personal data and on free flow of such data and repealing Directive 95/46/EC (General Data Protection Regulation) hereinafter referred to as GDPR, INTERNATIONAL VISA SERVICE Limited Liability Company Limited Partnership with the registered office in Katowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP: 9542766476, REGON: 364718356, entered by the Katowice-Wschód District Court in Katowice, 8th Commercial Division, under KRS number 0000623079 (hereinafter referred to as IVS), informs about the processing of the client’s personal data and the rights the client is entitled to. The following rules are applicable as of May 25th, 2018.
I. The controller of the personal data
INTERNATIONAL VISA SERVICE Limited Liability Company Limited Partnership with the registered office in Katowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP: 9542766476, REGON: 364718356, entered by the Katowice-Wschód District Court in Katowice, 8th Commercial Division, under KRS number 0000623079 is the controller of the personal data. Telephone number: +44 2031 293 603 E-mail address: support@evisa.express
II. Data protection officer
The data protection officer at IVS can be contacted by email sent to the address: data- protection@ivs.travel
III. Purpose and legal basis of the data processing
IVS processes personal data for the purpose of executing a contract to which the person whose data are processed is a party, or to take actions at the request of the data subject before concluding the contract (Article 6 par. 1 letter b of the GDPR). In certain situations, IVS may process personal data due to the need to comply with legal obligations to which IVS is subject (Article 6 par. 1 letter c of the GDPR), or the processing is necessary to protect the vital interests of the data subject or another natural person (Article 6 par. 1 letter d of the GDPR), or processing is necessary for the purposes of the legitimate interests pursued by IVS (Article 6 par. 1 letter f of the GDPR), in particular, for the purpose related to:
- marketing of products and services of IVS;
- monitoring and improvement of the quality of services provided by IVS, including monitoring of telephone conversations and meetings, carrying out customer satisfaction surveys of services provided;
- if applicable, the conduct of disputable proceedings, as well as proceedings before public authorities and other proceedings, including carrying on enquiry and defence against claims;
- improving the quality of services, which includes examining traffic on the website and profiling.
In all other situations, personal data are processed solely on the basis of the consent granted for the purpose specified in its content (Article 6 par. 1 letter a of the GDPR). In all situations, your sensitive personal data are processed only on the basis of the consent granted for the purpose specified in it (Article 9 paragraph 2 letter a of the GDPR). Data collected by the site may be used for standard profiling, i.e. for statistical purposes and for purposes of internal marketing analysis, which does not cause any legal consequences for the person whose data have been collected or does not significantly affect the person in any other similar way. In every situation where data concerning criminal convictions is processed, such as when applying for a visa to Australia, Canada, or Kenya, the legal basis for processing is Article 10 of the General Data Protection Regulation (GDPR). This is because the data is processed under the supervision of public authorities or if the processing is authorized by Union law or the law of a Member State that provides for appropriate safeguards for the rights and freedoms of individuals whose data is being processed. The data regarding criminal convictions that we receive is forwarded to the state authorities from which we are requesting a visa for you. The legal basis for processing this data is governed by the internal regulations of each respective country, specifying the scope of necessary data required when submitting a visa application.
IV. Recipients of data
IVS discloses or may disclose personal data to the following recipients or categories of recipients, in particular to:
- public authorities and relevant state offices, competent to process visa applications and to issue visas;
- public authorities and relevant state offices in connection with the fulfillment of its obligations arising from legal regulations;
- entities that participate in the processes necessary to perform contracts concluded with clients, including banks, credit card operators, electronic and online payment agents;
- entities which support IVS in business processes, including in particular entities processing personal data for IVS (so-called data processors), inter alia:
- hosting companies,
- legal services and accounting services,
- companies and external entities carrying out processes which are a part of the activities necessary to conclude the contract with a client.
V. Time of data processing
The client's personal data, including sensitive data provided based on consent, are processed by IVS for the time necessary to achieve the objectives indicated in point III, that is, until the Agreement is fully executed and the Service is concluded. After that period, IVS may process the client’s data for a period of time and to the extent specified by law or for the pursuit of the legitimate interest of the data controller as in point. 3, however, no longer than 6 years since their collection. Insensitive data processed on the basis of separate consent shall be kept until the consent is withdrawn.
VI. The rights of data subjects
IVS guarantees all clients exercise of the data subject rights granted by the GDPR, including in particular:
- The right to access the personal data;
- The right to request correction of the personal data which are incorrect and the right to request supplementing of the incomplete personal data,
- The right to request erasure of the personal data ("the right to be forgotten"), when:
- the personal data are no longer necessary for the purposes for which they have been collected or otherwise processed;
- the data subject has withdrawn the consent on which the processing is based and there is no other legal ground for their processing;
- the data subject objects to the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation provided by law;
- the personal data have been collected in relation to the offer of information society services.
- The right to request restriction of processing of the personal data when:
- the data subject challenges correctness of the personal data;
- the processing is unlawful and the data subject opposes to erasure of the personal data, requesting to limit their use instead;
- the controller no longer needs the personal data for processing but it is necessary for the data subject to establish an enquiry or defend their claims;
- the data subject has objected to the processing – pending determination of whether the legitimate grounds on the part of the controller take precedence over the grounds of objection.
- The right to transfer personal data if:
- the processing takes place on the basis of consent or on the basis of a contract, and;
- the processing is automated.
- The right to object to the processing of personal data, if there are reasons related to the client’s special situation and the processing results from indispensability for the purposes resulting from legally justified interests pursued by the controller.
VII. Withdrawal of consent to data processing
To the extent of the client’s consent to processing of their personal data, the client is entitled to withdraw the consent at any time. The withdrawal takes place without affecting the legality of the processing which was carried out on the basis of the consent prior to its withdrawal.
VIII. The right to lodge a complaint with the supervisory authority
In any situation, when the client considers that IVS processes personal data contrary to the provisions of the GDPR, the client has the right to lodge a complaint with the appropriate supervisory authority.
IX. Transfer of personal data to countries outside the European Economic Area
- IVS may transfer personal data to international organizations and countries outside the European Economic Area for which the Commission has not found an adequate level of protection of personal data. The transfer of data takes place on the basis of standard contractual clauses agreed with the recipient, the content of which has been adopted by the European Commission and ensures the highest standards of personal data protection applied on the market.
- If you are applying for a visa to:
- Australia - IVS transfers personal data to countries outside the European Economic Area: Australia – the transfer of data is necessary for carrying out the contract of the visa agency.
- Bahrain - IVS transfers personal data to countries outside the European Economic Area: Bahrain – the transfer of data is necessary for carrying out the contract of the visa agency.
- Canada - IVS transfers personal data to countries outside the European Economic Area: Canada – the transfer of data is necessary for carrying out the contract of the visa agency. In addition, the Commission decision of 20th December 2001 stated that the regulations in force in Canada ensure an adequate level of protection of personal data.
- Cambodia - IVS transfers personal data to countries outside the European Economic Area: Cambodia – the transfer of data is necessary for carrying out the contract of the visa agency.
- Egypt - IVS transfers personal data to countries outside the European Economic Area: Egypt – the transfer of data is necessary for carrying out the contract of the visa agency.
- India - IVS transfers personal data to countries outside the European Economic Area: India – the transfer of data is necessary for carrying out the contract of the visa agency.
- Kenya - IVS transfers personal data to countries outside the European Economic Area: Kenya – the transfer of data is necessary for carrying out the contract of the visa agency.
- Mjanma (Birma) - IVS transfers personal data to countries outside the European Economic Area: Mjanma (Burma) – the transfer of data is necessary for carrying out the contract of the visa agency.
- Oman - IVS transfers personal data to countries outside the European Economic Area: Oman – the transfer of data is necessary for carrying out the contract of the visa agency.
- Sri Lanka - IVS transfers personal data to countries outside the European Economic Area: Sri Lanka – the transfer of data is necessary for carrying out the contract of the visa agency.
- Tanzania - IVS transfers personal data to countries outside the European Economic Area: Tanzania– the transfer of data is necessary for carrying out the contract of the visa agency.
- Turkey - IVS transfers personal data to countries outside the European Economic Area: Turkey– the transfer of data is necessary for carrying out the contract of the visa agency.
- USA - IVS transfers personal data to countries outside the European Economic Area: USA – the transfer of data:
- is necessary for carrying out the contract of the visa agency; and/or
- takes place on the basis of standard contractual clauses agreed with the recipient, the content of which has been adopted by the European Commission and ensures the highest standards of personal data protection applied on the market.
- Vietnam - IVS transfers personal data to countries outside the European Economic Area: Vietnam – the transfer of data is necessary for carrying out the contract of the visa agency.
- United Arab Emirates - the transfer of data takes place on the basis of standard contractual clauses agreed with the recipient, the content of which has been adopted by the European Commission and ensures the highest standards of personal data protection applied on the market.
- The client has the right to obtain a copy of the data transferred by IVS.
X. Obligation to provide personal data
Providing personal data is entirely voluntary. Providing data is a condition for concluding a visa contract with IVS or it is necessary to achieve the objectives arising from the legitimate interests of IVS. Failure to provide all the data will prevent conclusion and execution of the indicated contract.