Datenschutzerklärung

Gültig ab: 15. Februar 2026

1. Einleitung und Verantwortlicher

This Privacy Policy explains how Electronic Travel Authority SL (“we”, “us”, “our Company”) collects, uses, and protects the personal data of the users (“you”, “the Customer”) of this website.

Wir sind fest entschlossen, Ihre Privatsphäre zu schützen und alle anwendbaren Datenschutzgesetze einzuhalten, einschließlich der Datenschutz-Grundverordnung der EU (DSGVO) 2016/679 und des spanischen Organgesetzes 3/2018 über den Datenschutz und die Gewährleistung digitaler Rechte (LOPDGDD).

Die für die Verarbeitung Ihrer personenbezogenen Daten verantwortliche Stelle (der Verantwortliche) ist:

• Company Name: Electronic Travel Authority SL
• NIF (Tax ID): B21891445
• Registered Address: Calle Princesa, 31, Planta 2, 28008 Madrid, Spain
• Data Protection Contact Email: policy@electronic-travel-authority.com

2. Welche personenbezogenen Daten wir erheben

Wir erheben personenbezogene Daten, die Sie uns bereitstellen, sowie Daten, die durch Ihre Nutzung unserer Website entstehen. Zu den Datenarten gehören:

• Identity & Travel Data: Full name, date and place of birth, passport details (number, issue/expiry date, issuing country), nationality, travel itinerary, signature, photographs, and any other information required on the travel authorization application form. This may include sensitive data such as biometric information contained in your passport photo.
• Contact Data: Email address, postal address, and telephone number.
• Transaction Data: Details of the services you have purchased from us and payment card details (processed securely by our third-party payment providers; we do not store your full card number).
• Technical Data: IP address, browser type and version, time zone setting, and other technology on the devices you use to access this website, collected via cookies. Please see our Cookie-Richtlinie for more details.
• Communications Data: Records of your correspondence with our Customer Service team.

2.1 Besondere Verarbeitung biometrischer Daten

As part of your application, we collect and process biometric data (specifically facial images from your photograph or passport).

• Purpose: This data is processed solely for Identity Verification and to comply with the mandatory requirements of the destination government’s immigration systems (e.g., UK ETA, Australia ETA).
• Scope: We do not use your biometric data for any secondary purposes, such as marketing, commercial profiling, or persistent facial recognition tracking.
• Consent: By uploading your photo and ticking the specific consent box, you provide explicit consent for this processing as required by Article 9 of the GDPR. You may withdraw this consent at any time, though this will likely result in the inability to process your travel authorization.

3. Wie wir Ihre Daten verwenden: Zwecke und Rechtsgrundlage

Wir verarbeiten Ihre personenbezogenen Daten nur für bestimmte Zwecke und nur dann, wenn dafür eine Rechtsgrundlage besteht. Die nachstehende Tabelle erläutert dies im Detail:

4. Einsatz automatisierter und KI-gestützter Werkzeuge zur Antragsbearbeitung

To provide our services efficiently and accurately, our platform may use integrated automated and AI-assisted technologies as a core part of the application process. This is not an optional feature but a necessary component of our service delivery.

• What this means: When you submit your application and documents (like a passport scan or photo), we use these tools to:
  • Automatically extract information (e.g., name, passport number, dates) to populate the application form.
  • Die Daten auf häufige Fehler, Vollständigkeit und Konsistenz analysieren.
  • Sicherstellen, dass Ihr Foto die spezifischen Anforderungen der Behörden erfüllt.
• Tools We Use: This process may involve our own proprietary systems as well as secure services from trusted third-party technology partners (such as services from Google, OpenAI, n8n, etc.). This may involve the transfer of your data to servers located outside the European Economic Area (see Section 7 on International Data Transfers).
• Legal Basis: The processing of your general personal data for this purpose is necessary for the Performance of a Contract (our service agreement with you). Because this process involves your photograph (biometric data), we also require your Explicit Consent, which you provide when you agree to our Terms of Service and submit your application for processing.
• No Automated Decision-Making: It is important to clarify that our AI tools are used for processing and assistance only. They do not make the final decision on your travel authorization. The decision to approve or deny your application is made solely by the government authorities of the destination country.

5. Speicherung der Daten

Wir speichern Ihre personenbezogenen Daten nur so lange, wie es zur Erfüllung der Zwecke erforderlich ist, für die wir sie erhoben haben, einschließlich zur Erfüllung etwaiger gesetzlicher, buchhalterischer oder berichtspflichtiger Anforderungen.

• Application Data: We will retain your application data for the period of validity of the issued travel document plus an additional period as required by law (e.g., for accounting or to handle potential claims). After this period, your personal data will be securely deleted or anonymized.
• Data for AI (with consent): If you consent to AI processing, your data will be anonymized and used for model training, after which the original personal data will be deleted according to our standard retention policy.
• Customer Service Communications: Data will be retained for a period of up to 24 months after your case is closed to allow for follow-up inquiries.

5.1 Erweiterte Löschrichtlinie für Ausweisdokumente

Während Transaktionsunterlagen aus rechtlichen und buchhalterischen Gründen aufbewahrt werden, wenden wir für besonders sensible Ausweisdokumente einen strengeren Aufbewahrungsplan an:

• Passport Copies & Face Photos: These files are permanently purged from our active servers within 30 days after your travel authorization has been finalized (granted or denied).
• Encrypted Backups: Any remaining encrypted fragments in system backups are overwritten according to our standard 60-day rotation cycle.

5.2 Vorübergehende Speicherung und abgebrochene Anträge

Wir setzen strenge technische Maßnahmen um, um sicherzustellen, dass Ihre Daten nur dann gespeichert werden, wenn dies zur Bearbeitung Ihrer Anfrage erforderlich ist:

• Unfinished Forms (Abandoned): If you exit the application form before proceeding to the payment page, no information is submitted to or stored on our servers. Your data remains local to your browser session and is cleared once the session expires or the tab is closed.
• Pending Payments: Once you proceed to the payment stage, your form data is temporarily stored for a maximum of 48 hours. This period is strictly limited to ensuring we receive a “Payment Success”/”Payment Failure” confirmation from our Payment Service Providers (PSP).
• Automatic Deletion: If a payment attempt fails or is not completed within this 48-hour window, all associated data (including any uploaded documents) is automatically and permanently purged from our servers without being processed or reviewed.

6. Mit wem wir Ihre Daten teilen

Wir verkaufen Ihre personenbezogenen Daten nicht. Wir geben sie nur bei Bedarf an die folgenden Parteien weiter:

• Government Authorities: The immigration authorities of the destination country to which you are applying for a travel document.
• Payment Service Providers: To process your payment securely and prevent fraud.
• Technology Service Providers: Our hosting providers, IT support, and platform developers who help us run our business.
• AI Service Providers: Trusted third-party companies that provide AI processing tools. We will ensure they have appropriate data protection safeguards in place.
• Legal and Law Enforcement: When required by law or to protect our legal rights.

7. Internationale Datenübermittlungen

Einige der Parteien, mit denen wir Ihre Daten teilen (z. B. Behörden von Nicht-EU-Ländern oder in den USA ansässige externe KI-Dienstleister), befinden sich außerhalb des Europäischen Wirtschaftsraums (EWR).

Wenn wir Ihre Daten außerhalb des EWR übermitteln, stellen wir deren Schutz durch geeignete Garantien sicher, etwa durch die Verwendung von der Europäischen Kommission genehmigter Standardvertragsklauseln (SCC), damit Ihre Daten ein Schutzniveau erhalten, das dem der DSGVO entspricht.

7.1 Zielländer und Schutzmaßnahmen

To fulfill our service, your data is transferred to the immigration authorities of the country you intend to visit (e.g., Australia, Canada, United Kingdom, or the United States).

• Adequacy: Transfers to the UK and Canada rely on the EU’s Adequacy Decisions.
• Standard Clauses: For transfers to countries without an adequacy decision (or to US-based technology providers like OpenAI or Google), we utilize Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework to ensure your data receives a level of protection equivalent to that in the European Union.

8. Ihre Datenschutzrechte

Nach der DSGVO haben Sie hinsichtlich Ihrer personenbezogenen Daten die folgenden Rechte:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You can ask us to delete your personal data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to suspend the processing of your data in certain scenarios.
• Right to Data Portability: You can request that we transfer your data to you or another service provider in a machine-readable format.
• Right to Object: You can object to us processing your data where we are relying on a legitimate interest.
• Right to Withdraw Consent: Where we rely on consent (e.g., for AI processing), you can withdraw it at any time.

Um eines dieser Rechte auszuüben, kontaktieren Sie uns bitte unter der in Abschnitt 1 angegebenen E-Mail-Adresse. Wir werden Ihre Anfrage innerhalb eines Monats beantworten.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence. The Spanish Supervisory Authority is the Agencia Española de Protección de Datos (AEPD).

9. Datensicherheit

Wir haben geeignete technische und organisatorische Sicherheitsmaßnahmen umgesetzt, um zu verhindern, dass Ihre personenbezogenen Daten versehentlich verloren gehen, verwendet, unbefugt abgerufen, verändert oder offengelegt werden. Alle unsere Mitarbeiter sind in Bezug auf ihre Datenschutzpflichten geschult.

10. Schutz von Minderjährigen

In accordance with the Spanish LOPDGDD, the minimum age to provide independent consent for data processing is 14 years old.

• Under 14: If the applicant is under 14, the data and biometric information must be provided by a parent or legal guardian.
• Verification: By submitting a minor’s application, the user affirms they have the legal authority to grant consent on the minor’s behalf. If we become aware that data from a child under 14 has been submitted without such authority, we will delete that information immediately.

11. Änderungen dieser Datenschutzerklärung

Wir behalten uns das Recht vor, diese Datenschutzerklärung jederzeit zu aktualisieren. Die aktualisierte Fassung wird wirksam, sobald sie auf dieser Website veröffentlicht wird. Wir empfehlen Ihnen, diese Seite regelmäßig zu überprüfen.