Informativa sulla privacy

Data di validità: 15 febbraio 2026

1. Introduzione e responsabile del trattamento

This Privacy Policy explains how Electronic Travel Authority SL (“we”, “us”, “our Company”) collects, uses, and protects the personal data of the users (“you”, “the Customer”) of this website.

Siamo fermamente impegnati nel proteggere la Sua privacy e nel rispettare tutte le leggi applicabili sulla protezione dei dati, incluso il Regolamento generale sulla protezione dei dati dell'UE (GDPR) 2016/679 e la Legge organica spagnola 3/2018 sulla protezione dei dati e la garanzia dei diritti digitali (LOPDGDD).

L'entità responsabile del trattamento dei Suoi dati personali (il Responsabile del trattamento) è:

• Company Name: Electronic Travel Authority SL
• NIF (Tax ID): B21891445
• Registered Address: Calle Princesa, 31, Planta 2, 28008 Madrid, Spain
• Data Protection Contact Email: policy@electronic-travel-authority.com

2. Quali dati personali raccogliamo

Raccogliamo dati personali che Lei ci fornisce e dati generati dall'utilizzo del nostro sito web. I tipi di dati includono:

• Identity & Travel Data: Full name, date and place of birth, passport details (number, issue/expiry date, issuing country), nationality, travel itinerary, signature, photographs, and any other information required on the travel authorization application form. This may include sensitive data such as biometric information contained in your passport photo.
• Contact Data: Email address, postal address, and telephone number.
• Transaction Data: Details of the services you have purchased from us and payment card details (processed securely by our third-party payment providers; we do not store your full card number).
• Technical Data: IP address, browser type and version, time zone setting, and other technology on the devices you use to access this website, collected via cookies. Please see our Informativa sui cookie for more details.
• Communications Data: Records of your correspondence with our Customer Service team.

2.1 Trattamento speciale dei dati biometrici

As part of your application, we collect and process biometric data (specifically facial images from your photograph or passport).

• Purpose: This data is processed solely for Identity Verification and to comply with the mandatory requirements of the destination government’s immigration systems (e.g., UK ETA, Australia ETA).
• Scope: We do not use your biometric data for any secondary purposes, such as marketing, commercial profiling, or persistent facial recognition tracking.
• Consent: By uploading your photo and ticking the specific consent box, you provide explicit consent for this processing as required by Article 9 of the GDPR. You may withdraw this consent at any time, though this will likely result in the inability to process your travel authorization.

3. Come utilizziamo i Suoi dati: scopi e base legale

Elaboriamo i Suoi dati personali solo per scopi specifici e solo quando esiste una base legale per farlo. La tabella sottostante spiega questo in dettaglio:

4. Utilizzo di strumenti automatizzati e assistiti da IA per l'elaborazione delle domande

To provide our services efficiently and accurately, our platform may use integrated automated and AI-assisted technologies as a core part of the application process. This is not an optional feature but a necessary component of our service delivery.

• What this means: When you submit your application and documents (like a passport scan or photo), we use these tools to:
  • Automatically extract information (e.g., name, passport number, dates) to populate the application form.
  • Analizzare i dati per errori comuni, completezza e coerenza.
  • Assicurare che la Sua fotografia soddisfi i requisiti specifici delle autorità governative.
• Tools We Use: This process may involve our own proprietary systems as well as secure services from trusted third-party technology partners (such as services from Google, OpenAI, n8n, etc.). This may involve the transfer of your data to servers located outside the European Economic Area (see Section 7 on International Data Transfers).
• Legal Basis: The processing of your general personal data for this purpose is necessary for the Performance of a Contract (our service agreement with you). Because this process involves your photograph (biometric data), we also require your Explicit Consent, which you provide when you agree to our Terms of Service and submit your application for processing.
• No Automated Decision-Making: It is important to clarify that our AI tools are used for processing and assistance only. They do not make the final decision on your travel authorization. The decision to approve or deny your application is made solely by the government authorities of the destination country.

5. Conservazione dei dati

Conserveremo i Suoi dati personali solo per il tempo necessario a soddisfare le finalità per cui sono stati raccolti, anche al fine di adempiere a eventuali obblighi legali, contabili o di rendicontazione.

• Application Data: We will retain your application data for the period of validity of the issued travel document plus an additional period as required by law (e.g., for accounting or to handle potential claims). After this period, your personal data will be securely deleted or anonymized.
• Data for AI (with consent): If you consent to AI processing, your data will be anonymized and used for model training, after which the original personal data will be deleted according to our standard retention policy.
• Customer Service Communications: Data will be retained for a period of up to 24 months after your case is closed to allow for follow-up inquiries.

5.1 Politica di cancellazione rafforzata per i documenti d'identità

Sebbene le registrazioni delle transazioni siano conservate per finalità legali e contabili, applichiamo un calendario di conservazione più rigoroso per i documenti d'identità ad alto rischio:

• Passport Copies & Face Photos: These files are permanently purged from our active servers within 30 days after your travel authorization has been finalized (granted or denied).
• Encrypted Backups: Any remaining encrypted fragments in system backups are overwritten according to our standard 60-day rotation cycle.

5.2 Archiviazione temporanea e richieste abbandonate

Adottiamo rigorose misure tecniche per garantire che i Suoi dati siano archiviati solo quando necessario per il completamento della Sua richiesta:

• Unfinished Forms (Abandoned): If you exit the application form before proceeding to the payment page, no information is submitted to or stored on our servers. Your data remains local to your browser session and is cleared once the session expires or the tab is closed.
• Pending Payments: Once you proceed to the payment stage, your form data is temporarily stored for a maximum of 48 hours. This period is strictly limited to ensuring we receive a “Payment Success”/”Payment Failure” confirmation from our Payment Service Providers (PSP).
• Automatic Deletion: If a payment attempt fails or is not completed within this 48-hour window, all associated data (including any uploaded documents) is automatically and permanently purged from our servers without being processed or reviewed.

6. Con chi condividiamo i Suoi dati

Non vendiamo i Suoi dati personali. Li condividiamo solo con le seguenti parti quando necessario:

• Government Authorities: The immigration authorities of the destination country to which you are applying for a travel document.
• Payment Service Providers: To process your payment securely and prevent fraud.
• Technology Service Providers: Our hosting providers, IT support, and platform developers who help us run our business.
• AI Service Providers: Trusted third-party companies that provide AI processing tools. We will ensure they have appropriate data protection safeguards in place.
• Legal and Law Enforcement: When required by law or to protect our legal rights.

7. Trasferimenti internazionali di dati

Alcune delle parti con cui condividiamo i Suoi dati (ad es. autorità governative di Paesi non UE o fornitori terzi di servizi di IA con sede negli Stati Uniti) si trovano al di fuori dello Spazio economico europeo (SEE).

Quando trasferiamo i Suoi dati al di fuori del SEE, ci assicureremo che siano protetti adottando garanzie adeguate, come l'utilizzo di Clausole contrattuali tipo (SCC) approvate dalla Commissione europea, per garantire che i Suoi dati ricevano un livello di protezione equivalente a quello previsto dal GDPR.

7.1 Destinazioni e garanzie

To fulfill our service, your data is transferred to the immigration authorities of the country you intend to visit (e.g., Australia, Canada, United Kingdom, or the United States).

• Adequacy: Transfers to the UK and Canada rely on the EU’s Adequacy Decisions.
• Standard Clauses: For transfers to countries without an adequacy decision (or to US-based technology providers like OpenAI or Google), we utilize Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework to ensure your data receives a level of protection equivalent to that in the European Union.

8. I Suoi diritti in materia di protezione dei dati

Ai sensi del GDPR, Lei dispone dei seguenti diritti relativamente ai Suoi dati personali:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You can ask us to delete your personal data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to suspend the processing of your data in certain scenarios.
• Right to Data Portability: You can request that we transfer your data to you or another service provider in a machine-readable format.
• Right to Object: You can object to us processing your data where we are relying on a legitimate interest.
• Right to Withdraw Consent: Where we rely on consent (e.g., for AI processing), you can withdraw it at any time.

Per esercitare uno qualsiasi di questi diritti, La preghiamo di contattarci all'indirizzo email indicato nella Sezione 1. Risponderemo alla Sua richiesta entro un mese.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence. The Spanish Supervisory Authority is the Agencia Española de Protección de Datos (AEPD).

9. Sicurezza dei dati

Abbiamo adottato adeguate misure di sicurezza tecniche e organizzative per evitare che i Suoi dati personali vengano accidentalmente persi, utilizzati, consultati in modo non autorizzato, alterati o divulgati. Tutto il nostro personale è formato sulle proprie responsabilità in materia di protezione dei dati.

10. Protezione dei minori

In accordance with the Spanish LOPDGDD, the minimum age to provide independent consent for data processing is 14 years old.

• Under 14: If the applicant is under 14, the data and biometric information must be provided by a parent or legal guardian.
• Verification: By submitting a minor’s application, the user affirms they have the legal authority to grant consent on the minor’s behalf. If we become aware that data from a child under 14 has been submitted without such authority, we will delete that information immediately.

11. Modifiche alla presente Informativa sulla privacy

Ci riserviamo il diritto di aggiornare la presente Informativa sulla privacy in qualsiasi momento. La versione aggiornata avrà efficacia non appena pubblicata su questo sito web. La invitiamo a consultare periodicamente questa pagina.