Privacy Policy

Effective Date: February 15, 2026

1. Introduction and Data Controller

This Privacy Policy explains how Electronic Travel Authority SL (“we”, “us”, “our Company”) collects, uses, and protects the personal data of the users (“you”, “the Customer”) of this website.

We are firmly committed to protecting your privacy and complying with all applicable data protection laws, including the EU General Data Protection Regulation (GDPR) 2016/679 and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

The entity responsible for processing your personal data (the Data Controller) is:

• Company Name: Electronic Travel Authority SL
• NIF (Tax ID): B21891445
• Registered Address: Calle Princesa, 31, Planta 2, 28008 Madrid, Spain
• Data Protection Contact Email: policy@electronic-travel-authority.com

2. What Personal Data We Collect

We collect personal data that you provide to us and data that is generated through your use of our website. The types of data include:

• Identity & Travel Data: Full name, date and place of birth, passport details (number, issue/expiry date, issuing country), nationality, travel itinerary, signature, photographs, and any other information required on the travel authorization application form. This may include sensitive data such as biometric information contained in your passport photo.
• Contact Data: Email address, postal address, and telephone number.
• Transaction Data: Details of the services you have purchased from us and payment card details (processed securely by our third-party payment providers; we do not store your full card number).
• Technical Data: IP address, browser type and version, time zone setting, and other technology on the devices you use to access this website, collected via cookies. Please see our Cookie Policy for more details.
• Communications Data: Records of your correspondence with our Customer Service team.

2.1 Special Processing of Biometric Data

As part of your application, we collect and process biometric data (specifically facial images from your photograph or passport).

• Purpose: This data is processed solely for Identity Verification and to comply with the mandatory requirements of the destination government’s immigration systems (e.g., UK ETA, Australia ETA).
• Scope: We do not use your biometric data for any secondary purposes, such as marketing, commercial profiling, or persistent facial recognition tracking.
• Consent: By uploading your photo and ticking the specific consent box, you provide explicit consent for this processing as required by Article 9 of the GDPR. You may withdraw this consent at any time, though this will likely result in the inability to process your travel authorization.

3. How We Use Your Data: Purposes and Legal Basis

We process your personal data only for specific purposes and only when there is a legal basis to do so. The table below explains this in detail:

4. Use of Automated and AI-Assisted Tools for Application Processing

To provide our services efficiently and accurately, our platform may use integrated automated and AI-assisted technologies as a core part of the application process. This is not an optional feature but a necessary component of our service delivery.

• What this means: When you submit your application and documents (like a passport scan or photo), we use these tools to:
  • Automatically extract information (e.g., name, passport number, dates) to populate the application form.
  • Analyze the data for common errors, completeness, and consistency.
  • Ensure your photograph meets the specific requirements of the government authorities.
• Tools We Use: This process may involve our own proprietary systems as well as secure services from trusted third-party technology partners (such as services from Google, OpenAI, n8n, etc.). This may involve the transfer of your data to servers located outside the European Economic Area (see Section 7 on International Data Transfers).
• Legal Basis: The processing of your general personal data for this purpose is necessary for the Performance of a Contract (our service agreement with you). Because this process involves your photograph (biometric data), we also require your Explicit Consent, which you provide when you agree to our Terms of Service and submit your application for processing.
• No Automated Decision-Making: It is important to clarify that our AI tools are used for processing and assistance only. They do not make the final decision on your travel authorization. The decision to approve or deny your application is made solely by the government authorities of the destination country.

5. Data Retention

We will only retain your personal data for as long as is necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Application Data: We will retain your application data for the period of validity of the issued travel document plus an additional period as required by law (e.g., for accounting or to handle potential claims). After this period, your personal data will be securely deleted or anonymized.
• Data for AI (with consent): If you consent to AI processing, your data will be anonymized and used for model training, after which the original personal data will be deleted according to our standard retention policy.
• Customer Service Communications: Data will be retained for a period of up to 24 months after your case is closed to allow for follow-up inquiries.

5.1 Enhanced Deletion Policy for ID Documents

While transaction records are kept for legal and accounting purposes, we apply a stricter retention schedule for high-risk identity documents:

• Passport Copies & Face Photos: These files are permanently purged from our active servers within 30 days after your travel authorization has been finalized (granted or denied).
• Encrypted Backups: Any remaining encrypted fragments in system backups are overwritten according to our standard 60-day rotation cycle.

5.2 Temporary Storage and Abandoned Applications

We implement strict technical measures to ensure that your data is only stored when necessary for the completion of your request:

• Unfinished Forms (Abandoned): If you exit the application form before proceeding to the payment page, no information is submitted to or stored on our servers. Your data remains local to your browser session and is cleared once the session expires or the tab is closed.
• Pending Payments: Once you proceed to the payment stage, your form data is temporarily stored for a maximum of 48 hours. This period is strictly limited to ensuring we receive a “Payment Success”/”Payment Failure” confirmation from our Payment Service Providers (PSP).
• Automatic Deletion: If a payment attempt fails or is not completed within this 48-hour window, all associated data (including any uploaded documents) is automatically and permanently purged from our servers without being processed or reviewed.

6. Who We Share Your Data With

We do not sell your personal data. We only share it with the following parties when necessary:

• Government Authorities: The immigration authorities of the destination country to which you are applying for a travel document.
• Payment Service Providers: To process your payment securely and prevent fraud.
• Technology Service Providers: Our hosting providers, IT support, and platform developers who help us run our business.
• AI Service Providers: Trusted third-party companies that provide AI processing tools. We will ensure they have appropriate data protection safeguards in place.
• Legal and Law Enforcement: When required by law or to protect our legal rights.

7. International Data Transfers

Some of the parties we share your data with (e.g., government authorities of non-EU countries or third-party AI service providers based in the U.S.) are located outside the European Economic Area (EEA).

When we transfer your data outside the EEA, we will ensure it is protected by implementing appropriate safeguards, such as using Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data receives a level of protection equivalent to that under GDPR.

7.1 Destinations and Safeguards

To fulfill our service, your data is transferred to the immigration authorities of the country you intend to visit (e.g., Australia, Canada, United Kingdom, or the United States).

• Adequacy: Transfers to the UK and Canada rely on the EU’s Adequacy Decisions.
• Standard Clauses: For transfers to countries without an adequacy decision (or to US-based technology providers like OpenAI or Google), we utilize Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework to ensure your data receives a level of protection equivalent to that in the European Union.

8. Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You can ask us to delete your personal data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to suspend the processing of your data in certain scenarios.
• Right to Data Portability: You can request that we transfer your data to you or another service provider in a machine-readable format.
• Right to Object: You can object to us processing your data where we are relying on a legitimate interest.
• Right to Withdraw Consent: Where we rely on consent (e.g., for AI processing), you can withdraw it at any time.

To exercise any of these rights, please contact us at the email address provided in Section 1. We will respond to your request within one month.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence. The Spanish Supervisory Authority is the Agencia Española de Protección de Datos (AEPD).

9. Data Security

We have implemented appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. All our staff are trained on their data protection responsibilities.

10. Protection of Minors

In accordance with the Spanish LOPDGDD, the minimum age to provide independent consent for data processing is 14 years old.

• Under 14: If the applicant is under 14, the data and biometric information must be provided by a parent or legal guardian.
• Verification: By submitting a minor’s application, the user affirms they have the legal authority to grant consent on the minor’s behalf. If we become aware that data from a child under 14 has been submitted without such authority, we will delete that information immediately.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. The updated version will be effective as soon as it is published on this website. We encourage you to review this page periodically.