Política de privacidade

Data de vigência: 15 de fevereiro de 2026

1. Introdução e controlador de dados

This Privacy Policy explains how Electronic Travel Authority SL (“we”, “us”, “our Company”) collects, uses, and protects the personal data of the users (“you”, “the Customer”) of this website.

Estamos firmemente comprometidos com a proteção de sua privacidade e com o cumprimento de todas as leis de proteção de dados aplicáveis, incluindo o Regulamento Geral de Proteção de Dados da UE (GDPR) 2016/679 e a Lei Orgânica Espanhola 3/2018 sobre Proteção de Dados e Garantia de Direitos Digitais (LOPDGDD).

A entidade responsável pelo processamento de seus dados pessoais (o Controlador de Dados) é:

• Company Name: Electronic Travel Authority SL
• NIF (Tax ID): B21891445
• Registered Address: Calle Princesa, 31, Planta 2, 28008 Madrid, Spain
• Data Protection Contact Email: policy@electronic-travel-authority.com

2. Quais dados pessoais coletamos

Coletamos dados pessoais que você nos fornece e dados que são gerados pelo uso do nosso site. Os tipos de dados incluem:

• Identity & Travel Data: Full name, date and place of birth, passport details (number, issue/expiry date, issuing country), nationality, travel itinerary, signature, photographs, and any other information required on the travel authorization application form. This may include sensitive data such as biometric information contained in your passport photo.
• Contact Data: Email address, postal address, and telephone number.
• Transaction Data: Details of the services you have purchased from us and payment card details (processed securely by our third-party payment providers; we do not store your full card number).
• Technical Data: IP address, browser type and version, time zone setting, and other technology on the devices you use to access this website, collected via cookies. Please see our Política de Cookies for more details.
• Communications Data: Records of your correspondence with our Customer Service team.

2.1 Processamento especial de dados biométricos

As part of your application, we collect and process biometric data (specifically facial images from your photograph or passport).

• Purpose: This data is processed solely for Identity Verification and to comply with the mandatory requirements of the destination government’s immigration systems (e.g., UK ETA, Australia ETA).
• Scope: We do not use your biometric data for any secondary purposes, such as marketing, commercial profiling, or persistent facial recognition tracking.
• Consent: By uploading your photo and ticking the specific consent box, you provide explicit consent for this processing as required by Article 9 of the GDPR. You may withdraw this consent at any time, though this will likely result in the inability to process your travel authorization.

3. Como usamos seus dados: Objetivos e base legal

Realizamos o tratamento de seus dados pessoais apenas para finalidades específicas e mediante a existência de uma base legal fundamentada. A tabela abaixo detalha essas hipóteses:

4. Uso de ferramentas automatizadas e inteligência artificial no processamento de solicitações

To provide our services efficiently and accurately, our platform may use integrated automated and AI-assisted technologies as a core part of the application process. This is not an optional feature but a necessary component of our service delivery.

• What this means: When you submit your application and documents (like a passport scan or photo), we use these tools to:
  • Automatically extract information (e.g., name, passport number, dates) to populate the application form.
  • Analisar os dados para identificar erros comuns, assegurando a integridade e a consistência das informações.
  • Certifique-se de que sua fotografia cumpra integralmente os requisitos específicos estabelecidos pelas autoridades governamentais.
• Tools We Use: This process may involve our own proprietary systems as well as secure services from trusted third-party technology partners (such as services from Google, OpenAI, n8n, etc.). This may involve the transfer of your data to servers located outside the European Economic Area (see Section 7 on International Data Transfers).
• Legal Basis: The processing of your general personal data for this purpose is necessary for the Performance of a Contract (our service agreement with you). Because this process involves your photograph (biometric data), we also require your Explicit Consent, which you provide when you agree to our Terms of Service and submit your application for processing.
• No Automated Decision-Making: It is important to clarify that our AI tools are used for processing and assistance only. They do not make the final decision on your travel authorization. The decision to approve or deny your application is made solely by the government authorities of the destination country.

5. Retenção de dados

Somente reteremos seus dados pessoais pelo tempo necessário para cumprir as finalidades para as quais os coletamos, inclusive para atender a quaisquer requisitos legais, contábeis ou de relatórios.

• Application Data: We will retain your application data for the period of validity of the issued travel document plus an additional period as required by law (e.g., for accounting or to handle potential claims). After this period, your personal data will be securely deleted or anonymized.
• Data for AI (with consent): If you consent to AI processing, your data will be anonymized and used for model training, after which the original personal data will be deleted according to our standard retention policy.
• Customer Service Communications: Data will be retained for a period of up to 24 months after your case is closed to allow for follow-up inquiries.

5.1 Política de exclusão aprimorada para documentos de identificação

Embora os registros de transações sejam mantidos para fins legais e contábeis, aplicamos um cronograma de retenção mais rigoroso para documentos de identidade de alto risco:

• Passport Copies & Face Photos: These files are permanently purged from our active servers within 30 days after your travel authorization has been finalized (granted or denied).
• Encrypted Backups: Any remaining encrypted fragments in system backups are overwritten according to our standard 60-day rotation cycle.

5.2 Armazenamento temporário e aplicativos abandonados

Implementamos medidas técnicas rigorosas para garantir que seus dados sejam armazenados somente quando necessário para a conclusão de sua solicitação:

• Unfinished Forms (Abandoned): If you exit the application form before proceeding to the payment page, no information is submitted to or stored on our servers. Your data remains local to your browser session and is cleared once the session expires or the tab is closed.
• Pending Payments: Once you proceed to the payment stage, your form data is temporarily stored for a maximum of 48 hours. This period is strictly limited to ensuring we receive a “Payment Success”/”Payment Failure” confirmation from our Payment Service Providers (PSP).
• Automatic Deletion: If a payment attempt fails or is not completed within this 48-hour window, all associated data (including any uploaded documents) is automatically and permanently purged from our servers without being processed or reviewed.

6. Com quem compartilhamos seus dados

Não vendemos seus dados pessoais. Somente os compartilhamos com as seguintes partes quando necessário:

• Government Authorities: The immigration authorities of the destination country to which you are applying for a travel document.
• Payment Service Providers: To process your payment securely and prevent fraud.
• Technology Service Providers: Our hosting providers, IT support, and platform developers who help us run our business.
• AI Service Providers: Trusted third-party companies that provide AI processing tools. We will ensure they have appropriate data protection safeguards in place.
• Legal and Law Enforcement: When required by law or to protect our legal rights.

7. Transferências internacionais de dados

Algumas das partes com as quais compartilhamos seus dados (por exemplo, autoridades governamentais de países fora da UE ou provedores de serviços de IA terceirizados sediados nos EUA) estão localizadas fora do Espaço Econômico Europeu (EEE).

Quando transferirmos seus dados para fora do EEE, garantiremos que eles sejam protegidos por meio da implementação de salvaguardas adequadas, como o uso de Cláusulas Contratuais Padrão (SCCs) aprovadas pela Comissão Europeia, para garantir que seus dados recebam um nível de proteção equivalente ao do GDPR.

7.1 Destinos e proteções

To fulfill our service, your data is transferred to the immigration authorities of the country you intend to visit (e.g., Australia, Canada, United Kingdom, or the United States).

• Adequacy: Transfers to the UK and Canada rely on the EU’s Adequacy Decisions.
• Standard Clauses: For transfers to countries without an adequacy decision (or to US-based technology providers like OpenAI or Google), we utilize Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework to ensure your data receives a level of protection equivalent to that in the European Union.

8. Seus direitos de proteção de dados

De acordo com o GDPR, você tem os seguintes direitos em relação aos seus dados pessoais:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You can ask us to delete your personal data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to suspend the processing of your data in certain scenarios.
• Right to Data Portability: You can request that we transfer your data to you or another service provider in a machine-readable format.
• Right to Object: You can object to us processing your data where we are relying on a legitimate interest.
• Right to Withdraw Consent: Where we rely on consent (e.g., for AI processing), you can withdraw it at any time.

Para exercer qualquer um desses direitos, entre em contato conosco pelo endereço de e-mail fornecido na Seção 1. Responderemos à sua solicitação dentro de um mês.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence. The Spanish Supervisory Authority is the Agencia Española de Protección de Datos (AEPD).

9. Segurança de dados

Implementamos medidas de segurança técnicas e organizacionais adequadas para evitar que seus dados pessoais sejam acidentalmente perdidos, usados, acessados de forma não autorizada, alterados ou divulgados. Todos os nossos funcionários são treinados em suas responsabilidades de proteção de dados.

10. Proteção de menores

In accordance with the Spanish LOPDGDD, the minimum age to provide independent consent for data processing is 14 years old.

• Under 14: If the applicant is under 14, the data and biometric information must be provided by a parent or legal guardian.
• Verification: By submitting a minor’s application, the user affirms they have the legal authority to grant consent on the minor’s behalf. If we become aware that data from a child under 14 has been submitted without such authority, we will delete that information immediately.

11. Alterações a esta Política de Privacidade

Reservamo-nos o direito de atualizar esta Política de Privacidade a qualquer momento. A versão atualizada entrará em vigor assim que for publicada neste site. Recomendamos que você revise esta página periodicamente.