Privacy Notice

1. About this notice

This notice explains how Travel & Adventures Limited, trading as ETA Visa Pro (“we”, “us”), uses personal information about:

• people who visit our website;
• people who send us an enquiry, start an application or contact us;
• our customers, and the other travellers they ask us to help, including children.

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you give us information about someone else, such as a family member travelling with you, please show them this notice.

2. Who we are

We are the controller of the personal information described in this notice, which means we decide how and why it is used. We are Travel & Adventures Limited, a company registered in England and Wales under company number 17149161. Our address is:

The Information Commissioner’s Office (ICO) is the UK regulator for data protection. Section 14 explains how to contact it.

If you have a question about this notice or your personal information, email us at info@etavisa.pro with “Data protection” in the subject line, or write to us at the address above.

3. Information we collect

When you send an enquiry or start an application

Depending on the form, we ask for:

• your name, email address and phone number, and how you prefer us to contact you;
• the country that issued your passport, and the country where you live;
• how many people are travelling, your arrival date and the purpose of your trip;
• the plan you are interested in;
• what your message is about, any reference number you already have, and any message you choose to send us;
• whether you would like to receive marketing emails from us.

When you send a form, we also record the date and time, your IP address, the type of browser and device you are using, the page on our website where your visit started, the website that sent you to us (if any), and any campaign or advertising codes in the link you followed. These codes include UTM tags and the click identifiers added by Google (gclid), Meta (fbclid) and Microsoft (msclkid). We give each enquiry a reference number.

Your enquiry is emailed to our team and a copy is saved in a file on our web server.

When you use our service

To prepare an ETA application, we ask for the information the Home Office requires for each traveller, including:

• full name, date of birth and nationality;
• passport details and a photo of the passport;
• a photo of the traveller’s face;
• home address, email address and phone number;
• answers to the Home Office’s questions, including its suitability questions.

We also keep the final answers you approve, the written authority you give us to submit the application, and the Home Office’s decision.

Information about criminal convictions

The suitability questions ask about criminal convictions. The law treats this as criminal offence data, which needs extra protection. Section 6 explains how we handle it.

Payment information

Payments are handled by our third-party payment provider. We receive confirmation that you have paid, the amount, the date and a transaction reference. We may also see limited card information, such as the card type and the last four digits, but we never receive or store your full card number or security code.

Communications

We keep the emails and messages you send us, notes of phone calls, and records of any complaint.

Technical and cookie information

Like most websites, our server records basic technical information about each visit, such as your IP address, browser, the pages requested and the time. To stop spam, we keep a scrambled (hashed) version of your IP address for a short time when you send a form. If you accept analytics or advertising cookies, Google and Meta collect information about how you use our website. Our Cookie Policy gives the details.

Information you give us about other people

If you book for other travellers, you will give us their details. Please only do this with their permission, and make sure they know how we will use their information. Each adult traveller must confirm their own suitability answers before we submit.

4. Where we get information from

• Directly from you, through our website forms, our secure application link, email, phone and messages.
• From the person who booked for you, such as a family member or group organiser, or a parent or guardian in the case of a child.
• From the Home Office, when it sends a decision or asks for more information about an application we submitted.
• From our payment provider, which confirms your payment.
• From Google and Meta, if you accept their cookies. They give us reports about how visitors use our website and respond to our adverts. These reports are combined and do not identify you by name.

5. How we use information and our lawful bases

We may only use personal information when we have a lawful basis under UK GDPR. The table shows what we use it for and the basis we rely on.

Where we rely on legitimate interests, we have weighed our interests against your rights and what you would reasonably expect. You can ask us for details of that assessment, and you have the right to object (see section 12).

Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

The tick box on our forms asks you to confirm that you have read this notice. We do not treat it as consent to use your information. Our lawful bases are the ones in the table above.

We need the information the Home Office asks for in order to provide our service. If you do not give it to us, we cannot prepare or submit the application.

6. Criminal offence data and other sensitive information

Among other things, the Home Office’s suitability questions ask whether a traveller has any criminal convictions. Under Article 10 of UK GDPR, information about criminal convictions and offences may only be used where UK law allows it.

We collect this information only because the application asks for it. We use it only to prepare and submit that traveller’s application, and only the specialists working on the application can see it.

Our lawful basis is contract (Article 6(1)(b) of UK GDPR). The additional conditions we rely on, from Part 3 of Schedule 1 to the Data Protection Act 2018, are:

• consent (paragraph 29). We ask each adult traveller, or a child’s parent or guardian, to consent to us using their answers when they give them to us; and
• legal claims (paragraph 33). If there is a complaint or dispute about an application, we may keep and use the answers where this is necessary to establish, exercise or defend legal rights.

You can withdraw your consent at any time before we submit the application. We will then stop using your answers and delete them, unless we need them for a dispute, but we will not be able to continue with the application. Our Refunds and Cancellations policy explains what happens to your payment. Once an application has been submitted, the Home Office holds its own copy, which we cannot recall.

We do not ask for health information or other special category data. If you choose to tell us something of that kind, for example to explain why you need extra help, we will use it only for that purpose, with your explicit consent, and delete it along with your other application details.

We check that the photo of your face meets the Home Office’s photo rules and pass it to the Home Office with your application. We do not use it for facial recognition or for any other purpose.

7. Children

Children, including babies, need their own ETA. A parent or legal guardian must give us the child’s details, approve the application and give us authority to submit it.

Our website and service are for adults, and we do not knowingly accept enquiries from anyone under 18. If we find that a child has contacted us directly, we will ask for a parent or guardian to get in touch, and delete the child’s information if we cannot reach one.

We use a child’s information only to prepare and submit their application, and never for marketing. A parent or guardian can usually exercise a child’s data protection rights on their behalf.

8. Who we share information with

We share personal information only where we need to, and only as described here. We do not sell personal information.

• The Home Office. When we submit an application, we send the traveller’s details to the Home Office through the official application service. The Home Office is then an independent controller of that information and uses it under its own privacy information, published on GOV.UK.
• Our payment provider, which processes your payment. It may also use your information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy notice.
• Our hosting provider, which runs the server that holds our website and the copies of enquiries saved there.
• Google, as our email provider. Our team’s inbox is a Google (Gmail) account, so enquiries and emails are stored on Google’s systems.
• Other IT service providers we use to run our business, such as the secure online tools we use to collect application details.
• WhatsApp, if you choose to contact us that way. WhatsApp is owned by Meta and handles those messages under its own terms. Please do not send passport images or suitability answers by WhatsApp.
• Google and Meta, for analytics and advertising, but only if you accept those cookies. They receive information about your device and how you use our website. When you send an enquiry, their tags record that an enquiry was made, with its reference number. We do not send them your name, contact details or application details.
• Professional advisers, such as our accountants, lawyers and insurers, where they need it to advise us.
• The police, regulators, courts and other public bodies, where the law requires us to share information, or where it is needed to prevent or detect crime.
• A buyer of our business. If we sell or reorganise our business, personal information may pass to the new owner, who may use it only in the ways set out in this notice.

Where a provider handles personal information on our behalf, it may use it only on our instructions and must keep it secure.

9. International transfers

Some of our providers, including Google and Meta, store or access personal information outside the UK, for example in the European Economic Area or the United States.

When personal information is transferred outside the UK, we make sure it is protected in one of these ways:

• the country, or the organisation receiving it, is covered by UK adequacy regulations. These cover, for example, the countries of the European Economic Area, and US organisations certified under the UK Extension to the EU-US Data Privacy Framework; or
• the transfer is covered by the International Data Transfer Agreement (IDTA), or by the UK Addendum to the European Commission’s standard contractual clauses.

You can ask us for more information about the safeguards for a particular transfer.

10. How long we keep information

We keep personal information only for as long as we need it. After that, we delete it securely, including the copies in our email inbox.

11. How we protect your information

We take appropriate technical and organisational steps to protect personal information, including:

• using encrypted connections (HTTPS) for our website and the secure links we send you;
• limiting access to the people in our team who need it for their work, and protecting our systems with passwords;
• asking you to send passport images, photos and suitability answers only through our secure link, not by ordinary email or messaging apps;
• deleting the most sensitive application details soon after the decision, as set out in section 10.

We will never ask you to send card details by email, phone or message. Payments are made only through our payment provider.

No system is completely secure. If a personal data breach happens that is likely to put your rights at high risk, we will tell you without undue delay, and we will report it to the ICO where the law requires.

12. Your rights

Under UK GDPR you have the right to:

• access: ask for a copy of the personal information we hold about you;
• rectification: ask us to correct information that is wrong or incomplete;
• erasure: ask us to delete your information in certain circumstances;
• restriction: ask us to limit how we use your information, for example while we check whether it is accurate;
• data portability: where we use information you gave us on the basis of consent or contract, ask for it in a structured, machine-readable format, or ask us to send it to another organisation;
• object: object to our use of your information where we rely on legitimate interests. You can object to direct marketing at any time, and we will stop;
• withdraw consent: where we rely on your consent, withdraw it at any time;
• rights about automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make any decisions of this kind. The Home Office makes its own decisions on ETA applications, and explains how in its own privacy information.

Some rights have limits. For example, we may need to keep certain records to meet our legal obligations even if you ask us to delete them. If that applies, we will explain why.

How to make a request

Email us at info@etavisa.pro or write to us at the address in section 2. We may ask you to confirm your identity before we act. There is normally no charge.

We will respond within one month. If your request is complex, or you have made several requests, we may extend this by up to two further months. If we need to do that, we will tell you within the first month and explain why.

13. Marketing

We only send marketing emails, such as news about changes to UK travel rules, if:

• you ticked the box on one of our forms to say you would like to hear from us; or
• you are a customer, the emails are about similar services of ours, and you did not opt out when you gave us your details. This is known as the “soft opt-in” under PECR.

Every marketing email includes a link to unsubscribe, and you can also unsubscribe at any time by emailing us. We do not send marketing texts or make marketing calls unless you have specifically agreed to them, and we never pass your details to other organisations for their marketing.

Messages about your enquiry or application, such as progress updates and decisions, are not marketing. We will send these even if you have unsubscribed from marketing.

14. Complaints

If you are unhappy with how we have used your personal information, please tell us first so we can try to put it right. Our Complaints Procedure explains how.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

• Online: make a complaint on the ICO website
• Phone: 0303 123 1113

15. Changes to this notice

We review this notice regularly and update it when the way we use personal information changes. The “last updated” date on this page shows when it was last changed. If we make a significant change that affects our customers, we will tell them by email.

16. Contact us

• Email: info@etavisa.pro (please put “Data protection” in the subject line)
• Post: Travel & Adventures Limited, 100a Stricklandgate, Kendal, Cumbria, LA9 4PU, England