Privacy Policy

1. Who we are

abizon operates this website and the visa filing service described on it. For the purposes of Indian data protection law and the GDPR, abizon is the data controller for the personal data described below. Questions go to privacy@abizonvisa.com.

2. What we collect

Information you give us

• Identity details — name, date of birth, nationality, passport number
• Contact details — email address, phone number, postal address
• Travel details — destination, dates, itinerary, accommodation and flight bookings
• Documents — passport scans, photographs, bank statements, tax returns, employment letters and any other document a destination requires
• Payment details, processed by our payment provider and never stored by us

Information we collect automatically

• Device and browser type, and approximate location derived from IP address
• Pages viewed and actions taken, to diagnose faults and improve the service

3. Why we use it

• To file your application. This is the primary purpose and the legal basis is performance of our contract with you.
• To keep you informed. Status updates, document requests and delivery confirmations.
• To meet legal obligations. Payment records are retained for seven years as Indian tax law requires.
• To improve the service. Using aggregated data only, subject to the constraints described in section 6.

4. Who we share it with

Government authorities of the destination you are applying to, and their appointed visa application centres. This is the point of the service and cannot be opted out of while still applying.

Payment processors, who receive the transaction details necessary to take payment. We never receive or store your full card number.

Infrastructure providers who host our systems under contract, and who are bound to process data only on our instructions.

We do not sell personal data. We do not share it with advertisers or data brokers. We do not disclose it to third parties for their own purposes.

5. How long we keep it

• Documents — deleted 30 days after your application reaches a final outcome
• Application records — destination, dates and outcome, retained while your account is open
• Payment records — seven years, as required by law
• Analytics — 26 months, in aggregated form

Deletion can be requested earlier at any time. See Security for the technical detail of how documents are stored and destroyed.

6. What we never do with your documents

Your passport scans, photographs and financial documents are not used to train machine learning models, are not used for analytics, and are not used for advertising. Our document intelligence models are trained on licensed and synthetic datasets. Our published research uses application metadata only, subject to a minimum aggregation threshold of 1,000 records — see abizon Atlas.

7. Your rights under the DPDP Act

This section used to be written in the vocabulary of the GDPR — legitimate interests, the right to object, data portability. Those are European concepts and two of the three have no counterpart in Indian law, so the list described rights we could not actually offer and omitted two that we owe you. What follows is the Digital Personal Data Protection Act 2023, which is the law that governs your data here.

• Access (s.11) — a summary of the personal data we process about you, what we do with it, and who else we have shared it with.
• Correction, completion and erasure (s.12) — we correct inaccurate data, complete incomplete data, and erase what we no longer need for the purpose you gave it for or to meet a legal obligation.
• Grievance redressal (s.13) — a route to complain to us that does not depend on our goodwill, with published periods. See below.
• Nomination (s.14) — you may nominate someone to exercise these rights on your behalf if you die or become incapacitated. Ask and we will record it.
• Withdrawal of consent (s.6(4)) — as easily as you gave it. An application already filed with a consulate cannot be unfiled, so withdrawal stops future processing rather than reversing what a government already holds.

Write to privacy@abizonvisa.com. We do not charge for exercising any of these.

8. Children

Section 9 of the DPDP Act treats anyone under 18 as a child, and children travel. Where an applicant is a minor we process their data only on the verifiable consent of a parent or lawful guardian, obtained through the adult who is making the application. We do not track a child, profile them, or serve them advertising — none of which we do to adults either.

9. If something goes wrong

A personal data breach is reported to the Data Protection Board of India and to every affected person, without a threshold and without waiting to establish harm — the Act does not provide for one and we do not apply one of our own.

10. Complaining, and escalating

Raise it with our Grievance Officer, named below. Every complaint is acknowledged within 24 hours with a ticket number and resolved within 15 days.

If you are not satisfied, you may complain to the Data Protection Board of India. Section 13(3) requires you to exhaust our process first, which is the reason the periods above are published: they are what tells you when you are entitled to escalate.

11. Where your data is held

Data for Indian applicants is stored in India. Data for GCC applicants is stored in the UAE. Neither is replicated outside its region. Where a document must reach a government outside that region, it is transmitted for that purpose only.

12. Cookies

We use cookies necessary for the site to function — session management and security — and, with your consent, analytics cookies that help us understand where the application flow is failing people. Analytics can be declined without any loss of functionality.

13. Changes

Material changes are notified by email at least 30 days in advance. The revision date at the top of this page always reflects the current version.

14. Who to contact