Privacy policy

The protection of your personal data is important to us. Below we inform you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) about which data we process when you use this website and our application service, for what purpose, on what legal basis and for how long.

1. Controller

Avesta Interactive
Owner: Amin Sepehri
Hauptstraße 208C
28816 Stuhr
Germany

Email: info@visaparo.com
Phone: +49 4206 4460745 (Mon–Fri 4–7 pm CET/CEST)

VAT identification number: DE294421179. We have not appointed a data protection officer; please send data protection enquiries to the contact address above.

2. Overview: who we are and what we do

Visaparo assists travellers in preparing an ESTA application for the USA (see general terms and conditions). The decision on the application is made exclusively by U.S. Customs and Border Protection (CBP). To provide this service, we necessarily have to process information from your passport and about your journey.

3. Which data we process and for what purpose

3.1 Accessing the website, server logs (hosting)

When you access the website, our web server (operated by our hosting provider, see section 4) processes technically necessary connection data, in particular IP address, date and time, requested address (URL), amount of data transferred, status code and browser/operating system information (server log files). This data is necessary for secure and stable operation and is retained for a maximum of 14 days.

In addition, for forms and login attempts our application stores your IP address or your email address together with a counter for a short period (time window of minutes to hours; expired counters are removed by a regular deletion run) in order to prevent misuse and brute-force attacks (rate limiting).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security, stability and the prevention of misuse).

3.2 Customer account and login

To pay for and manage your application, you create a customer account. In doing so, we process your name, your email address and your password (only as a cryptographic hash, not in plain text). When you log in, the system also stores session data (session token, expiry time, IP address and browser identifier of the device). A session is valid for 7 days.

Resetting your password: if you request a link via “Forgot password”, we send an email with a single-use, time-limited link to the email address on file. The website’s response does not reveal whether an account exists for that address. Requests are limited in number to prevent misuse (counters per IP address and email address).

Two-factor login (voluntary for customers, mandatory for staff): if you set up two-factor login under “Security”, we store secret TOTP key material (encrypted) and recovery codes (only as a hash) in your account as well as counters for failed confirmations (temporary lock after several failed attempts). You can switch the function off again at any time (staff cannot), which deletes this data.

Alternatively – if offered on the login screen – you can log in via Google or X. The login then runs via an intermediary service (authentication broker of the hosting platform) to the respective provider; from there we receive your name, your email address and an identifier. The respective providers (Google, X) are themselves responsible for the processing on their side; their privacy notices apply. Your IP address may be transferred to the USA in the process.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract or pre-contractual measures); for session logging, rate limiting and two-factor login Art. 6(1)(f) GDPR (security of the account, Art. 32 GDPR).

3.3 Application data

To prepare and review your ESTA application, we process the information you enter in the application assistant, for yourself or as an authorised representative for other travellers (e.g. children, family members – please obtain their consent or, as a person with parental responsibility, the necessary authority):

• personal details: name, any other names, date of birth, place and country of birth, sex, nationality,
• passport data: passport number, issuing country, date of issue and expiry date,
• details of other passports or national identity cards issued by other countries,
• contact details: address, phone number, email address,
• travel data: purpose of travel, date of arrival, address in the USA, where applicable a contact person in the USA with name and phone number,
• answers to the eligibility questions, including supplementary travel, organisation and business-relationship data as well as details of visas and laissez-passer documents,
• uploaded documents: photo of the passport data page (mandatory), optionally a passport photo, each as JPEG, PNG or PDF.

Information about other persons (Art. 14 GDPR): if you provide information about other travellers or US contact persons, we receive their data from you. Please inform these persons about this privacy policy (purposes, legal bases, recipients including CBP, storage period, rights). Persons with parental responsibility act on behalf of children.

As long as you are not logged in, your entries are only kept in your browser’s storage (sessionStorage, see section 8) and are not transmitted to us. When you create the account and as you progress through the assistant, the information is stored on our server; from that point on the draft is kept only there, and the information (including passport number, dates of birth, address) is removed from the browser storage.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Without this information we cannot prepare the application; you are contractually obliged to provide it, but not by law.

3.4 Sensitive information (Art. 9 and 10 GDPR)

The eligibility questions of the ESTA procedure concern, among other things, communicable diseases (data concerning health, Art. 9 GDPR) as well as arrests/convictions and security-related matters (Art. 10 GDPR). We store your answers and the related supplementary details exclusively in order to review and submit your application.

For health information (Art. 9 GDPR), the legal basis is your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give in the application assistant before answering these questions and which we document with a time stamp and version. You can withdraw your consent at any time with effect for the future (contact see above); we will then no longer be able to process the application. The lawfulness of the processing carried out until then remains unaffected. Consent is voluntary; if you do not give it, an application through us is not possible, but you can then submit the application directly to CBP.

We process information on criminal convictions and offences (Art. 10 GDPR) exclusively because CBP mandatorily requests it for the ESTA application, and only for as long as is necessary for the submission to CBP; we do not base this processing on your consent alone. Immediately after submission, and no later than 30 days after receipt of payment, we delete this information. The same applies to your health information: we delete all answers to the eligibility questions immediately after submission to CBP, no later than 30 days after receipt of payment – even if the order has not been completed by then (section 6).

We do not use your passport photo and passport copy for biometric identification, but exclusively to check legibility and consistency with your information.

3.5 Security of passport uploads

Uploaded documents are not stored in a publicly accessible directory but in the database, where they are encrypted with AES-256-GCM (encryption at rest; the key is kept separately from the database). Transmission takes place via HTTPS. Only selected staff roles (case handling/review, administration) have access to documents; every retrieval is recorded in the audit log. Staff with pure support or accounting roles see passport numbers only in masked form and no documents. Likewise, particularly sensitive application data – passport number, date of birth, place and country of birth, date of issue and expiry date of the passport, address, US contact person and answers to the eligibility questions – is stored in the database encrypted field by field with AES-256-GCM (key separate from the database, versioned for a later key change). Only you yourself and the staff roles with document access receive it in plain text. To search for a passport number (e.g. in the case of queries), an irreversible check value (HMAC) is stored, not the number itself.

3.6 Order, payment and invoice

When you place an order, we process the selected package, the amount, the payment status, invoice data (invoice number, date, amount) and the record of your consents in the ordering process (acceptance of the general terms and conditions/privacy policy, acknowledgement of the information on the right of withdrawal, express request for performance to begin, time and version of the texts). We provide the order confirmation in your customer account and also send it by email (see 3.9).

You pay by bank transfer (prepayment). To match your payment, we process the details from the incoming payment: name of the account holder, IBAN, amount, date and payment reference (case number). The recipient is our bank, Sparkasse Bremen, Bremen, which is independently responsible for keeping the account. Legal basis: Art. 6(1)(b) GDPR; for the retention of bank statements and accounting records Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). We transfer refunds to the account from which the payment was made. We pay the CBP fee included in the total price to CBP ourselves; we do not transmit any customer payment data for this purpose.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for the retention of invoices and accounting records Art. 6(1)(c) GDPR (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB), Section 14b of the German VAT Act (UStG)); for the documentation of consents Art. 6(1)(c) and (f) GDPR (obligations to provide evidence, legitimate interest in legal defence).

3.7 Messages, status enquiry and contact form

Messages in the customer account, status notifications and the history of your case (event log) are stored so that we can answer queries and trace the processing. For the public status enquiry, we check the reference number and surname and show you only the processing status.

If you use the contact form, we store your name, email address, subject and message in order to answer your enquiry. The information in the form is voluntary; without it we cannot answer your enquiry. Please do not send passport numbers or other sensitive data via the form. We delete the enquiry no later than 180 days after receipt, unless retention obligations (e.g. for commercial letters) prevent this or it leads to a contract.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual enquiry), otherwise Art. 6(1)(f) GDPR (efficient handling of enquiries).

3.8 Audit log and prevention of misuse

Significant changes to applications and accounts as well as staff access (including document retrievals, role changes) are recorded in the audit log in order to be able to trace access and investigate misuse. Legal basis: Art. 6(1)(f) GDPR (data security and accountability), Art. 32 GDPR.

3.9 Sending emails (order confirmation)

After your order we send an order confirmation to the email address stored in the customer account. It contains the order data (reference number, package, total price, invoice number), the general terms and conditions, the information on the right of withdrawal and the model withdrawal form (pre-filled with your order data) as well as confirmation of your consent to the early start of performance. In this way we fulfil our obligation to confirm the content of the contract to you on a durable medium (Section 312f(3) of the German Civil Code (BGB)). The email does not contain any passport, birth or address data.

So that a confirmation is not lost in the event of temporary delivery problems, it is stored in a queue (“outbox”) in our database (recipient, subject, content, delivery status, times of delivery attempts) and resent several times in the event of errors. We delete these entries after 180 days. The emails are sent via our hosting provider Hetzner Online GmbH, Gunzenhausen (see section 4); transmission is encrypted in transit (TLS) where the receiving server supports this.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and (c) GDPR (legal obligation under Section 312f(3) BGB).

3.10 Automated support assistant (chat)

On our public pages you can ask an automated assistant general questions. It is a simple search program that runs exclusively on our own server and compares your question with the texts of this website (FAQ, guides, prices, general terms and conditions). No external AI or chat service is used; your question is not passed on to anyone. The assistant does not make any decisions about you (no automated decision within the meaning of Art. 22 GDPR) and does not assess individual cases.

Your question is processed only in the server’s working memory in order to answer it and is stored neither in a database nor in log files. The conversation history exists only in your open browser window and disappears when the page is reloaded or closed. Messages in which your browser recognises a passport number, date of birth, email address or phone number are not sent at all; you receive a notice instead. To prevent misuse (limiting requests), the server keeps a non-reversible check value (hash) of your IP address in working memory for a maximum of five minutes.

Statistics: we only count anonymously how often the assistant gave which type of answer in which language (e.g. “answer”, “no suitable information”, “forwarding”) – without question text, IP address or time. The counters are kept in working memory and deleted on restart. If you choose “Write by email”, your own email program opens with the question; we only receive it once you send the email yourself (section 3.7). The assistant clearly identifies itself as an automated system (AI notice) and never gives legal advice or approval promises.

If you choose “Send question to us”, your browser transfers the question to the contact form (temporarily stored in sessionStorage and deleted immediately when the form is opened); questions containing information on health or criminal offences are not transferred. Data is only transmitted when you submit the form yourself; section 3.7 then applies.

Legal basis: Art. 6(1)(f) GDPR (answering general questions, prevention of misuse); for temporary storage in the browser Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

3.11 Online withdrawal (“Withdraw from contract”)

If you use our withdrawal function, we store your name, your email address, the reference number you provide, the wording of your statement (including additional information) and the time of receipt. If the information matches an order, we assign the withdrawal to it. We send an acknowledgement of receipt to the email address provided (see 3.9); in addition, we receive an internal notification. No IP address is stored in the process; section 3.8 applies to the prevention of misuse.

Legal basis: Art. 6(1)(b) GDPR (unwinding of the contract) and (c) GDPR in conjunction with Section 356a BGB (obligation to acknowledge receipt). We delete this information 1460 days after receipt (evidence until the expiry of the regular limitation period, Sections 195, 199 BGB), unless retention obligations prevent this.

4. Recipients and processors

• Hosting: Our website and the associated data are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in the EU. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.
• E-mail sending and mailboxes: Order confirmations, other order-related e-mails, messages from the contact form and our mailboxes are also handled by Hetzner Online GmbH (address see above) on the basis of the same data processing agreement (Art. 28 GDPR). The recipient and sender addresses, subject and content of the e-mail are processed. No data is transferred to a third country in this process.
• CBP / US authorities: see section 5.
• Staff: internally, only those persons who need access for their tasks are granted it (role-based authorisation concept).
• Tax and legal obligations: where required by law, we pass on data to authorities, courts or advisers engaged for legal enforcement (Art. 6(1)(c) or (f) GDPR).

Data is not passed on for advertising purposes. We do not sell data.

5. Transfer to CBP in the USA (third country)

The purpose of the contract is to apply for an electronic travel authorisation from the US authority CBP (U.S. Customs and Border Protection, Department of Homeland Security). For this purpose, your application data – in particular personal details, passport data, travel data and answers to the eligibility questions – is transferred to CBP in the USA in your name and at your instigation. There is no adequacy decision of the European Commission for the USA with regard to public authorities; the level of data protection there may not correspond to that of the EU (e.g. more extensive access and storage rights of authorities). The transfer is necessary in order to submit the application you have requested and is based on Art. 49(1)(b) GDPR (performance of the contract with you); for your answers to the eligibility questions (special categories) additionally on your explicit consent pursuant to Art. 49(1)(a) in conjunction with Art. 9(2)(a) GDPR, which you give in the application assistant after being informed of the risks mentioned. You are the applicant vis-à-vis CBP; we transmit the data in your name as the service provider instructed by you. CBP processes the data under its own responsibility in accordance with US law; information on this can be found in the privacy notices on the official website esta.cbp.dhs.gov. If you do not want your data to be transferred to CBP, you cannot submit the application through us.

6. Storage period

• Server log files: a maximum of 14 days.
• Rate-limit counters: briefly (until the time window expires, then removal by the deletion run).
• Uploaded documents (passport, passport photo): are automatically deleted for completed orders 30 days after the last change to the case, and for all paid orders – including those not completed – no later than 30 days after receipt of payment. You can remove documents yourself beforehand in the application assistant.
• Email delivery queue (outbox): 180 days after sending or final failure. The order confirmation also remains available in your mailbox and as an invoice in your customer account.
• Unpaid, abandoned applications: are completely deleted after 60 days without activity, including uploaded files, messages and event log.
• Data of paid orders (application information, invoice and payment data, messages, records of consent): we store it for as long as necessary to process the contract, to defend or enforce claims (regular limitation period: 3 years to the end of the year) and to comply with statutory retention obligations (accounting records and invoices 8 years, commercial letters 6 years, Sections 147 AO, 257 HGB, 14b UStG). After that, or at your request where no obligations prevent this, we delete it.
• Answers to the eligibility questions (Art. 9/10 GDPR): are deleted immediately after submission to CBP (or when the case is closed), no later than 30 days after receipt of payment, even if the order has not been completed by then. Invoice, payment and accounting data are exempt from this 30-day period; they are subject to the statutory retention periods (Sections 147 AO, 257 HGB, 14b UStG) and are only deleted thereafter.
• Contact enquiries: 180 days after receipt (see 3.7).
• Online withdrawals: 1460 days after receipt (see 3.11).
• Database backups: are overwritten after no more than 14 days; until then, data that has already been deleted may still be contained in backups.
• Customer account: until you request deletion, unless statutory retention obligations prevent this.

The deletion runs mentioned run automatically at regular intervals; within these intervals data may briefly be held for longer.

7. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation; we will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

An informal message to the contact address above is sufficient to exercise your rights. We do not currently offer an automated self-service procedure (e.g. data export). Automated decision-making, including profiling (Art. 22 GDPR), does not take place.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover
https://lfd.niedersachsen.de

You can also contact the supervisory authority at your place of residence.

8. Cookies, browser storage and third-party content

• Session cookie: after login we set a technically necessary session cookie (__Host-grok-auth.session_token; HttpOnly, Secure, SameSite=Lax, lifetime up to 7 days). Its sole purpose is to recognise you as a logged-in user.
• sessionStorage in the browser: the application assistant keeps your entries (before login including passport number, dates of birth and address), the selected package and, where applicable, a login token in your browser’s sessionStorage. As soon as your draft is stored on our server, only the package, step and application ID remain there, but no more personal information. After the order has been submitted and on logout, the draft is deleted; after no more than 2 hours of inactivity it is discarded. The data is also deleted when the browser tab is closed. Please do not use the application on third-party or public devices.
• Support assistant: the chat does not store anything in the browser; only if you choose “Send question to us” is your question briefly held in sessionStorage until the contact form takes it over (see 3.10).
• No advertising or analytics tools: we currently do not use any tracking, analytics or marketing services. Fonts are delivered from our own server (no retrieval from Google Fonts).

Legal basis for the cookie and the browser storage: Section 25(2) no. 2 TDDDG (strictly necessary, no consent required) in conjunction with Art. 6(1)(b) and (f) GDPR.

9. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR, including encrypted transmission (HTTPS/HSTS), hashed passwords, encryption of uploaded documents and sensitive application data in the database (AES-256-GCM), limitation of login attempts, role-based access restrictions for staff and logging of sensitive access, firewall and hardening of the server (only necessary ports, protection against brute-force login attempts, automatic security updates), regular database backups and automated deletion runs. No system is absolutely secure; please choose a strong password used only here (at least 10 characters).

10. Changes to this policy

We adapt this privacy policy when processing operations or the legal situation change (e.g. when further service providers are integrated). The version available here at any given time applies.

The version in the language in which you access this privacy policy shall prevail.