Information about the processing of personal data
To comply with the obligations arising from the Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016 on protection of natural persons in relation to the processing of personal data and on free flow of such data and repealing Directive 95/46/EC (General Data Protection Regulation) hereinafter referred to as GDPR, INTERNATIONAL VISA SERVICE Limited Liability Company Limited Partnership with the registered office in Katowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP: 9542766476, REGON: 364718356, entered by the Katowice-Wschód District Court in Katowice, 8th Commercial Division, under KRS number 0000623079 (hereinafter referred to as IVS), informs about the processing of the client's personal data and the rights the client is entitled to. The following rules are applicable as of May 25th, 2018.
1. The controller of the personal data
INTERNATIONAL VISA SERVICE Limited Liability Company Limited Partnership with the registered office in Katowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP: 9542766476, REGON: 364718356, entered by the Katowice-Wschód District Court in Katowice, 8th Commercial Division, under KRS number 0000623079 is the controller of the personal data
Telephone number: +44 2031 293 603
E-mail address: support@evisa.express
2. Data protection officer
Aleksander Posmyk is the data protection officer at IVS, telephone +44 2031 293 603.
3. Purpose and legal basis of data processing
IVS processes personal data for the purpose of executing a contract to which the person whose data are processed is a party, or to take actions at the request of the data subject before concluding the contract (Article 6 par. 1 letter b of the GDPR).
In certain situations, IVS may process personal data due to the need to comply with legal obligations to which IVS is subject (Article 6 par. 1 letter c of the GDPR), or the processing is necessary to protect the vital interests of the data subject or another natural person (Article 6 par. 1 letter d of the GDPR), or processing is necessary for the purposes of the legitimate interests pursued by IVS (Article 6 par. 1 letter f of the GDPR), in particular, for the purpose related to:
marketing of IVS products and services,
monitoring and improvement of the quality of services provided by IVS, including monitoring of telephone conversations and meetings, carrying out customer satisfaction surveys of services provided,
if applicable, the conduct of disputable proceedings, as well as proceedings before public authorities and other proceedings, including carrying on enquiry and defence against claims.
In all other situations, personal data are processed solely on the basis of the consent granted for the purpose specified in its content (Article 6 par. 1 letter a of the GDPR).
In all situations, sensitive personal data are processed solely on the basis of the consent granted for the purpose specified in its content (Article 9 par. 2 letter a of the GDPR).
4. Recipients of data
IVS discloses or may disclose personal data to the following recipients or categories of recipients, in particular to:
a) public authorities and relevant state offices, competent to process visa applications and to issue visas;
b) entities that participate in the processes necessary to perform contracts concluded with clients, including banks, credit card operators, electronic and online payment agents,
c) entities which support IVS in business processes, including in particular entities processing personal data for IVS (so-called data processors), inter alia:
hosting companies,
legal services and accounting services,
companies and external entities carrying out processes which are a part of the activities necessary to conclude the contract with a client.
5. Time of data processing
The client's personal data, including sensitive data provided on the basis of consent, are processed by IVS for the time necessary to achieve the objectives indicated in point 3, that is, until the contract is concluded. After that period, IVS may process the client's data for a period of time and to the extent specified by law or for the pursuit of the legitimate interest of the controller as in point. 3, however, no longer than 10 years. Insensitive data processed on the basis of separate consent shall be kept until the consent is withdrawn.
6. The rights of data subjects
IVS guarantees all clients exercise of the data subject rights granted by the GDPR, including in particular:
the right to access the personal data;
the right to request correction of the personal data which are incorrect and the right to request supplementing of the incomplete personal data,
the right to request erasure of the personal data ("the right to be forgotten"), when:
a) the personal data are no longer necessary for the purposes for which they have been collected or otherwise processed;
b) the data subject has withdrawn the consent on which the processing is based and there is no other legal ground for processing;
c) the data subject objects to the processing;
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation provided by law
f) the personal data have been collected in relation to the offer of information society services.
- the right to request restriction of processing of the personal data when:
a) the data subject challenges correctness of the personal data;
b) the processing is unlawful and the data subject opposes to erasure of the personal data, requesting to limit their use instead;
c) the controller no longer needs the personal data for processing but it is necessary for the data subject to establish an enquiry or defend their claims;
d) the data subject has objected to the processing – pending determination of whether the legitimate grounds on the part of the controller take precedence over the grounds of objection.
- the right to transfer personal data if:
a) the processing takes place on the basis of consent or on the basis of a contract
b) the processing is automated
- the right to object to the processing of personal data, if there are reasons related to the client's special situation and the processing results from indispensability for the purposes resulting from legally justified interests pursued by the controller.
7. Withdrawal of consent to data processing
To the extent of the client's consent to processing of their personal data, the client is entitled to withdraw the consent at any time. The withdrawal takes place without affecting the legality of the processing which was carried out on the basis of the consent prior to its withdrawal.
8. The right to lodge a complaint with the supervisory authority
In any situation, when the client considers that IVS processes personal data contrary to the provisions of the GDPR, the client has the right to lodge a complaint with the appropriate supervisory authority.
9. Transfer of personal data to countries outside the European Economic Area
IVS transfers personal data to countries outside the European Economic Area:
Canada – the transfer of data is necessary for carrying out the contract of the visa agency. In addition, the Commission decision of 20th December 2001 stated that the regulations in force in Canada ensure an adequate level of protection of personal data.
IVS may transfer personal data to third countries, in particular, to the US and international organizations. The transfer of data takes place on the basis of standard contractual clauses agreed with the recipient, the content of which has been adopted by the European Commission and ensures the highest standards of personal data protection applied on the market.
The client has the right to obtain a copy of the data transferred by IVS.
10. Obligation to provide personal data
Providing personal data is entirely voluntary. Providing data is a condition for concluding a visa contract with IVS or it is necessary to achieve the objectives arising from the legitimate interests of IVS. Failure to provide all the data will prevent conclusion and execution of the indicated contract.