Privacy Policy

1. Data controller and scope

The personal data controller is the company providing services under the Visa Navigator brand. The full legal name, BIN, registered address and bank details are specified in the client's individual contract and invoice.

This Policy applies to data received through the website, email, telephone, messengers, contact forms and in the course of performing the contract. It does not govern third-party websites and services that external links may lead to.

2. What data we collect

• Contact details: name, phone number, email address and preferred method of contact.
• Information needed to assess your request: citizenship, country of residence, purpose and expected dates of travel, details of your employer or business, and your comments.
• Documents required for the chosen service: passport and identification data, visa history, photographs, powers of attorney, corporate, employment, financial and other supporting documents.
• Technical data: IP address, device and browser type, date and time of access, pages visited, referral source and data from essential cookies.
• Correspondence, recordings of calls made with your consent, and payment information, excluding full bank card details, which are processed by the payment provider.

3. Data you provide through the website: what, why, how long we keep it, how to delete it

What we receive. Through the request form — your name, phone number, e-mail (optional), citizenship, purpose of the request and comment. Together with the request we automatically store the site language, the page it was sent from, your IP address and browser type, and the traffic source (utm and gclid campaign tags) if you arrived via an advertising link. In the client area — the e-mail used to sign in, the documents you upload, messages to your coordinator and details of your case and invoices.

Why.

• To contact you, assess your situation and prepare a service proposal — based on the consent you tick in the form.
• To conclude and perform the contract and manage your case in the client area — based on the contract.
• To understand which advertising channels bring clients: source tags are used in aggregated form and are never passed to advertising platforms together with your contact details.
• To protect the form from spam and abuse (this requires the IP address).

How long we keep it.

• A request that did not lead to a contract — 12 months from the last contact, then deleted or anonymised.
• Client data and documents under a contract — for the term of the contract and 5 years after it ends (retention periods for accounting and tax records under the laws of the Republic of Kazakhstan). Documents the law does not require us to keep are deleted earlier at your request.
• Technical server logs (IP address, request time) — up to 6 months.
• Web analytics data (Google Analytics) — up to 14 months, anonymised.

How to delete your data or withdraw consent. Message us on WhatsApp +7 (707) 806-59-56, stating the name and the phone number or e-mail you used in the request; to protect your data we may ask you to confirm your identity. We will delete the data within 10 business days and confirm by reply. The exception is information we are legally required to keep (documents of a performed contract, accounting records): it is stored with restricted access until the statutory period expires and is not used to contact you. You may withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal. In the client area you can ask your coordinator to delete an uploaded document via the case chat.

4. Purposes and legal basis for processing

Depending on the situation, processing is based on consent, the need to enter into or perform a contract, compliance with a legal obligation, or a legitimate interest, provided it does not override the client's rights and freedoms.

• Responding to your request, preliminary assessment of your situation and preparing a service proposal.
• Entering into and performing the contract, checking documents, preparing applications and supporting communication with host organizations and authorized bodies.
• Invoicing, recording payments and complying with accounting, tax and other applicable legislation.
• Ensuring website security, preventing abuse and protecting the legitimate interests of the company and the client.
• Sending informational and marketing messages — only with separate consent, which can be withdrawn at any time.

5. Data sharing and cross-border processing

We disclose data only to the extent necessary for the service: to employees and contractors, the host party, translators, notaries, courier and payment services, providers of secure IT infrastructure, as well as consular, migration and other authorized bodies.

If a service requires transferring data outside the client's country of residence, such transfer is carried out to perform the contract, with the client's consent, or on another legal basis provided by law. Recipients are required to maintain confidentiality and use the data only for the agreed purpose.

We do not sell personal data and do not share it with third parties for their own marketing purposes.

6. Retention and security

Data is retained for as long as necessary to handle your request and perform the contract, and thereafter for the periods required by law or needed to defend against potential claims. Outdated data is deleted or anonymized when its further retention is no longer required.

We apply access controls, secure transmission channels, backups and organizational measures. However, no method of storing or transmitting data can guarantee absolute security.

7. Cookies and analytics

The website may use essential cookies to operate the interface and remember language settings, as well as analytics cookies — only once they are actually enabled and the required consent has been given. Cookies can be restricted or deleted in your browser settings; some website features may then not work correctly.

To measure advertising performance the site uses Google Analytics 4 and the Google Ads tag: they record visits, form submissions and clicks on contact buttons in anonymised form and do not receive your name, phone number or e-mail. You can disable such cookies in your browser settings — the site will keep working.

8. Your rights

To protect your data, we may ask you to verify your identity. A response is provided within the period established by applicable law.

• Obtain information about the processing and a copy of your personal data.
• Request correction of inaccurate data or completion of incomplete data.
• Withdraw consent and request deletion or restriction of processing where there is no other legal basis for retention.
• Object to processing and opt out of marketing messages.
• Lodge a complaint with the authorized personal data protection authority.

9. Minors' data and changes to this Policy

We do not request data of minors without the involvement of their legal representative. By submitting such data, the applicant confirms they have the appropriate authority.

This Policy may be updated when our services or legislation change. The new version takes effect from the date of publication on this page; we will notify you of material changes by an accessible means.

Questions about personal data

For questions about personal data, deletion or withdrawal of consent, message us on WhatsApp +7 (707) 806-59-56. We reply within 10 business days.