1. Data controller
- Cloud Dynamics Limited (雲逸科技有限公司), owner of VisadoAsia.
- Business Registration Number (Hong Kong): 67340964.
- Registered address: Rm 607 Yen Sheng Centre, 64 Hoi Yuen Rd, Kwun Tong, Hong Kong.
- Privacy contact: hi@visadoasia.com.
We apply the European Union General Data Protection Regulation (GDPR) to the data of people in the European Union, and the Hong Kong Personal Data (Privacy) Ordinance.
2. What data we process
- Contact and account data: your email and, if you write to us, your name.
- Order and payment data: visa, embassy, category, amount, currency, discount code and payment status. We do not receive or store your card details: you enter them in the form of Stripe, our payment provider, shown within our website, and Stripe processes them.
- Applicant data: nationality, country of residence, date of birth, planned arrival date and number of dependants.
- File documents and the data they contain: passport, photographs, bank statements and letters, contracts and proof of employment, flight and accommodation bookings, insurance, marriage and birth certificates, and others your embassy requires. They may include data of other people, such as your partner or children, if they travel with you as dependants.
- Special categories of data: some visas require a medical certificate (health data) or a criminal record certificate. We only process them if you upload them for your review.
- Review results: the status of each document, the checks performed and the report.
- Technical and browsing data: IP address (of which we only keep an encrypted digest, a hash, for 24 hours to prevent abuse), technical security logs and, if you consent, web analytics data (see the Cookie policy).
- Messages you send us through the contact form or by email.
3. Why we use them and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and charge your order, give you access to your account and provide the review service | Performance of the contract |
| Process the medical certificate and criminal record certificate you upload | Your explicit consent, given when you upload them for review. You can withdraw it by deleting those documents |
| Send you service emails (access, confirmation, requests for information, report) | Performance of the contract |
| Reply to your messages | Your request and our legitimate interest in answering it |
| Invoicing and accounting and tax obligations | Legal obligation |
| Security, fraud and abuse prevention, and usage limits | Legitimate interest in protecting the service and its users |
| Web analytics | Your consent (in Europe) |
We do not send marketing emails or newsletters. We do not sell your data. We do not send anything to embassies or authorities unless the law requires us to.
4. Artificial intelligence
We use AI providers (Anthropic, Google and OpenAI) to extract data from documents, run checks and prepare draft letters, always with human review before the report. We only send what each task needs and use their services under business (API) terms, under which, according to their terms, they do not use that data to train their models. We do not take decisions based solely on automated processing that produce legal effects concerning you. More details in the "Use of artificial intelligence" section of the Terms and conditions.
5. Who we share data with
We work with providers that process data on our behalf (processors), under contract and only for the service they provide to us:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, private document storage and account access | Servers in Ireland (EU) |
| Brevo | Sending service emails | European Union |
| Stripe | Payment processing and fraud prevention, through its payment form within our website | Across its payment network |
| Web server | Website hosting | France (EU) |
| n8n (self-hosted) | Internal automations, such as notifications and scheduled tasks | France (EU) |
| Anthropic, Google, OpenAI | AI document analysis | European Union and United States |
| Google Analytics | Web analytics, only with your consent in Europe | European Union and United States |
Stripe also acts as an independent controller of the payment data it processes to prevent fraud and meet its own legal obligations, and of the data of its Link service if you choose to save your payment method there. Its privacy policy is at stripe.com/privacy.
6. International transfers
Cloud Dynamics Limited is based in Hong Kong and our team may access data from Hong Kong and other countries. Documents and the database are stored in the European Union. When data leaves the European Economic Area, we use appropriate safeguards: European Commission adequacy decisions where they exist (for example, the EU-US Data Privacy Framework for certified providers) or standard contractual clauses approved by the Commission. You can ask us for more information at hi@visadoasia.com.
7. How long we keep data
| Data | Period |
|---|---|
| File documents | Automatically deleted 30 days after we deliver your report, or earlier if you delete them from your account. We only keep a record of the deletion (date and file reference), without the content |
| Report and review results | While you have an account, so you can consult them |
| Orders, payments and invoicing | 7 years, for accounting and tax obligations |
| Account | Until you ask us to delete it |
| Contact messages | As long as needed to reply and at most 12 months |
| Encrypted IP digest (hash) for usage limits | 24 hours |
| Web analytics | According to the Google Analytics settings, at most 14 months |
8. Security
Documents are kept in private storage that is not reachable from the internet: they are only uploaded and read through temporary signed links that expire. Data is encrypted in transit and at rest. Each user can only see their own orders and documents, and team access is restricted to those who review files.
9. Your rights
You can ask us at any time to access, rectify or delete your data, restrict or object to its processing, receive it in a portable format and withdraw your consent, without affecting processing carried out before the withdrawal. Email hi@visadoasia.com from your account email. We reply within one month at the latest.
You can also delete your documents yourself from your account with the "Borrar mis documentos ahora" (delete my documents now) button.
If you think we have not handled your data properly, you can complain to the data protection authority of your country (in Spain, the Agencia Española de Protección de Datos, www.aepd.es) or to the Office of the Privacy Commissioner for Personal Data in Hong Kong (www.pcpd.org.hk).
10. Minors
The service is for people aged 18 or over. We only process minors' data when their parent or guardian uploads it as dependants in their own file.
11. Changes
If we make important changes to this policy, we will say so on the website and, if they affect orders in progress, we will email you. The date of the last update is shown at the top of this page.
The Spanish version of this document is the reference version; this English version is provided for convenience.