Privacy Policy
Last updated: 28 June 2026
This Privacy Policy explains how ABUNDANCE LEGAL LTD (“VisaTourist”, “we”, “us”) collects, uses, shares, and protects your personal data when you use visatourist.org and our ESTA application-preparation and submission Service. It is designed to comply with the UK GDPR and the Data Protection Act 2018, the EU GDPR, and the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), among other laws.
Data Controller: ABUNDANCE LEGAL LTD, Suite 10448, 5 Brayford Square, London, E1 0SG, United Kingdom (company number 16994280). Privacy / Data Protection Contact: support@visatourist.org (we have not appointed a separate Data Protection Officer; privacy requests are handled via this address).
2.1 Personal Data We Collect
To prepare and submit an ESTA application, we collect the personal data the U.S. ESTA program requires, which you provide to us, including:
- Identity data: full name, other/maiden names, gender, date and place of birth, citizenship and nationality, country of residence.
- Passport and document data: passport number, issuing country, issue and expiry dates, national identity document numbers, and (where applicable) other travel-document details.
- Contact data: email address, telephone number, home/postal address.
- Travel data: travel and trip details, U.S. point-of-contact and U.S. address (where applicable), and related itinerary information requested by ESTA.
- Employment data: current or previous employer name, address, and job title, where required by the ESTA application.
- Emergency contact data: name, phone, and email of an emergency contact.
- ESTA eligibility responses: answers to the security and eligibility questions required by CBP.
- Payment data: processed by Stripe. We receive limited transaction details (e.g., confirmation, last four digits, billing country); we do not store full card numbers.
- Technical/usage data: IP address, device/browser type, and similar data collected via cookies and similar technologies (see the Cookie Policy).
Some of this data may be considered sensitive. We collect only what is necessary to provide the Service you request.
2.2 Purposes and Legal Bases for Processing (GDPR Art. 6)
| Purpose | Legal basis (GDPR) |
|---|---|
| Preparing, reviewing, error-checking, and submitting your ESTA application to CBP | Performance of a contract (Art. 6(1)(b)) — the Service you purchased |
| Processing payment (government fee + service fee) via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Communicating with you about your order and outcome (email/support) | Performance of a contract (Art. 6(1)(b)) |
| Complying with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Securing our systems, preventing fraud, and improving the Service | Legitimate interests (Art. 6(1)(f)) |
| Analytics and advertising cookies (e.g., Google Analytics, Google Ads), set when you use the site | Legitimate interests (Art. 6(1)(f)) — to measure, operate, and promote the Service; you may opt out as described in the Cookie Policy |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
2.3 How We Protect Your Data
We store personal data encrypted and apply technical and organizational measures appropriate to the sensitivity of the data, including access controls and encryption in transit and at rest. No method of transmission or storage is 100% secure, but we work to protect your data and to maintain breach-response procedures.
2.4 Data Retention
We retain your personal data only as long as necessary for the purposes described above. Our standard retention period is 6 months after your ESTA application has been submitted to / decided by CBP, after which it is securely deleted, except where a longer period is required by law (for example, tax or accounting records) or to establish, exercise, or defend legal claims. You may request earlier deletion as described in Section 2.7, subject to any legal obligation requiring us to retain certain records.
2.5 Who We Share Data With (Recipients)
We share personal data only as necessary to deliver the Service:
- U.S. Customs and Border Protection (CBP): we submit your ESTA application data to CBP via the official ESTA system. This is the core purpose of the Service. CBP processes your data under U.S. government rules.
- Stripe, Inc.: to process payments.
- Email / communication provider(s): to send you order and outcome communications.
- Hosting and IT infrastructure providers: to operate our website and securely store data, under data-processing agreements.
- Professional advisers and authorities: where required to comply with law, enforce our Terms, or protect rights.
We do not sell your personal data. We do not “share” your personal data for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA, except in connection with the analytics and advertising cookies described in our Cookie Policy, which you can opt out of as described there.
2.6 International Data Transfers
Providing the Service inherently requires transferring your data to the United States, because the ESTA application is submitted to U.S. CBP. Depending on where you and our infrastructure are located, your data may also be processed in other countries. Where we transfer personal data out of the UK or EEA to a country without an adequacy decision, we rely on appropriate safeguards such as the Standard Contractual Clauses and the UK International Data Transfer Agreement/Addendum where applicable. The transfer of your application data to CBP is necessary for the performance of the contract you requested (GDPR/UK GDPR Art. 49(1)(b)) and to take steps at your request.
2.7 Your Rights
Under the UK GDPR and EU GDPR (UK/EEA residents), subject to conditions, you have the right to: access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO, ico.org.uk); in the EU, your local data-protection authority.
Under CCPA/CPRA (California residents), you have the right to: know/access the categories and specific pieces of personal information collected; delete personal information; correct inaccurate information; opt out of the sale or sharing of personal information (we do not sell; opt-out of advertising cookies is available via our banner); limit use of sensitive personal information; and not be discriminated against for exercising your rights.
To exercise any right, contact support@visatourist.org. We will verify your identity and respond within the timeframe required by applicable law. You may use an authorized agent where the law permits.
2.8 Children
The Service is intended to be purchased by adults. Where an application is for a minor, it must be submitted by a parent, legal guardian, or authorized adult who consents to the processing of the minor’s data.
2.9 Cookies
Our website uses cookies and similar technologies, including analytics and advertising cookies (such as Google Analytics and Google Ads) that are set when you use the site. You can opt out of analytics and advertising cookies through your browser settings, through Google’s ad settings at adssettings.google.com and the Google Analytics Opt-out Browser Add-on, and through your device’s ad controls. See our Cookie Policy for full details.
2.10 Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date reflects the current version. Material changes will be posted on this page.
2.11 Contact
Privacy questions or requests: support@visatourist.org — ABUNDANCE LEGAL LTD, Suite 10448, 5 Brayford Square, London, E1 0SG, United Kingdom.