Your Data.
Our Responsibility.

Throughout this policy, the following terms carry the meanings given below:

• ›"VisaBanana", "we", "us", or "our" refers to GP Trips India Private Limited, the company that owns and operates the VisaBanana brand, incorporated under the laws of India, with its registered office at 3rd Floor, Landmark Cyber Park, Gurgaon Sector 67 — 122102.
• ›"Platform" means the VisaBanana website, mobile applications, and any associated digital services.
• ›"User", "you", or "your" refers to any person who accesses or uses the Platform, whether registered or not.
• ›"Personal Data" means any information that identifies or can reasonably identify a natural person, directly or in combination with other data.
• ›"Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• ›"Government Authority" means an embassy, consulate, immigration department, or other official body to which visa applications are submitted.

We collect information that falls into two broad categories: information you provide directly, and information generated automatically when you interact with the Platform.

Information you provide:

• ›Identity documents — full name, date of birth, gender, nationality, and passport details including number, issue date, and expiry.
• ›Contact details — email address, phone number, and residential address.
• ›Travel information — intended dates of travel, destination country, purpose of visit, and accommodation address.
• ›Financial records — bank statements, salary slips, or income tax returns submitted as part of visa requirements.
• ›Employment and education details — employer name, designation, work address, or academic institution as required by specific visa categories.
• ›Photographs — passport-size photographs meeting the specification of the relevant Government Authority.
• ›Additional documents — any supplementary record requested by an embassy or consulate (e.g., invitation letters, travel itineraries, insurance certificates).

Information collected automatically:

• ›Device and browser data — IP address, browser type and version, operating system, screen resolution, and device identifiers.
• ›Usage data — pages visited, features used, time spent on each section, and navigation paths within the Platform.
• ›Session data — session identifiers, timestamps of login and logout, and authentication tokens.
• ›Location data — approximate geographic location derived from your IP address (not GPS-level precision unless explicitly granted).

Every piece of data we collect serves a defined purpose. We do not process personal information for purposes incompatible with those listed below without obtaining fresh consent.

• ›Preparing and submitting visa applications to the relevant Government Authorities on your behalf.
• ›Verifying your identity and assessing application eligibility before submission.
• ›Communicating application status updates, required corrections, and approval or rejection notices.
• ›Processing payments and issuing receipts or invoices for services rendered.
• ›Providing customer support and resolving disputes or escalations.
• ›Detecting and preventing fraud, identity theft, and other unlawful activities on the Platform.
• ›Complying with applicable laws, court orders, or regulatory obligations.
• ›Improving the Platform through analysis of aggregated, de-identified usage patterns.
• ›Sending service-related communications (mandatory) and, where consented, promotional updates about new visa corridors or offers.

Cookies are small text files placed on your device by your browser when you visit the Platform. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or until they reach their expiry date).

Types of cookies we use:

• ›Strictly necessary cookies — essential for core Platform functions such as maintaining your session, remembering form progress, and securing authenticated areas. These cannot be disabled without breaking the service.
• ›Performance cookies — collect anonymised data about how visitors navigate the Platform (pages loaded, error rates, load times) to help us identify and fix performance issues.
• ›Functional cookies — remember your preferences such as language, currency display, and previously selected visa types to personalise your experience.
• ›Analytics cookies — placed by third-party analytics services (see Section 10) to measure aggregate traffic patterns.

You can manage cookie preferences through your browser settings. Note that disabling certain cookie categories may limit functionality. A cookie consent banner on first visit allows granular opt-in or opt-out for non-essential categories.

VisaBanana does not sell, rent, or trade your personal data. Disclosure to third parties occurs only in the circumstances described below:

• ›Government Authorities — embassies, consulates, immigration departments, and authorised visa facilitation centres (e.g., VFS Global) receive the data strictly required for your application.
• ›Payment processors — PCI-DSS Level 1 certified gateways process card and UPI transactions. VisaBanana does not store raw card numbers (see Section 11).
• ›Technology infrastructure providers — cloud hosting, document storage, and email delivery partners operate under contractual data processing agreements that prohibit independent use of your data.
• ›Identity verification services — third-party providers that check document authenticity or screen against government watchlists where legally required.
• ›Legal and regulatory bodies — courts, law enforcement agencies, or regulators when we receive a lawful order or are under a statutory obligation to disclose.
• ›Corporate transactions — in the event of a merger, acquisition, or asset sale, personal data may transfer to the successor entity subject to equivalent privacy commitments.

Subject to applicable law and any overriding legal obligation we are under, you have the following rights with respect to your personal data held by VisaBanana:

• ›Right to access — request a copy of the personal data we hold about you.
• ›Right to correction — ask us to rectify inaccurate or incomplete information.
• ›Right to erasure — request deletion of your personal data where we no longer have a lawful basis for retaining it.
• ›Right to restrict processing — ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• ›Right to data portability — receive your data in a structured, machine-readable format.
• ›Right to object — object to processing carried out on the basis of legitimate interests or for direct marketing.
• ›Right to withdraw consent — where processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Grievance Officer (see Section 15). We will respond within 30 days of receipt. Identity verification may be required before we act on your request.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. In practice:

• ›Application-related documents (passport copies, photographs, bank statements) are retained for 12 months from the date your application is closed, to support post-decision queries or appeals.
• ›Financial transaction records are retained for 7 years in compliance with the Income Tax Act, 1961 and the Prevention of Money Laundering Act, 2002.
• ›Account and profile data persists for as long as your account is active. If you close your account, data is deleted within 90 days unless a longer retention period is legally mandated.
• ›Anonymised and aggregated analytics data (which cannot identify you) may be retained indefinitely for internal research.

Visa applications by their nature require submitting your data to Government Authorities in foreign jurisdictions. Beyond this inherent necessity, VisaBanana may also transfer data to infrastructure providers whose servers are located outside India.

Where data is transferred outside India or the European Economic Area, we ensure one or more of the following safeguards is in place: contractual clauses approved by competent data protection authorities, certification under a recognised adequacy framework, or the explicit consent of the data subject.

By submitting a visa application through our Platform, you acknowledge and agree that your data will be transmitted to the relevant Government Authority in your destination country as a necessary step in the application process.

We deploy a layered security architecture designed to protect your data against unauthorised access, disclosure, alteration, or destruction. Key controls include:

• ›AES-256 encryption for all documents at rest, with keys managed in a logically isolated key-management service.
• ›TLS 1.3 with perfect forward secrecy for all data in transit between your device and our servers.
• ›Role-based access controls ensuring that staff can only access data relevant to their job function.
• ›Immutable audit logs recording every privileged access or modification event.
• ›Automated vulnerability scanning and periodic independent penetration testing.
• ›Data classification policies that separate identity documents from supporting records at the storage layer.

While we employ industry-standard measures, no digital system is entirely immune to risk. We encourage users to use strong passwords, avoid shared devices for sensitive submissions, and contact us immediately if they suspect unauthorised access to their account.

We use third-party analytics tools — including Google Analytics 4 — to understand how visitors interact with the Platform in aggregate. These tools collect data such as pages visited, session duration, referral source, and general geographic region.

Google Analytics operates under Google's own Privacy Policy. We have enabled IP anonymisation so that your full IP address is never stored by Google. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

We do not use analytics data to build individual profiles or to target advertising. All analysis is conducted at an aggregated level to guide product and content decisions.

Payment processing on the Platform is handled exclusively by PCI-DSS Level 1 certified payment gateways. VisaBanana never receives, processes, or stores raw card numbers, CVV codes, or full UPI credentials.

When you initiate a payment, you are interacting with the gateway's secure iframe or redirect flow. The gateway returns a token to our systems, which we use to reference the transaction. This token cannot be used to reconstruct your payment credentials.

All payment records are retained in tokenised form for the statutory period required under Indian financial regulations. Refund transactions, where applicable, are processed back to the original payment instrument through the same gateway.

The Platform may contain links to government portals, embassy websites, and third-party information resources. These external sites operate under their own privacy policies, which VisaBanana does not control and is not responsible for.

We recommend reviewing the privacy notice of any external site before submitting personal information to it. A link from the VisaBanana Platform does not constitute an endorsement of the linked site's privacy practices.

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If a minor is included in a family visa application, all data related to that minor must be submitted by a parent or legal guardian who accepts this policy on their behalf.

If you believe we have inadvertently collected personal data from a child without appropriate parental consent, please contact our Grievance Officer and we will delete the relevant data without undue delay.

We review this Privacy Policy at least once annually and update it whenever our data practices change in a material way. When we make significant changes, we will:

• ›Update the "Last updated" date at the top of this page.
• ›Display a notice on the Platform homepage for 30 days following a material change.
• ›Send a notification to registered users via the email address on their account.

Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms. If you do not agree with material changes, you may close your account and request deletion of your data.

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, VisaBanana has designated a Grievance Officer to address complaints related to data handling on the Platform.

If you are unsatisfied with the resolution provided by our Grievance Officer, you may escalate your complaint to the relevant data protection authority or court of competent jurisdiction in your country of residence.