Privacy notice for applicants
Last updated
This notice is given by the business that sent you this link: the one named at the top of this page (“we”). We are preparing your US visa application (form DS-160) and are responsible for your information as its controller.
What we collect
- Your answers to the DS-160: names, date and place of birth, nationality, national identification and passport details, addresses, phone numbers, email addresses and social media identifiers, travel plans and history, family members, education and work history.
- Your answers about health and criminal history. The DS-160’s security and background questions ask about health (for example communicable diseases, mental or physical disorders and drug use) and about arrests, convictions and other criminal matters. These are special categories of personal data and data about criminal offences, and we collect them only because the US government requires them on the DS-160.
- Your visa photo and documents you upload, such as a passport scan.
- Messages you and our staff write to each other about your application.
- A record of each change to an answer, who made it and when.
- How you use these pages, such as which pages you open.
- Your consent: when you agreed to this notice, in which language, and the browser you used.
Why we use it
To prepare your DS-160 with you, check it, and file it with the US Department of State on CEAC, and to keep a record of what was filed. We use your information for nothing else.
Your consent
We ask for your explicit consent before you answer anything, because the DS-160 asks about health and criminal history. You can withdraw your consent at any time with the link at the bottom of these pages. After you withdraw it, this link can no longer change your application unless you agree again; withdrawing does not undo what was done before. Withdrawing does not delete your information: to have it deleted, ask us using the contact details at the top of this page.
Who receives it
- The US Department of State. Filing a DS-160 sends your answers to CEAC, which the US government operates. Once filed, that copy is outside our control and cannot be deleted by us.
- Our software provider, which hosts these pages and stores your application for us in the United States, under a written agreement that lets it use your information only on our instructions. It runs on its own servers, and uses these services of its own, each under a written agreement:
| Service | What for | Location |
|---|---|---|
| Backblaze (B2) | Storing photos, documents and filed-application PDFs | United States |
| Google (Gemini API) | Translating free-text answers into English; extracting the details on a passport scan when you or our staff ask | United States |
| Amazon Web Services (SES, S3) | Sending and receiving the emails about your application | United States |
| PostHog | Measuring how these pages are used | United States |
| Google (Analytics) | Measuring how these pages are used | United States |
We do not sell your information.
Transfers outside your country
Your information is stored and processed in the United States. Where data protection law requires a safeguard for that transfer, we rely on the European Commission’s standard contractual clauses, and the services above use the EU-U.S. Data Privacy Framework or standard contractual clauses. Sending your answers to the US Department of State is necessary to file the application you asked for.
How it is protected
Your answers, their history, your messages and the filing records are encrypted when stored, with a key kept apart from the database and its backups. Everything is sent over HTTPS. Only a few people can reach the systems, and staff of our software provider open an application only with our permission to fix a problem.
How long we keep it
As long as we need it to prepare and file your DS-160 and to answer questions about it afterwards, unless you ask us to delete it sooner. Deleted information leaves backups within 7 days.
Your rights
You have the right to access your information and get a copy, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent. Ask us using the contact details at the top of this page; we answer within one month. You also have the right to complain to a data protection authority, in particular the one where you live or work.