Privacy Policy

This Privacy Policy explains what personal data etourist.online collects whenever you use our online visa application assistance service, why we collect it, how we handle it, and the rights you hold over your personal data. We deliberately keep this document in plain English, with the full legal detail set out across the sections that follow.

1. Who we are

etourist.online (the "Service", "we", "us") is an independent online visa application assistance platform. We help travellers apply for electronic travel authorisations and digital arrival cards for the United Kingdom (UK ETA), Thailand (TDAC), Malaysia (MDAC) and Indonesia (eVOA). We are not a government body, nor are we affiliated with any of the immigration authorities whose documents we help you apply for.

The data controller for the personal information collected through etourist.online is the business operating this website, with full contact details available in section 13.

2. Data we collect

We collect only the data we actually need to prepare and submit your travel document application, process your payment, deliver the result to you, and provide support if something goes wrong. In practice, this falls into four categories.

2.1 Application data you give us

• Identity details such as your full name, date of birth, place of birth, nationality and gender, exactly as they appear on your passport.
• Passport data including the passport number, issue date, expiry date and issuing country, plus an uploaded passport photo or scan whenever the destination requires one.
• Travel details such as your destination, intended arrival date, flight number and address of your first accommodation.
• Contact details such as your email address, phone number and country of residence.

2.2 Payment data

Payment is handled by regulated third-party payment processors (for example Stripe or PayPal). We receive a transaction reference and the last four digits of your card for order lookup purposes, but we never see or store full card numbers, CVV codes or bank account credentials on our servers.

2.3 Technical and usage data

When you browse etourist.online we automatically collect limited technical information: IP address, approximate location derived from your IP, browser and device type, operating system, referring website, pages viewed, time spent and standard log data. We use this to keep the Service running smoothly, prevent fraud and continuously improve the experience.

2.4 Communications data

Emails, chat messages and WhatsApp conversations with our support team are stored so we can follow up on your case, train our team members and maintain an auditable record of what was agreed.

3. How we use your data

Your data is only ever used for clearly defined purposes:

• Processing your order. Preparing and submitting your UK ETA, Thailand TDAC, Malaysia MDAC or Indonesia eVOA application to the correct government system.
• Delivering your document. Emailing you the approved travel document and keeping a copy available in case you lose it before you fly.
• Supporting you. Responding to your questions and handling complaints, refunds or re-submissions.
• Fraud prevention and security. Flagging unusual activity, abuse or payment fraud.
• Service improvements. Understanding anonymised traffic patterns so we can make the Service faster and clearer for everyone.
• Legal compliance. Meeting the record-keeping requirements imposed by tax, consumer and immigration law.
• Marketing — only with your consent. Sending useful travel reminders and occasional offers, which you can switch off at any time.

4. Legal basis for processing

Where European or UK data protection law applies, we rely on the following legal bases:

Contract performance.

We process your application data because it is required to deliver the service you ordered.

Legitimate interests.

We rely on legitimate interests for fraud prevention, service improvement and basic analytics, carefully balanced against your rights and reasonable expectations.

Legal obligation.

We retain certain records to comply with tax law, consumer protection law and lawful requests from government authorities.

Consent.

We rely on your explicit consent for marketing emails and for any non-essential cookies, and you can withdraw this consent whenever you choose.

5. Sharing with third parties

We do not sell your personal data. We only share it with trusted partners who help us run the Service, and we require each of them to protect your data at least as carefully as we do.

• Government systems. The immigration authority of the destination you apply for receives the application data needed to issue your document — this is the whole point of the Service.
• Payment processors. Stripe, PayPal or similar providers handle your payment under their own privacy terms.
• Email, chat and WhatsApp providers. We use standard business tools to communicate with you.
• Hosting and cloud providers. Our servers and backups run on reputable European and US cloud infrastructure.
• Analytics and anti-fraud providers. We use privacy-respecting analytics and anti-fraud tools with carefully limited data access.
• Professional advisors. Lawyers, accountants and auditors, under strict confidentiality obligations.
• Authorities. We may share data if required by a lawful court order or regulatory request.

6. Storage and retention

We keep your application data for as long as needed to deliver the Service, plus any time required by law. In practical terms:

• Active application data: for as long as the approved travel document remains valid (for example 2 years for a UK ETA).
• Order and billing records: 7 years, to comply with tax and consumer protection law.
• Support communications: 3 years, for complaint handling purposes.
• Technical logs: usually under 90 days.

Once these periods expire, we securely delete or anonymise the data. You can also request early deletion of your account (see section 7), subject to any legal retention we are obliged to apply.

7. Your rights

Depending on where you live, you may hold the following rights over your personal data:

• Access. Request a copy of the data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete data.
• Erasure. Request that we delete your data, where we are not legally required to keep it.
• Restriction. Ask us to pause processing your data while a dispute is being sorted out.
• Portability. Request a machine-readable copy of your data to move to another provider.
• Objection. Object to processing based on our legitimate interests or to direct marketing.
• Withdraw consent. Unsubscribe from marketing or change your cookie preferences at any time.
• Complain to a regulator. You can file a complaint with a supervisory authority in your country if you believe we have mishandled your data.

To exercise any of these rights, email privacy@etourist.online. We respond within 30 days and never charge a fee for your first request.

8. Cookies and tracking

etourist.online uses a small set of cookies and similar technologies:

• Strictly necessary cookies keep your application session active, remember your language preference and allow checkout to work. These cookies cannot be switched off.
• Analytics cookies help us understand how many people visit the site and which pages are useful. They do not personally identify you.
• Marketing cookies may be set with your consent to measure the effectiveness of our advertising.

On your first visit, we display a banner where you can accept or decline the non-essential cookies. You can change your preference at any time using the cookie-settings link in the footer.

9. Security

We handle your passport data with the care it genuinely deserves. Our security measures include encrypted connections (HTTPS/TLS) for every form submission, encrypted storage of application data at rest, strict role-based access for our staff, periodic security reviews and immediate rotation of credentials whenever a team member leaves. No system is ever perfect, but we do everything reasonable to keep your data safe — and we will notify you promptly if a breach ever affects your personal information.

10. Children and minors

Our Service is intended for adults applying on their own behalf or on behalf of family members. If you apply for a child travelling with you, we only collect what the destination's immigration system requires and we store it under your account. We do not knowingly collect data directly from children under 16 for marketing purposes.

11. International transfers

Because the whole purpose of the Service is to submit your application to a government in another country, your data will inevitably cross borders. Where personal data moves outside the EEA or the UK to a country without an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards to protect it.

12. Changes to this policy

We may update this Privacy Policy whenever the law changes or when we add new features. When we make a material change, we update the "Last updated" date at the top of the page and, where appropriate, notify you by email before the change takes effect. Earlier versions are kept on file and are available on request.

13. Contact us

If you prefer, you can also use the contact form on our main page.