Privacy notice

Who is responsible for your data

"Velano" EOOD, UIC 208601414, registered at 2 Lyuben Karavelov Street, Duvanlii 4174, Kaloyanovo Municipality, Plovdiv Region, Bulgaria, operates Viarify and is the data controller for the personal data described in this notice. For privacy enquiries, contact: support@viarify.com.

Viarify offers services to individuals in the United Kingdom. We therefore apply applicable data-protection requirements, including the EU GDPR and, where applicable to our services for UK residents, the UK GDPR and Data Protection Act 2018.

What we collect

• Identity data: full name, date of birth, place and country of birth and nationality.
• Passport data: passport number, issue and expiry dates and issuing country.
• Contact data: email address, telephone number and home address.
• Travel and application data: travel details, U.S. point of contact where applicable, employer or other information requested by the official ESTA application.
• Eligibility information: answers required by the official ESTA application, which may include information concerning health, criminal offences, immigration history and travel history.
• Document images: passport photographs and other documents submitted for the application.
• Biometric data: where identity verification uses facial comparison or liveness technology for the purpose of identifying or verifying a person, this may constitute special-category biometric data.
• Payment information: transaction reference, amount and payment status. Viarify does not store full payment-card numbers.

Data minimisation

We collect only information reasonably necessary to provide the requested ESTA assistance service. Sensitive eligibility information is not used for marketing, advertising or unrelated profiling.

A. Ordinary personal data

Under Article 6(1)(b) GDPR, we process ordinary personal data where necessary to provide the Viarify service you requested and perform our contract with you, including preparing, checking and submitting your ESTA application. Under Article 6(1)(c) GDPR, we process and retain information where necessary to comply with applicable legal obligations, including accounting, tax and legally required record-keeping obligations. Under Article 6(1)(f) GDPR, we process limited information where necessary for our legitimate interests in service security, fraud and abuse prevention, technical logging, and the establishment, exercise or defence of legal claims, subject to the required balancing of those interests against your rights and interests.

B. Health information and biometric identification

Information concerning health, and biometric data used for the purpose of uniquely identifying or verifying you, may constitute special-category personal data under Article 9 UK GDPR. Where such processing is required for the Viarify service, we rely on Article 6(1)(b) GDPR because the processing is necessary to provide the requested Viarify service and perform our contract with you and, for Article 9 special-category processing, your explicit consent under Article 9(2)(a). Explicit consent is collected separately and affirmatively and is not hidden inside acceptance of the general Terms of Service.

We retain an auditable record of the consent given, the version of the consent wording, the date and time, and the application or customer identifier. You may withdraw consent. If consent is withdrawn before the relevant verification or application processing has been completed, Viarify may be unable to continue providing the affected part of the service.

C. Criminal-offence data — Article 10

Criminal-offence information is not special-category data under Article 9. Personal data relating to criminal convictions, offences or allegations is subject to Article 10 UK GDPR and the Data Protection Act 2018. Where the official ESTA process requires this information, we process it to provide the requested application-assistance service under Article 6(1)(b) GDPR, because the processing is necessary to provide that service and perform our contract with the customer, and, where applicable, the customer's specific and informed consent under Schedule 1, Part 3, paragraph 29 of the Data Protection Act 2018.

The Viarify service is optional and customers can apply directly through the official U.S. government ESTA service. Criminal-offence information is processed only where necessary to prepare, check or submit the customer's ESTA application. Consent is recorded. We do not create or maintain a general criminal-record database, and do not use this information for advertising, profiling or unrelated purposes.

Who we share it with

• Identity-verification provider: Didit is a third-party identity-verification technology provider used as part of Viarify’s identity-verification process. Identity and biometric information may be transmitted to Didit only to perform the required document, liveness and face-match checks.
• U.S. Customs and Border Protection — we submit the application data you give us to the official ESTA system on your behalf. Their handling of that data is governed by U.S. law, not by us.
• Payment provider: processes your payment and holds card details directly.
• Hosting and infrastructure providers: host the service and encrypted records.
• Email and customer communication providers: send application and support messages.

International data transfers

Providing the ESTA service necessarily involves transferring application information to U.S. Customs and Border Protection in the United States. Where Viarify or its service providers make other international transfers of personal data, Viarify uses an applicable lawful transfer mechanism and safeguards required by the relevant data-protection law, such as adequacy arrangements, Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, where applicable.

How long we keep it

Passport images and selfies are deleted automatically 7 days after a decision on your application. Thirty days after that decision, an automated job anonymises your record: names, date of birth, passport and identification numbers, addresses, telephone numbers, parents, employer, contacts and eligibility detail are all erased. What remains is the tracking ID, status, dates, filing reference and the minimum non-sensitive accounting, transaction, service and audit records required for legal, accounting and dispute purposes. Records retained for up to six years do not include unnecessary sensitive ESTA answers, passport images or biometric images.

Encryption

Everything is encrypted in transit and at rest. In addition, your passport number and any national or personal identification numbers are separately encrypted inside the database, so they are unreadable without a key that only our application holds; they can be unlocked only by an authenticated administrator viewing your application.

How we protect it

Data is encrypted in transit and at rest. Document images are held in private storage that is not publicly addressable; access requires an authenticated staff account with an explicit administrator role, and every access is logged.

Your rights

Depending on the circumstances, you may have rights including access, rectification, erasure, restriction, data portability, objection where applicable, and withdrawal of consent where processing relies on consent. To exercise your rights, email support@viarify.com. Where applicable, you may also complain to the relevant supervisory authority, including the Bulgarian Commission for Personal Data Protection and, for processing subject to UK GDPR, the UK Information Commissioner's Office.

Cookies

We use only the storage strictly necessary to keep your application progress and your signed-in session working. We do not run advertising trackers.