In short
- We ask for as little as possible: usually just your passport, plus the contact and trip details the government's form needs, and a photo if your destination requires one.
- We send it to the issuing authority for your destination, through its official systems. Where its form asks health, customs or other declaration questions, we ask you before we file. We never answer for you.
- Passport scans are encrypted at rest. You type card details into Stripe's secure fields, so we never see or store your full card number.
- We don't sell your data for money. Analytics and advertising tools run only if we've switched them on and you agree in our cookie banner. Our anonymous counts of form steps and visa checks use no cookies and can't identify you.
- We keep your application so we can meet legal duties and help with later trips. You can ask us to delete it at any time.
- You can see, correct, delete or export your data and opt out. Email [email protected].
1. Who we are
Nomadic Mart is a private, independent online service. We prepare, check and submit travel-document applications and filings for travelers, for many destinations: visas and eVisas, ETAs and other travel authorizations, visas on arrival, arrival cards and arrival, health and customs declarations, and other travel documents. We are not a government agency and are not affiliated with any government.
Nomadic Mart is a trading name of THE CLOUDOPS LTD (company no. 17112198, England and Wales; registered office Work.Life Manchester, Core 30, Brown Street, Manchester M2 1DH).
This policy explains how we handle your personal data when you use nomadicmart.com, order any of our travel documents for any destination, pay us, or contact us by email or WhatsApp. It applies to every document and destination we offer. Each of our destination pages, such as our Cambodia visa page, explains what that document needs.
| Detail | Information |
|---|---|
| Data controller | THE CLOUDOPS LTD, trading as Nomadic Mart |
| Company number | 17112198, registered in England and Wales |
| Registered address | Work.Life Manchester, Core 30, Brown Street, Manchester, M2 1DH, United Kingdom |
| Privacy contact | [email protected] |
| Data Protection Officer | We have not appointed a Data Protection Officer. Our privacy contact above handles all data protection questions. |
When this policy says "Nomadic Mart", "we", "us" or "our", it means the company above. The "issuing authority" is the government or official body that issues your document or receives your filing.
2. What this policy covers
This policy covers personal data we collect through our website, application forms, payments, emails and WhatsApp chats. It applies to everyone who uses our service, wherever you live.
- Government websites and systems are not covered. When we submit your application or filing, the issuing authority for your destination handles your data under its own laws and policies. We don't control what it does with your data.
- Other companies' sites are not covered. This includes Stripe's payment pages and WhatsApp. They have their own privacy policies.
- Related policies. Read this together with our Terms and Conditions, our Cookie Policy (the full list of cookies and how to control them), our Refund Policy and our Disclaimer.
3. The personal data we collect
Most of it you give us in the application form for the document you order. What we ask for depends on your destination and the document: an arrival card may need only your passport and flight details, while a visa may need more. We ask only for what the government's application or form requires, plus what we need to take payment and keep you updated.
We ask for as few documents as possible, usually just your passport.
| Type of data | Examples | Source |
|---|---|---|
| Identity and passport | Title and full name, nationality, date of birth, sex and passport details (such as the passport number and the issue and expiry dates) as they appear on your passport, and a scan of your passport photo (bio) page. Depending on the form, you type these details in or we read them from your scan. The scan also shows your photo and, on many passports, your place of birth. | You |
| Photo | A passport-style photo of you, if your destination requires one | You |
| Contact | Email address, and phone or WhatsApp number | You |
| Address and work | Your home address and occupation, where the government's form asks for them | You |
| Trip | The document you need, travel dates, flight numbers, ports of entry and exit, the country you travel from and your next country, your reason for visiting and, where a form asks, earlier trips | You |
| Accommodation | Where you'll stay, such as a hotel name, address or phone number, where a form asks | You |
| Other application details | Anything else your destination's form requires, such as marital status, parents' names, employer details or previous visas | You |
| Government questions and declarations | Your answers to the government's own health, customs or other declaration questions, and to its eligibility or security questions (for example about previous refusals or criminal convictions), where your destination's form asks them. We ask you before we file. We never answer for you. We file each answer as you give it. See section 5. | You |
| Other travelers | The same details for anyone else you apply for, such as family members or travel companions | You |
| Other orders | If you book a visa service or appointment on one of our visa pages: your full name, nationality and preferred appointment time, and any answers to that visa's eligibility questions | You |
| Order and payment | What you ordered, the amount and currency, the payment and refund status, and Stripe's reference IDs. We don't receive your card number, card type or billing details. | You and Stripe |
| Application outcome | Status updates, reference numbers, and the government's decision: the document it issues to you, such as your eVisa, travel authorization or arrival-card confirmation, or a refusal | The issuing authority |
| Our notes | Notes our team adds while working on your order | Us |
| Messages | What you write to us by email, WhatsApp or our contact form, and our replies | You |
| Newsletter | Your email address, if you subscribe | You |
| Technical | IP address, approximate country, browser and device type, pages requested, and error reports | Your device and Cloudflare |
| Cookies and browser storage | Your passport-country and language preferences (kept beyond your visit only if you allow them), security cookies, and form drafts saved in your browser. See section 8. | Your device |
| Cookie choices | What you chose in our cookie banner, with the random ID from your choice cookie, the date and time, the banner and policy versions, whether your browser sent Global Privacy Control, your browser type and a scrambled form of your IP address | Your device |
| Advertising and analytics (only if switched on, and only with your consent) | Cookie IDs, pages visited, clicks and scrolling (including session replays, with what you type masked), ad clicks and conversions | Your device and our analytics and ad partners. See section 7. |
If you apply for someone else
If you give us another person's details, you must have their permission, or be their parent or legal guardian. Please show them this policy.
If you don't give us the data
The issuing authority requires most of the details above for the document you order. If you don't give them to us, we can't prepare or file your application.
4. How we use your data, and our lawful bases
UK and EU data protection law says we need a lawful basis for each use of your data. Here is each purpose and the basis we rely on.
| What we do | Data we use | Lawful basis |
|---|---|---|
| Prepare, check and submit your application or filing to the issuing authority, and send you the result | Identity and passport, photo, contact, address and work, trip, accommodation, other application details, other travelers | Contract: we need it to provide the service you ordered |
| File your answers to a government's declaration, eligibility or security questions, when your destination's form asks them | Government questions and declarations | Contract. For a health-related answer, also your explicit consent; for an answer about criminal convictions, also your consent (see section 5). |
| Take payment and screen payments for fraud | Order and payment, contact, technical | Contract; and our legitimate interest in preventing fraud |
| Send emails about your order, such as confirmations, status updates and your document | Contact, order, application outcome | Contract |
| Answer your questions by email or WhatsApp | Contact, messages, order | Contract; or our legitimate interest in helping people who contact us |
| Alert our team to new and paid orders so they can start work | Order reference and details, email address | Contract; and our legitimate interest in running our work efficiently |
| Pre-select your passport country, remember your language, and save form drafts in your browser | Approximate country, cookies and browser storage | Our legitimate interest in making the forms quicker to fill out. Remembering your passport country and language after you close the tab needs your consent (Preferences in Cookie settings), as our Cookie Policy describes. |
| Count, as anonymous daily totals, how many visitors reach each step of our forms and which visa checks are made | None that identifies you: the step or check, the passport country and destination, the answer, and the date | Our legitimate interest in improving our forms and choosing which destinations to add. The totals can't identify anyone (see section 7). |
| Keep a record of your cookie choices | Cookie choices | Legal obligation: the law requires us to be able to show that you agreed. Also our legitimate interest in showing that we asked properly. |
| Keep the site secure, stop abuse, and find and fix errors | Technical | Our legitimate interest in a safe, working service |
| Keep tax, accounting and business records | Order and payment, identity, contact | Legal obligation |
| Handle refunds, complaints, chargebacks and legal claims | Any data linked to the order | Our legitimate interest in defending our rights; for any health-related or criminal-conviction answer, establishing or defending legal claims |
| Help with your future applications, for any destination, so you don't start from scratch | Identity and passport, contact, trip | Our legitimate interest in serving returning customers. You can object at any time. |
| Respond to lawful requests from courts, police and regulators | Any data we hold, only as required | Legal obligation |
| Measure how the site is used (analytics), with Google Analytics and Microsoft Clarity, only if switched on | Advertising and analytics, technical | Your consent |
| Advertising: remarketing, conversion tracking, Enhanced Conversions, Customer Match, Meta's Conversions API and TikTok's Events API, only if switched on | Advertising and analytics, technical; hashed email or phone number | Your consent |
| Send our newsletter, and marketing emails if we start sending them | Email address | Your consent; or, for existing customers in the UK, our legitimate interest under the "soft opt-in" rule. Every email will have an unsubscribe link. |
Legitimate interests. Where we rely on legitimate interests, we have checked that our interest is not outweighed by your rights. You can ask us for details of that check, and you can object (see section 13).
Consent. Where we rely on consent, you can withdraw it at any time. Withdrawing doesn't affect what we did before.
Automated checks
We don't profile you or score you. Our site and forms apply each destination's published entry rules automatically, using facts such as your nationality and travel dates. For example, if a destination doesn't offer a document to your nationality, the site won't let you order it and explains your options. Stripe also screens payments for fraud automatically. Our team checks every application, and only the government decides whether to approve it. If you think a check has stopped you wrongly, contact us and a person will review it.
Fraud prevention. To stop payment fraud and chargeback abuse, we keep a short list of details linked to confirmed fraud or abuse on our orders: for example an email address, phone number, IP address, the card's fingerprint from Stripe (never the card number), or a scrambled (hashed) passport number (never the number itself). New orders and payments are checked against it. A match never decides anything on its own: it holds the order until a person on our team reviews it, and if we then decline an order you have paid for, we refund it in full. Entries are deleted after 1 year (2 years at most), and records of matches after 12 months.
5. Passport, health-related and other sensitive data
Some of what we hold is especially sensitive. We give it extra protection.
- Passport data. Your passport scan and passport number are government ID. Your nationality and the document you apply for show your citizenship and immigration status. US state laws treat these as "sensitive personal information".
- Photos. If your destination requires a photo, we use it only for your application. We don't use photos to recognize faces, and we don't collect fingerprints or other biometric data. If a destination needs those, you give them directly to its government.
- Health and customs declarations. Some destinations' arrival cards and travel forms include the government's own health and customs declaration questions. Where your destination's form asks them, we ask you before we file. We never answer for you. We file each answer exactly as you give it. We treat a health-related answer as health data and use it only to file your document. Where the law treats it as special-category data, we rely on your explicit consent, which you give when you answer.
- Criminal record and security questions. Some visas and travel authorizations ask about past convictions, previous refusals or security matters. Where your destination's form asks, we ask you before we file. We never answer for you. We treat answers about convictions as criminal-offense data: we use them only to file that application, with your consent, which you give when you answer, and we protect them in the same way as your passport data.
We use sensitive data only to prepare and file your application, to meet legal duties, and to handle disputes about your order. We never use it to profile you, never use it for advertising, and never send it to advertising or analytics partners. If you withdraw consent to using a health-related or criminal-conviction answer before we file, we can't file a form that needs it.
7. Analytics and advertising, only with your consent
Anonymous counts, without cookies
Separately from the tools below, our own server keeps a few anonymous counts, so we can see where our forms lose people and which destinations travelers ask about:
- how many times each step of our application forms is reached, per destination and per day;
- which visa checks are made: the passport country and destination, the answer our checker gave, and whether Apply was clicked, per day;
- words typed into our visa checker that it couldn't match, such as a misspelt country. We keep letters only and drop anything that looks like an email, a number or a sentence, and we delete these after 180 days.
These counts use no cookies and store nothing on your device. They keep no IP address, no ID and nothing else about you, only totals per day, so nobody, including us, can tell who was counted. Your browser sends the count to our server like any other request; our rate limiter keeps a scrambled form of your IP address for about a minute, then forgets it. We rely on our legitimate interest in improving our service. Because the counts can't identify you, your cookie choices don't change them.
The tools we may use
| Tool | What it does | What it collects |
|---|---|---|
| Google Analytics 4 (Analytics) | Shows us how people find and use our site, in aggregate | Pages viewed, clicks, device and browser, approximate location, and a cookie ID. Google says it doesn't store IP addresses from the UK, the EEA or Switzerland. |
| Microsoft Clarity (Analytics) | Heatmaps and session replays: how visitors scroll, click and move through our pages, so we can fix what's confusing | Clicks, scrolling, mouse movement, page content with text masked, device and browser, and a cookie ID. What you type into a form is masked in your browser and never sent. |
| Google Ads (Advertising) | Conversion tracking (which ads led to orders), remarketing (showing our ads to past visitors), Enhanced Conversions and Customer Match | Cookie IDs, ad clicks, conversions, and a hashed email or phone number |
| Meta Pixel and Conversions API (Advertising) | Measures and targets our ads on Facebook and Instagram | Cookie IDs, pages visited, conversions, and a hashed email or phone number |
| TikTok Pixel and Events API (Advertising) | Measures and targets our ads on TikTok | Cookie IDs, pages visited, conversions, IP address and browser details, and a hashed email or phone number |
| Microsoft Advertising (UET) (Advertising) | Conversion tracking and remarketing on Bing and Microsoft's network | Cookie IDs, pages visited, ad clicks, conversions, IP address, screen size and language |
Who is responsible, where your data goes and how long it's kept
| Tool | Their role | International transfers | How long it's kept |
|---|---|---|---|
| Google Analytics 4 Google Privacy Policy | Google acts as our processor, under the Google Ads Data Processing Terms | Google LLC, US: the EU-US Data Privacy Framework, its UK Extension and the Swiss-US framework, with Standard Contractual Clauses as a back-up | Data about individual visitors: 14 months, the setting we choose. Reports keep totals only. |
| Microsoft Clarity Microsoft Privacy Statement | Microsoft is an independent controller. It also uses the data to provide and improve Microsoft Advertising. | Microsoft Corporation, US: the Data Privacy Framework (EU, UK and Swiss) | Session replays: 30 days. Heatmaps and click data: 9 months. |
| Google Ads Google Privacy Policy | Google is an independent controller, under the Google Ads Controller-Controller Data Protection Terms. For Enhanced Conversions and Customer Match it acts as our processor. | Google LLC, US: the Data Privacy Framework, with Standard Contractual Clauses as a back-up | Ad-click cookies on our site last up to 90 days. Google keeps ad data under its own policy. |
| Meta Meta Privacy Policy | Meta and we are joint controllers for collecting data on our site and sending it to Meta. After that, Meta is an independent controller. For visitors in the UK this is Meta Platforms, Inc.; in the EEA, Meta Platforms Ireland. | Meta Platforms, Inc., US: the EU-US and Swiss-US Data Privacy Frameworks and Meta's data transfer terms | Up to 2 years |
| TikTok TikTok Privacy Policy | TikTok and we are joint controllers for collecting and sending data, and for measuring ads. TikTok is an independent controller when it targets and delivers ads, and our processor when it matches hashed contact details. For the UK and EEA: TikTok Information Technologies UK Ltd and TikTok Technology Ltd (Ireland). | Standard Contractual Clauses (TikTok isn't part of the Data Privacy Framework) | Up to 18 months |
| Microsoft Advertising (UET) Microsoft Privacy Statement | Microsoft is an independent controller | Microsoft Corporation, US: the Data Privacy Framework (EU, UK and Swiss) | 390 days (about 13 months) |
What these tools never get
We never send these tools your name, your passport details or scan, your photo, your answers to health, customs or other declaration questions, or the contents of your application. What you type into our forms is masked before Microsoft Clarity records a page. The events we send to ad platforms say only what's needed to count an order, such as the product and its value, plus a hashed email or phone number if you've allowed Advertising.
How consent works
- Off until you say yes. Wherever you are, these tools stay off until you accept them. We use Google Consent Mode v2 to pass your choices (for storage, ad user data and ad personalization) to Google tags. Google's tags don't load until you agree, so while consent is denied no advertising or analytics cookies are set and nothing is sent to Google.
- Equal choice. Our banner's Accept all, Reject all and Choose buttons have equal weight. You can accept, reject or pick categories (Preferences, Analytics and Advertising), and change your mind at any time in our cookie settings. We keep a record of your choice, as Google's EU user consent policy requires.
- Opt-out signals. We treat a Global Privacy Control signal as an opt-out: advertising stays off in that browser (see section 14).
- Withdrawing consent. Select Cookie settings at the bottom of any page and switch a category off. We stop using those tools right away and delete the cookies we can on our domain. Withdrawing doesn't affect what happened before.
- How long your choice lasts. We remember it for 6 months in a cookie, then ask again. We keep a record of each choice for 2 years (see section 11).
- Third-party vendors, including Google, show our ads on sites across the internet. They use cookies to serve ads based on your past visits to our website and other websites.
- Google's use of advertising cookies lets it and its partners show you ads based on your visits to our site and other sites on the internet.
- You can opt out of personalized advertising in Google's Ads Settings. You can opt out of some other vendors' use of cookies for personalized ads at aboutads.info.
- Google Analytics advertising features. If we link Google Analytics to Google Ads, we may use its advertising features: remarketing audiences, and demographics and interests reports. These use Google Analytics' first-party cookie together with Google's advertising cookies, so they run only if you allow both Analytics and Advertising. You can opt out in Ads Settings, through the NAI opt-out, or with the browser add-on below. See analytics cookies in our Cookie Policy.
- To learn how Google collects and processes this data, read How Google uses information from sites or apps that use our services. You can also block Google Analytics with Google's browser add-on.
Enhanced Conversions, Customer Match, Conversions API and Events API
With these tools we share customer data with third parties, namely Google, Meta and TikTok, so they can measure ads and run ad services for us. Before your email or phone number leaves your browser or our servers, it is hashed (turned into a scrambled code). Google, Meta and TikTok use the code only to match it to accounts they already hold, under their own terms. We never send names, passport details, photos, health-related or other declaration answers, or application contents. We send none of this without your consent, and in the UK, the EEA and Switzerland we never share IP addresses for Customer Match matching.
Microsoft, Meta and TikTok
- Microsoft Clarity. If we use it, Microsoft Clarity shows us how visitors use our site through behavioral metrics, heatmaps and session replay. Microsoft collects this data with first- and third-party cookies and similar technologies, and uses it to provide and improve Clarity and Microsoft Advertising. We pass your Advertising choice to Clarity too, so its advertising cookies are used only if you also allow Advertising. Read the Microsoft Privacy Statement.
- Microsoft Advertising. If we use it, Microsoft tracks individual visitors on our site with cookies, and data is shared with Microsoft for advertising and marketing. Microsoft says it does not resell this data or share it with other advertisers. You can opt out of personalized ads in Microsoft's ad settings. Read the Microsoft Privacy Statement.
- Meta (Facebook and Instagram). If we use it, Meta and other third parties may use cookies, web beacons and similar storage technologies to collect or receive information from our site and elsewhere on the internet. They use it to provide measurement services and to target and deliver ads. You can opt out of this use for ad targeting in Meta's ad preferences, or through aboutads.info and youronlinechoices.eu. Read the Meta Privacy Policy.
- TikTok. If we use it, the TikTok Pixel and Events API collect information from our site, such as pages visited and orders, to measure our ads on TikTok and show them to people who have visited us. TikTok doesn't offer its own web opt-out, so switch off Advertising in Cookie settings, or use aboutads.info or youronlinechoices.eu. Read the TikTok Privacy Policy.
Industry opt-outs
You can opt out of interest-based ads from many companies at once through the Digital Advertising Alliance (US), Your Online Choices (EU and UK) and the Network Advertising Initiative. Opting out doesn't remove all ads. It means the ads you see are less tailored to you.
Ads on our site. We don't show other companies' ads on our site. If we ever do, for example through Google AdSense, the Google disclosures above apply and we will list the other ad vendors here.
9. Emails, WhatsApp and marketing
- Emails about your order. We email your payment confirmation, reminders to add missing details, status updates, and the document the government issues, such as your eVisa, travel authorization or arrival-card confirmation. These are part of the service, so you can't unsubscribe from them while your order is open.
- Newsletter and marketing. If you subscribe to our newsletter, we use your email address to send travel and visa tips. We haven't sent any marketing emails yet. When we do, we will send them only to people who agreed, or, in the UK, to customers about similar services, and every email will have an unsubscribe link.
- WhatsApp. If you message us on WhatsApp, WhatsApp (part of Meta) carries the chat under its own privacy policy. We use your number and messages only to help you, and we may keep the chat with your order. Please upload passport scans and photos through our secure form, not in a chat.
- Email and our contact form. We keep your messages and our replies with your order so any of our team can help you.
10. International transfers
We are based in the UK. Some of the companies we work with are in other countries, and so are the governments of most destinations we file with. When your data leaves the UK, the EEA or Switzerland, we protect it like this:
- To the UK from the EEA: the European Commission has decided that the UK protects personal data adequately.
- To service providers in the US and elsewhere: we rely on the EU-US Data Privacy Framework, its UK Extension or the Swiss-US framework where the provider is certified. Otherwise we use the European Commission's Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement, plus extra safeguards such as encryption.
- To the issuing authority for your destination: it is in your destination country, and many destination countries have no UK or EU adequacy decision, so their law may not protect your data to the same standard. We send your data there because you ask us to: the document you ordered can't be issued without it. The law allows a transfer that is necessary to perform the contract you asked us for. Once received, your data is handled under that country's laws.
- To our own team: some of our staff and contractors may work from outside the UK. They are bound by contract to protect your data and access it only through our secure systems.
You can ask us for a copy of the safeguards we use.
11. How long we keep your data
We don't delete your application automatically when it is finished, whatever the document or destination. This includes passport scans, photos, and any earlier scan you replaced. We keep your data for as long as we need it to:
- provide the service and send you your document, and resolve any problems with it;
- meet legal, tax and accounting duties (UK tax rules require us to keep financial records for six years);
- handle refunds, complaints, chargebacks and legal claims;
- help you with future applications, so you don't have to start again.
You can ask us to delete your data at any time. We will delete it, or remove what identifies you, unless we must keep it for a legal reason, such as tax records or an open dispute. If so, we will tell you what we keep and why, and delete it when that reason ends.
Some records are deleted automatically:
- our log of staff actions, after 1 year;
- entries on our fraud-prevention list, after 1 year (2 years at most), and records of matches against it, after 12 months;
- records of payment notifications from Stripe, after 30 days;
- records of your cookie choices, after 2 years;
- words typed into our visa checker that it couldn't match, after 180 days;
- the scrambled (hashed) form of your IP address used to limit repeated requests, after about a minute.
The private link to your order in our emails stops working after 90 days. Cookie lifetimes are listed in our Cookie Policy.
12. How we protect your data
- Encryption. Passport scans, photos you upload, and the travel documents we deliver are encrypted at rest with AES-256-GCM. If encryption isn't available, our system refuses the upload rather than store a scan unencrypted. Data travels between your browser and our servers over HTTPS.
- Cards stay with Stripe. You enter card details in Stripe's secure payment fields, so they never reach our servers. Stripe is certified to the PCI DSS card-security standard.
- Limited access. Only authorized staff can see applications, through a staff-only admin area with individual logins. We log every time a staff member downloads a passport scan, and every change staff make.
- Private order links. You don't need an account. We email you a private, signed link to your order, which expires after 90 days. Anyone with the link can see your order status and, before payment, change your order. Please don't share it.
- Protection against attacks. Cloudflare filters malicious traffic, and we limit repeated requests.
- Trusted providers. Our service providers must protect your data under contract.
If something goes wrong
No system is perfectly secure. If a data breach is likely to put your rights at risk, we will report it to the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and to any other regulator the law requires. If the risk to you is high, we will tell you without undue delay, explain what happened, and tell you what you can do.
13. Your rights
If you are in the UK, the EEA or Switzerland, you have the rights below. We offer the same rights to everyone, wherever you live, unless local law says otherwise.
| Your right | What it means |
|---|---|
| Access | Get a copy of your data and information about how we use it |
| Correction | Have wrong or incomplete data fixed |
| Deletion | Have your data deleted when we no longer need it, or when you withdraw consent or object |
| Restriction | Ask us to pause using your data, for example while we check a correction |
| Portability | Get the data you gave us in a common, machine-readable format, or have it sent to another company |
| Objection | Object to uses based on our legitimate interests. You can always stop direct marketing, with no reason needed. |
| Withdraw consent | Take back consent at any time, for example for advertising cookies or a health-related answer |
| Human review | Not be subject to decisions based only on automated processing that have legal or similarly significant effects on you. We don't make such decisions, and a person will review any automated check on request (see section 4). |
| Complain | Complain to us, and to a data protection regulator (see section 18) |
How to use your rights
- Email [email protected] or message us on WhatsApp. Say which right you want to use. Your order reference helps.
- We may ask you to confirm your identity, usually by replying from the email address you used with us. We only ask for what we need.
- We reply within one month. If your request is complex, we may take up to two more months, and we will tell you why.
Using your rights is free. We may refuse, or charge a reasonable fee, if a request is clearly unfounded or excessive. If we can't do what you ask, we will explain why.
Note: once the government has your application, we can't change or delete the copy it holds. We can tell you how to contact it.
14. California privacy rights
This section adds to the rest of this policy for California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).
What we collected in the last 12 months
| CCPA category | Examples | Disclosed for a business purpose to | Sold or shared? |
|---|---|---|---|
| Identifiers | Name, email, phone, home address, passport number, IP address, order reference; cookie IDs and a hashed email or phone number, if you allow Advertising | Governments, service providers | Only cookie IDs, IP address and hashed email or phone, and only if you allow Advertising |
| Customer records | Name, address, phone, passport details, payment status; where a form asks, employment details | Governments, service providers | ✗ No |
| Protected characteristics | Age and sex (from your passport), nationality and citizenship | Governments, service providers | ✗ No |
| Commercial information | Services ordered and amounts paid | Service providers | Only that an order happened and its value, and only if you allow Advertising |
| Internet activity | Pages requested, device and browser data, error reports, messages to us; with your consent, how you use our pages and our ads | Service providers | Only pages visited and ad clicks, and only if you allow Advertising |
| General location | Approximate country from your IP address. We don't collect precise location. | Service providers | Only as worked out from your IP address by ad platforms, and only if you allow Advertising |
| Visual information | The photo on your passport scan, and any passport-style photo your destination requires | Governments, service providers | ✗ No |
| Professional information | Occupation | Governments, service providers | ✗ No |
| Sensitive personal information | Passport number, citizenship and immigration status, and any health-related answer you gave us | Governments, service providers | ✗ No |
We don't collect biometric data, education information or precise geolocation, and we don't create profiles or inferences about you. The sources and purposes are in section 3 and section 4. How long we keep each category is in section 11.
Selling and sharing
We have not sold or shared personal information in the last 12 months, and we have never sold it for money. When the advertising tools in section 7 are on and you allow Advertising, giving cookie IDs, pages visited and hashed contact details to Google, Meta, TikTok or Microsoft counts as "sharing" for cross-context behavioral advertising under the CCPA, and may count as a "sale". The table above shows which data that covers. We do this only with your permission: Advertising is off until you switch it on in our cookie banner, and always off when your browser sends Global Privacy Control. You can opt out at any time as described below. We don't knowingly sell or share the data of anyone under 16.
Sensitive personal information
We use sensitive personal information only to provide the service you asked for, to keep it secure, and to meet legal duties. These are uses the CCPA allows without offering a right to limit. We don't use it to infer anything about you. You can still send us a "Limit the Use of My Sensitive Personal Information" request, and we will confirm our position.
Your California rights
- Right to know and access: the categories and specific pieces of personal information we hold, where it came from, why we use it and who we disclose it to.
- Right to delete personal information we collected from you, with legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of selling and sharing, including for cross-context behavioral advertising.
- Right to limit the use of sensitive personal information.
- Right not to be discriminated against. We won't charge you more, give you a worse service or deny you service for using your rights. We offer no financial incentives for personal data.
Global Privacy Control
We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of selling and sharing, for that browser and for any order we can link to it. You don't need to do anything else. Our cookie banner and Cookie settings show that we have honored the signal. To send GPC, use a browser or extension that supports it.
How to make a request
- Use the links in section 16, email [email protected], or message us on WhatsApp.
- For requests to know, delete or correct, we confirm receipt within 10 business days. We verify your identity by matching details we already hold, such as your email address and order reference. We reply within 45 days, or tell you if we need up to 45 more.
- Opt-out requests need no verification. We act on them within 15 business days.
Authorized agents. Someone else can make a request for you if you give them signed permission. We may ask you to confirm your identity with us directly and to confirm that you gave the agent permission, unless they hold a valid power of attorney.
15. Other US states
Many US states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, New Jersey and others, give residents similar rights. Depending on where you live, you may have the right to:
- access and get a copy of your data, and correct or delete it;
- opt out of targeted advertising, the sale of your data, and profiling that has legal or similarly significant effects;
- have sensitive data (such as citizenship, immigration status and health data) processed only with your consent. You give it when you submit your application, and you can withdraw it.
To use these rights, contact us as in section 13. We honor Global Privacy Control as an opt-out from targeted advertising and sale everywhere it applies.
Appeals. If we refuse your request, you can appeal. Reply to our decision with "Appeal" in the subject line. We will answer within the time your state's law sets. If you disagree with the outcome, you can contact your state's Attorney General.
16. Your privacy choices
All the ways to control your data in one place.
| What you want | How to do it |
|---|---|
| Do Not Sell or Share My Personal Information | Switch off Advertising in Cookie settings (it's off unless you switched it on), turn on Global Privacy Control, or email a Do Not Sell or Share request |
| Limit the Use of My Sensitive Personal Information | Email a Limit the Use request |
| Change cookie choices | Use Cookie settings at the bottom of every page, or block cookies in your browser. See our Cookie Policy. |
| Stop personalized Google ads | Google Ads Settings; block Google Analytics with the opt-out add-on |
| Stop personalized Meta ads | Meta ad preferences |
| Stop personalized Microsoft ads | Microsoft ad settings |
| Stop personalized TikTok ads | Switch off Advertising in Cookie settings. TikTok has no web opt-out of its own; you can also use the industry opt-outs below. |
| Opt out of interest-based ads from many companies | aboutads.info (US), youronlinechoices.eu (EU and UK), networkadvertising.org |
| Stop marketing emails | Click "unsubscribe" in any marketing email, or email us |
| See, correct, delete or export your data | [email protected] (see section 13) |
17. Children
Our service is for adults. You must be 18 or over to place an order.
- A parent or legal guardian may apply for a child. In that case the parent or guardian gives us the child's details and is responsible for the application.
- We don't knowingly collect personal data directly from children under 16, or under 13 in the US.
- We never use children's data for analytics or advertising, and never sell or share it.
If you think a child has given us their data without a parent or guardian, contact us and we will delete it.
18. Complaints
If you're unhappy with how we've handled your data, please tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.
You also have the right to complain to a data protection regulator at any time:
- UK: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone 0303 123 1113, or make a complaint on the ICO website.
- EEA: we have no establishment in the EU, so there is no single "lead" authority for us. You can complain to the regulator in the country where you live or work, or where you think the problem happened. Find yours in the list of EU data protection authorities.
- Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
- California: the California Privacy Protection Agency or the California Attorney General.
19. Changes to this policy
We update this policy when our service, the tools we use or the law changes. The date at the top shows the latest version. If we make an important change, such as switching on a new advertising tool or using your data in a new way, we will update this page before the change takes effect. If you have an open order with us, we will also email you. Where a change needs your consent, we will ask for it.
20. Contact us
For any question about your data or this policy, or to use your rights:
- Email: [email protected]
- WhatsApp: +44 7561 525115 (the number may change; the current one is always on our website)
- Post: THE CLOUDOPS LTD (Nomadic Mart), Work.Life Manchester, Core 30, Brown Street, Manchester, M2 1DH, United Kingdom