Privacy Policy

VisaPass is a service for UK immigration advisers, lawyers and visa consultants ("Partners") to manage visa cases for their clients.

VisaPass is operated by ENROLA GLOBAL LTD, a company registered in England and Wales (company number 16588390), 126 East Ferry Road, London E14 9FP, United Kingdom ("VisaPass", "we", "us"). For Partners established in Uzbekistan, our wholly-owned subsidiary OOO "ENROLA" (ENROLA LLC, TIN 312 977 390), Tashkent, also acts as operator.

Contact for privacy questions and requests: [email protected].

• Partner and account data (the firm, its users, billing): we are the controller.
• Client data (the people whose visa cases a Partner manages): the Partner is the controller and we are the processor. We process client data only on the Partner's instructions and under our data processing terms (section 13).

If you are a Partner's client, please contact your adviser first about your data. We will help them answer your request.

Partner and account data: firm name and details, users' names, work emails and phone numbers, sign-in details, billing details (we never see full card numbers), usage and quota data, and technical data (IP address, browser, logs).

Client data: name, contact details, date of birth, nationality, passport details, study and course details (such as the CAS), financial documents (such as bank statements), travel and immigration history, uploaded documents, text read from those documents, the answers a client or adviser gives, messages sent about the case, and the results of our compliance checks.

UK visa applications can require sensitive information, such as tuberculosis test results (health data) and answers about criminal convictions. We process it only because the visa application requires it and only on the Partner's instructions. Access is limited to the Partner's own users and to the small number of our staff who maintain the service. We never use it for any other purpose.

• To provide VisaPass: storing cases, reading documents, checking them against UK visa rules, preparing reports, and helping fill in official forms.
• To send case messages by email or WhatsApp when the Partner chooses to.
• To run accounts, billing and plan limits.
• To keep the service secure, fix problems and prevent abuse.
• To meet legal obligations.

We do not sell data, use it for advertising, or use client data for our own purposes.

VisaPass uses OpenAI's business API to read documents and check them against UK visa rules. Under our agreement with OpenAI:

• OpenAI does not use our data to train its models.
• OpenAI may keep requests for up to 30 days to detect abuse, and then deletes them.
• We send only the text needed for each check, not a whole case.

AI results help the adviser; they are not a decision. A qualified adviser reviews each case, and nothing is submitted to the Home Office automatically.

A Partner can send a client a secure link to upload documents, answer questions or follow their case. The client can also use the VisaPass browser extension to fill in the official GOV.UK application. The extension works only on the GOV.UK pages it fills in. It does not read other websites or your browsing history. In both cases the Partner remains the controller of the client's data.

We store data on servers in Germany (Hetzner Online GmbH). Some providers process data outside the UK and EU: OpenAI in the United States, and Cloudflare through its global network. Traffic between Cloudflare and our servers is encrypted.

For transfers outside the UK and EU we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in our agreements with these providers.

We have a data processing agreement with each provider. We tell Partners before we add or replace one. We share data with public authorities only when the law requires it.

• Client data: while the Partner's account needs it. When a Partner deletes a case or closes the account, we delete the data within 30 days, unless the law requires us to keep it.
• Partner and account data: for the life of the account, then as long as tax and accounting law requires (usually 6 years for billing records).
• Server logs: up to 90 days.
• OpenAI abuse-check copies: up to 30 days.
• Backups: overwritten on a rolling basis.

Data is encrypted in transit, access is limited by role, and sign-in uses secure single sign-on. Partners decide who in their firm can see each case. If a breach affects personal data, we tell affected Partners without undue delay.

Under UK and EU data protection law you can ask to access, correct, delete or export your data, to restrict or object to processing, and to have an automated result reviewed by a person. Partners can do most of this in VisaPass or by emailing [email protected]. Clients should contact their adviser, and we will help. We reply within one month.

If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk).

When we process client data for a Partner, we: act only on the Partner's documented instructions; keep it confidential; use only the providers listed in section 9; help the Partner answer clients' requests and meet its own obligations; tell the Partner about a breach without undue delay; delete or return the data when the service ends; and give the Partner the information needed to show we comply. These terms form part of our Terms of Service.

We will post changes here and tell Partners by email about important ones.