Privacy Policy

---

VisaStep EU Last updated: May 19, 2026

VisaStep EU ("we", "us", or "our") is a Germany-based consultancy providing education and work visa services for Germany and Poland. We are committed to protecting your personal data and respecting your privacy in accordance with:

• The EU General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679
• The German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)
• The Polish Personal Data Protection Act of 10 May 2018 (Ustawa o ochronie danych osobowych – PDPA)
• The Polish Electronic Communications Law (Prawo komunikacji elektronicznej – ECL) as of 10 November 2024

This policy explains what personal data we collect, why we collect it, how we use it, and your rights as a data subject.

The data controller responsible for your personal data is:VisaStep EU Germany Email: sales@visastepeu.com if  are located in Poland and wish to exercise your rights under Polish law, you may also contact the above email address.

We may collect and process the following categories of personal data:Identity and Contact Data

• Full name, date of birth, nationality, and passport details
• Email address and phone number
• Postal address

Application and Case Data

• Educational qualifications and transcripts
• Employment history and work experience
• Visa application documents and supporting materials
• Immigration history

Communication Data

• Messages and correspondence sent to us via email or contact forms
• Consultation notes and records

Technical Data

• IP address, browser type, and device information when you visit our website
• Cookie identifiers and usage data (see Section 9)

We do not intentionally collect special categories of data (e.g. health, biometric, or criminal record data) unless strictly required by a visa application process and only with your explicit consent.

We process your personal data on the following legal bases under GDPR Article 6:PurposeLegal BasisProviding visa consultancy servicesPerformance of a contract (Art. 6(1)(b))Communicating with you about your applicationPerformance of a contract (Art. 6(1)(b))Complying with legal obligations (e.g. record-keeping)Legal obligation (Art. 6(1)(c))Sending service updates and relevant informationLegitimate interest (Art. 6(1)(f))Sending marketing communications (with consent)Consent (Art. 6(1)(a))Improving our website and servicesLegitimate interest (Art. 6(1)(f))Where we rely on consent as a legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

We may share your personal data with:

• German and Polish immigration authorities as required for visa applications
• Educational institutions or employers in Germany or Poland where relevant to your case
• IT service providers who host or support our website and systems, acting as data processors under GDPR-compliant agreements
• Professional advisors such as legal counsel, subject to confidentiality obligations

We do not sell, rent, or trade your personal data to third parties for marketing purposes.International Transfers: If we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with GDPR Chapter V.

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

• Active client data – retained for the duration of our service relationship
• Completed case files – retained for up to 6 years after case closure to comply with German and Polish legal record-keeping obligations
• Marketing consent records – retained until consent is withdrawn
• Website technical data – retained for up to 12 months

After the applicable retention period, data is securely deleted or anonymised.

Under the GDPR, BDSG, and Polish PDPA, you have the following rights:

• Right of Access – Request a copy of the personal data we hold about you (Art. 15 GDPR)
• Right to Rectification – Request correction of inaccurate or incomplete data (Art. 16 GDPR)
• Right to Erasure – Request deletion of your data where there is no overriding legal basis to retain it (Art. 17 GDPR)
• Right to Restriction – Request that we limit how we process your data in certain circumstances (Art. 18 GDPR)
• Right to Data Portability – Receive your data in a structured, machine-readable format (Art. 20 GDPR)
• Right to Object – Object to processing based on legitimate interests or for direct marketing purposes (Art. 21 GDPR)
• Right not to be subject to automated decision-making – We do not carry out fully automated decisions with legal or similarly significant effects on you

To exercise any of these rights, contact us at: sales@visastepeu.com we will respond within one calendar month as required by GDPR Article 12.

If you are in Germany, you have the right to lodge a complaint with your local data protection authority. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) can be reached at:www.bfdi.bund.deIf you are in Poland, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO): www.uodo.gov.plWe encourage you to contact us first so we can resolve any concerns directly.

Our website may use cookies and similar tracking technologies. In line with:

• Germany's TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz)
• Poland's Electronic Communications Law (ECL), Article 399, in force since November 2024

We only set non-essential cookies with your prior, active, and informed consent. You can withdraw or manage your cookie preferences at any time via our cookie settings on the website. Essential cookies required for the website to function do not require consent.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted communications, secure data storage, and access controls limited to authorised personnel only.In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and affected individuals where required under Article 34.

Our services are intended for adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has provided us with personal data, please contact us immediately so we can delete it.Under German law (BDSG §8), consent for information society services is valid from age 16. Under Polish PDPA, parental consent is required for children under 16.

We may update this Privacy Policy from time to time to reflect legal or operational changes. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you directly where possible.

For any questions, requests, or concerns about this Privacy Policy or your personal data, please contact:VisaStep EU Email: sales@visastepeu.com Location: Germany