Privacy Policy

Last updated: 5 August 2026 · Version 2.0

1. Who Controls Your Data

Italy Visa Alerts is the controller for personal data processed through italyvisaalerts.com. You can contact us at [email protected].

We are independent and are not affiliated with VFS Global, TLScontact, BLS International, VisaMetric, any embassy, consulate, government body or visa application centre. Where you deal directly with one of those organisations, they are a separate controller and their own privacy policy applies.

2. Personal Data We Collect

We collect only what we reasonably need to provide, evidence and protect the service.

2.1 Account and contact data

• name, email address and telephone number in international format;
• password, stored only as a one-way cryptographic hash that we cannot reverse;
• account creation, update and sign-in timestamps.

2.2 Order and search preference data

• application market, application city, destination country, provider and visa category;
• applicant count, passport nationality, earliest and latest acceptable dates;
• whether you already hold an appointment, and its date where you tell us;
• free-text notes you choose to add to your order;
• order status, service period, price, currency and product type.

2.3 Payment data

• we do not receive, process or store your full card number, expiry date or security code;
• payment is handled by Stripe. We receive the payment reference, amount, currency, status, the last four digits and card brand where Stripe supplies them, and the billing email;
• we store the Stripe session and payment intent references, the receipt link and the transaction date against your order.

2.4 Consent and agreement records

When you place an order we record, against that order:

• the fact and time of your acceptance of the Terms, Privacy Policy and Refund Policy;
• the version number of each document then in force;
• the exact wording of every checkbox displayed to you, including your express request to start the service immediately and the cancellation acknowledgement;
• the page URL, your IP address, your IPv6 address where present, and your browser user agent.

We hold this because it is the evidence of what you agreed to. It is used to administer your order, to answer a query about your agreement, and to respond to a chargeback or payment dispute.

2.5 Service activity data

• records of appointment checks carried out for your route;
• alerts and emails generated, queued, sent, delivered or failed;
• support messages you send us and our replies;
• order status changes and administrative notes.

2.6 Technical and usage data

• IP address, approximate country or region derived from it, browser type and device type;
• pages viewed, referring website and the search or campaign parameters in the link you arrived on;
• server and application logs, including error records.

Analytics of this kind are collected first-party and server-side. We do not operate third-party advertising or profiling trackers on this site.

3. Provider Account Access

Some provider appointment calendars can only be viewed after signing in. Where a route clearly identifies that requirement, we may ask for provider account access after payment.

• we ask only where the route genuinely requires it, and never during standard Cancellation Finder checkout;
• provider passwords and references are encrypted at rest using authenticated encryption, with the key held outside the web root and outside the database;
• access is used only to check appointment availability within the preferences you supplied. For a Cancellation Finder order we do not use it to book, cancel or change an appointment;
• every decryption is restricted to authorised staff, requires re-entry of an administrator password, and is written to an access log recording who viewed it and when;
• you may withdraw provider access at any time and we will delete the stored credentials. Your search continues using the route checks otherwise available to us.

We will never ask for your provider password by email, SMS or telephone. If you receive such a request, it is not from us.

4. Why We Use Your Data And Our Lawful Bases

Purpose	Lawful basis
Creating and administering your account	Performance of a contract
Running your appointment search and sending alerts	Performance of a contract
Taking payment and issuing receipts	Performance of a contract
Storing and using provider account access where a route requires it	Performance of a contract, and your explicit instruction
Retaining consent and agreement records	Legitimate interests, namely evidencing the contract and defending disputes
Responding to chargebacks and payment disputes	Legitimate interests, namely establishing and defending legal claims
Support correspondence	Performance of a contract, and legitimate interests in running the service
Security, fraud prevention, abuse detection and rate limiting	Legitimate interests, and legal obligation where applicable
Service quality, error diagnosis and improvement	Legitimate interests
Accounting and tax records	Legal obligation
Optional marketing email, where offered	Consent, withdrawable at any time

Where we rely on legitimate interests we have considered whether our interest is overridden by your rights. You can object to processing based on legitimate interests, and we will stop unless we have compelling grounds to continue or need the data for legal claims.

5. Who We Share Data With

We do not sell personal data, and we do not share it for third-party advertising.

We share the minimum necessary with:

• Stripe — payment processing and dispute handling;
• Amazon Web Services (Simple Email Service) — delivery of transactional email;
• Our hosting and infrastructure providers — storage and operation of the website and database;
• Cloudflare — DNS, network security and denial-of-service protection;
• Professional advisers, insurers and regulators — where we are required or entitled to disclose.

Where a route requires provider account access that you have supplied, that access is used with the relevant official provider only for the purpose you instructed. We do not otherwise pass your details to visa providers, embassies or consulates.

Each supplier acts under a written contract that restricts them to our instructions and requires appropriate security.

6. International Transfers

Our infrastructure and email delivery are located in the United Kingdom and the European Economic Area, including the AWS Europe (London) region. Some suppliers, including Stripe and Cloudflare, operate globally and may process data outside the UK or EEA.

Where data is transferred outside the UK or EEA we rely on an adequacy decision where one exists, or on the International Data Transfer Agreement, the UK Addendum, or Standard Contractual Clauses together with appropriate supplementary safeguards.

7. Cookies

We use a single strictly necessary cookie:

Cookie	Purpose	Type	Duration
PHPSESSID	Keeps you signed in and preserves your order through checkout	Strictly necessary	Session, deleted when you close your browser

This cookie is set with the Secure, HttpOnly and SameSite=Lax attributes.

We do not use advertising cookies, profiling cookies, cross-site tracking or third-party analytics cookies. Because we set only a strictly necessary cookie, no consent banner is required under the Privacy and Electronic Communications Regulations. Usage measurement is carried out first-party and server-side, and can be objected to under section 10.

If we ever introduce a non-essential cookie, we will ask for your consent before setting it and update this policy first.

8. Data Retention

Data	Retention
Account records	While your account is open, then up to 12 months after closure
Order, consent and payment records	6 years from the end of the tax year of the transaction, for accounting and limitation purposes
Provider account credentials	Deleted when the order completes, when you withdraw access, or on request — whichever is first
Support correspondence	Up to 24 months from the last message
Server, security and error logs	Up to 12 months
Dispute and chargeback evidence	Up to 6 years, or longer where a claim remains live
Marketing consent records	Until withdrawn, plus a suppression record kept indefinitely so we do not contact you again

When a retention period ends we delete the data or irreversibly anonymise it so that it can no longer identify you.

9. Security

• the site is served over HTTPS with HTTP Strict Transport Security;
• passwords are stored only as one-way hashes;
• provider credentials are encrypted at rest with the key stored outside the web root and outside the database;
• administrative access is restricted by role, protected by password re-entry for sensitive actions, and logged;
• sensitive administrative downloads are rate limited and recorded with a fingerprint of the file supplied;
• payment card details never reach our servers;
• logs containing personal data are held outside the public web root.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours where required, and will tell you directly where the risk is high.

10. Your Rights

You have the right to:

• be informed about how we use your data, which this policy provides;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we no longer have a lawful reason to keep it;
• restrict processing while a concern is investigated;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests;
• object to direct marketing at any time, with no exceptions;
• withdraw consent where consent is the basis, without affecting earlier processing.

To exercise a right, email [email protected]. We respond within one month and may extend by two further months for complex requests, telling you if we do. We may ask you to verify your identity before releasing data. There is no charge unless a request is manifestly unfounded or excessive.

Erasure is not absolute. We may need to keep order, consent, payment and dispute records for the periods in section 8 to meet legal obligations and to establish or defend legal claims.

11. Automated Decision-Making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. Appointment matching compares available appointments against the preferences you supplied; it does not evaluate you, and a human reviews service and refund decisions.

12. Children

The service is not directed at children and accounts are for adults aged 18 or over. Where an order concerns a child applicant, the details are supplied by the responsible adult holding the account. If you believe a child has provided data directly, contact us and we will remove it.

13. Changes To This Policy

We may update this policy. The version in force when you place an order is recorded against that order. Material changes will be notified by email or by a prominent notice on the site.

14. Complaints

Please contact us first at [email protected] so we can put things right.

You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, at ico.org.uk or on 0303 123 1113. If you are in the EEA you may complain to your local supervisory authority.

15. Contact

Privacy and data protection enquiries: [email protected].