Privacy Policy
1. Who we are
Navi Visa Consulting Consortium (Private) Limited (company registration no. PV00321174), Kuliyapitiya, North Western Province, Sri Lanka ("NVCC", "we", "us") is the controller of the personal data described in this policy. NVCC is a subsidiary of Phoenix Global Trading (Private) Limited. We are a private visa consultancy. We are not a government body, embassy, consulate or visa-issuing authority.
Data Protection Officer / privacy contact: Data Protection Officer (to be appointed), privacy@navivisas.com, +94 701 500 268.
2. Which law applies
We process personal data in line with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka ("PDPA"). Where we serve people in the European Union or United Kingdom, we also try to follow the principles of the GDPR / UK GDPR. Nothing in this policy limits rights you have under the law that applies to you.
3. What personal data we collect
- Identity and contact data: name, date and place of birth, gender, nationality, NIC number, address, email, phone and WhatsApp number.
- Travel document data: passport number, issue and expiry dates, issuing authority, passport and ID scans, photographs.
- Application data: travel dates and purpose, employment and employer details, marital status and family details, destination contacts, previous travel, supporting documents (for example bank statements, letters, invitations), and our case notes.
- Financial data: quotes, invoices, payments and refunds. Card payments are handled by PayHere; we do not receive or store your full card number.
- Communications: inquiries, messages and emails with us, and a record of the messages we send (we keep a fingerprint and a masked address, not the full message).
- Account and technical data: login details (passwords are stored only as secure hashes), consent records, security logs, IP address (kept as a one-way hash in most logs), browser type, and essential cookies.
- Chat data: messages you type into our AI assistant, with passport numbers, ID numbers, phone numbers, emails and bank details removed automatically before they are stored or sent.
Some of this data, for example passport and identity data, financial data, and in some cases health or family information that an embassy requires, may be special categories or sensitive data under the PDPA. We collect it only because it is needed for the visa service you asked for.
4. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Preparing, checking and submitting your visa application, booking appointments, keeping you updated | Performance of our contract with you, and steps you asked for before a contract |
| Invoicing, payments, refunds, accounting and tax records | Contract, and legal obligations (tax and company law) |
| Security, fraud prevention, audit logs, defending legal claims | Legitimate interests and legal obligations |
| Answering inquiries sent through our contact form, chat or WhatsApp | Steps you asked for before a contract, and legitimate interests |
| Newsletters and offers | Your consent, which you can withdraw at any time |
| Using an AI tool to draft letters or answer general questions | Your consent for the chat assistant; legitimate interests (with human review) for staff drafting |
| Optional cookies (for example analytics), if we ever turn them on | Your consent through the cookie banner |
5. Who we share it with
- Embassies, consulates, visa application centres and immigration authorities of the country you are applying to, because that is the service you asked for. Their own laws apply to the data once they receive it.
- Service providers (processors) who act on our instructions: our web hosting provider; Brevo (email delivery); Twilio (SMS); Meta Platforms (WhatsApp Business messages); PayHere (card payments); an AI provider for the chat assistant and drafting tools (data is redacted first). The current list is kept in our processor register and is available on request.
- Corporate clients and sub-agents, only for applications they submitted for you.
- Professional advisers, auditors, courts and authorities where the law requires it or to defend legal claims.
We do not sell your personal data and we do not use it for third-party advertising.
6. Transfers outside Sri Lanka
Some of the providers above, and the embassies themselves, are outside Sri Lanka (for example in the European Union, the United States, China and other destination countries). We transfer data abroad only as the PDPA allows, for example where it is necessary for the contract you asked for, or where the provider gives appropriate safeguards. Ask us for details of the safeguards for a particular provider.
7. How long we keep it
We keep personal data only for as long as we need it. Our retention schedule is published on our retention page. In summary: application files are kept while your application is active and for a limited period after it ends; invoices, payments and accounting records are kept for the period required by tax and company law; AI chat history is deleted after 30 days; security logs after a limited period. When the period ends, we delete or anonymise the data. When data is erased it is removed from our live systems at once; copies in encrypted backups are overwritten as those backups expire in the normal backup cycle and are never restored for any other purpose.
8. How we protect it
Encrypted connections (HTTPS), role-based staff access, a tamper-evident audit log, hashed passwords, private file storage, login lockouts, and staff training. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the Data Protection Authority of Sri Lanka as the law requires.
9. Your rights
Under the PDPA you can ask to: access your data; get a copy; correct inaccurate or incomplete data; withdraw consent; object to processing; and ask us to erase your data. Some rights have legal limits, for example we must keep invoices for tax law even if you ask us to delete your account. You can use most rights in the Privacy & Data page of the client portal, or by contacting privacy@navivisas.com. We will answer within the time the law allows (we aim for 21 working days) and we may need to confirm your identity first. We do not charge for reasonable requests.
10. Complaints
Please contact us first at privacy@navivisas.com. You also have the right to complain to the Data Protection Authority of Sri Lanka. People in the EU or UK may also complain to their local data protection authority.
11. Children
We process data about children only when a parent or legal guardian applies for them and gives the information. The parent or guardian accepts these terms on the child's behalf.
12. Changes
We will post every new version here with its version number and effective date. If a change is important, we will ask you to read and accept it the next time you sign in.