Privacy Policy

In this Policy, capitalised terms have the meanings given below. Terms defined in the DPDP Act and not defined here carry the meaning given in that Act.

We are the Data Fiduciary in respect of the personal data described in this Policy. We decide why and how that data is processed, and we are accountable to you and to the Board for it. That accountability is not diminished by our use of Data Processors.

What we do. Unbordr is a Schengen visa document preparation and verification service. We help you build and check the documents for your own visa application. We are not a government body, we do not issue visas, we are not affiliated with any embassy, consulate, VFS Global, BLS International or other visa application centre, and we do not submit your application to any authority on your behalf. You remain the applicant and you submit your own file. This shapes our approach to your data: we collect what we need to prepare and verify your documents, and little else.

Territorial scope. This Policy applies to the processing of digital personal data within India, and to processing outside India where that processing is in connection with any activity related to offering goods or services to Data Principals within India, in line with section 3 of the DPDP Act.

We process your personal data only where we have a lawful basis under the DPDP Act. We rely on two bases, and we tell you which applies.

We collect only what is necessary for the specified purpose. Depending on the product you use and what you share when you book a call or complete your file, this may include:

The table at Annexure A sets out, for each category of personal data, the specified purpose, the lawful basis, and the retention period. That Annexure forms part of this Policy. In summary, we process your personal data to:

• Provide the Services: build your personalised document list, prepare and verify your documents, conduct your 30-minute advisor call, and return your finished file.
• Communicate with you about your application: booking confirmations, calendar invites and meeting links, reminders, document requests, status updates and support, by email, telephone and (if you opt in) WhatsApp.
• Take and reconcile payment through our payment gateway, and issue tax invoices.
• Meet legal, tax, accounting and regulatory obligations, and establish, exercise or defend legal claims.
• Secure the Services: prevent, detect and investigate fraud, misuse and security incidents.
• Improve the Services, using aggregated, anonymised or de-identified data wherever possible. Where data has been irreversibly anonymised so that no individual is identifiable, it ceases to be personal data and this Policy does not restrict its use.
• Send you news or offers only where you have separately opted in. You may unsubscribe at any time, at no cost, using the link in every such message.

We do not sell your personal data. We do not rent, trade or otherwise make it available for consideration to any third party for that third party's own marketing. We do not use the documents you upload for any purpose other than providing the Service you asked for. These are contractual commitments, not aspirations.

Purpose limitation. We will not process your personal data for a new purpose that is incompatible with the purpose for which it was collected without giving you a fresh notice and, where required, obtaining fresh consent.

Accuracy. Where we use your personal data to make a decision that affects you, or disclose it to another Data Fiduciary, we take reasonable steps to ensure it is complete, accurate and consistent, as required by section 8(3) of the DPDP Act. Because our preparation can only be as accurate as the information you give us, you are responsible for the accuracy of the data you supply, and for notifying us of changes.

You may withdraw your consent at any time. We will make withdrawal as easy as giving consent, as required by section 6(6) of the DPDP Act. You can withdraw through your account settings, or by writing to the Grievance Officer at the address in section 18. We will not impose a fee, a retention offer, a multi-step obstacle course, or any other friction designed to discourage you.

On withdrawal:

• we will stop the processing that relied on that consent within a reasonable period;
• we will erase your personal data and cause each of our Data Processors to erase it, unless retention is required for compliance with a law in force in India, in which case we retain only what that law requires, for only as long as it requires (see Annexure A);
• the lawfulness of processing carried out before withdrawal is not affected; and
• withdrawal may mean we can no longer provide some or all of the Services. Where it prevents us from completing work you have paid for, the refund position is governed by our Terms & Conditions, and the consequences of withdrawal are yours to bear under section 6(5) of the DPDP Act.

Our Services are intended for adults. You must be at least 18 years old to use the Services on your own behalf. We operate an age declaration at sign-up and we do not knowingly process a child's personal data outside the circumstances below.

Where an application involves a child, for example a minor travelling with a family, we process the child's personal data only:

• after obtaining verifiable consent from the parent or lawful guardian, in accordance with section 9(1) of the DPDP Act and Rule 10 of the DPDP Rules. We will exercise due diligence to check that the person identifying themselves as the parent is an adult and is identifiable, by reference to reliable identity details already available to us, or, where available, a virtual token issued by an authorised digital locker service provider (DigiLocker) that maps to verified identity details;
• to the extent strictly necessary for that specific visa application; and
• in a manner that is not likely to cause any detrimental effect on the well-being of the child, as required by section 9(2).

Absolute prohibition on tracking and advertising to children. In accordance with section 9(3) of the DPDP Act, we do not undertake any tracking, behavioural monitoring or profiling of children, and we do not direct any advertising at children. Operationally, this means that where a file involves a child, that child's personal data is processed only within our document preparation environment and is excluded from every advertising, analytics and measurement tool we use, including Meta's. We do not transmit any child's personal data, or any identifier derived from it, to an advertising platform.

Persons with a disability. Where you are a person with a disability who has a lawful guardian appointed under law, we will process your personal data on the basis of that guardian's consent, having verified the guardian's appointment, in accordance with section 9(1) and Rule 11 of the DPDP Rules.

If we learn that we have processed a child's personal data without valid verifiable consent, we will cease processing and erase that data promptly, and we will notify the parent or guardian.

We share your data narrowly, on a need-to-know basis, and never carelessly.

We take payment through Razorpay, a payment aggregator authorised by the Reserve Bank of India under the Payment and Settlement Systems Act, 2007. We do not collect, store or have access to your full card number, CVV, PIN, UPI PIN, net-banking credentials or bank account credentials on our systems. Those are captured and processed directly by Razorpay in a PCI-DSS compliant environment, and card storage, where applicable, is by way of tokenisation in accordance with RBI's card-on-file tokenisation directions. We receive only the transaction confirmation data described in section 4.3. Razorpay's handling of your data is governed by its own privacy policy.

Never share your card number, CVV, OTP, PIN or password with anyone claiming to be from Unbordr. We will never ask for them.

We use cookies and similar technologies in four categories:

Non-essential cookies are set only after you give consent through our cookie banner. Consistent with the Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023, our banner presents "Accept all" and "Reject all" with equal prominence, uses no pre-ticked boxes, and does not use confirmshaming, false urgency or nagging. You may change or withdraw your choices at any time through the cookie preference centre linked in our website footer, and through your browser settings. Some features may not work if you disable cookies.

We keep personal data only for as long as the specified purpose is being served, and thereafter only where retention is required by a law in force in India. When neither applies, we erase it or irreversibly anonymise it, and we require our Data Processors to do the same.

The specific retention periods that apply to each category of data are set out at Annexure A. In outline:

• Uploaded documents and prepared files. Retained for 60 days after delivery of your finished file, so that you can raise queries and we can support you, and then deleted. You may ask us to delete them sooner.
• Account and contact data. Retained while your account is active and for 3 years after your last interaction with us, after which it is erased, unless a longer statutory period applies.
• Financial and transaction records. Retained for 8 financial years as required by section 128(5) of the Companies Act, 2013, and for 72 months from the due date of the annual return as required by section 36 of the Central Goods and Services Tax Act, 2017. These are legal minimums we cannot waive, and they apply even if you withdraw consent.
• Security and access logs. Retained for 180 days within India, as required by the CERT-In Directions dated 28 April 2022.
• Records of consent, notices and rights requests. Retained for the duration of processing and for a reasonable period afterwards, to demonstrate compliance.

Where we retain data under a legal obligation after you have asked us to delete it, we retain the minimum data necessary for that obligation, we restrict it to archival access only, and we do not use it for any other purpose. We will tell you what we have retained and why.

We implement reasonable security safeguards to prevent a Personal Data Breach, as required by section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules. These include:

• Encryption of personal data in transit (TLS) and at rest, and masking or tokenisation of sensitive fields where practicable;
• Access control on a least-privilege, need-to-know basis, with document access restricted to authorised team members assigned to your file, individual named accounts, and multi-factor authentication for administrative access;
• Logging and monitoring of access to and processing of personal data, retained and reviewed so that unauthorised access can be detected and investigated;
• Backups and continuity measures reasonably designed to allow continued processing in the event of loss of availability;
• Contractual safeguards with every Data Processor, as described in section 8.1;
• Confidentiality undertakings and background-appropriate onboarding for personnel with access to files, and prompt revocation of access on exit;
• Periodic review of our safeguards, and of the technical and organisational measures of our Data Processors.

No system can be guaranteed perfectly secure, and we do not claim otherwise. What we commit to is that we will apply safeguards appropriate to the sensitivity of visa documentation, and that we will not seek to contract out of our statutory obligation to do so. Nothing in this Policy or in our Terms & Conditions excludes or limits any liability we have under the DPDP Act, which can extend to a penalty of up to ₹250 crore for failure to take reasonable security safeguards.

Your part. You are responsible for keeping your login credentials confidential and for the security of the device and email account you use to access the Services. Please tell us immediately if you suspect unauthorised access to your account.

If a Personal Data Breach occurs, we will:

1. Notify you, each affected Data Principal, without delay, in a concise, clear and plain manner, through the user account and by email or other registered mode of communication. That notification will describe the nature, extent and timing of the breach and the likely consequences relevant to you, the measures we have taken or propose to take to mitigate risk, the safety measures you may take, and the contact details of a person able to answer your questions, in accordance with Rule 7(1) of the DPDP Rules.
2. Notify the Data Protection Board without delay with the available particulars, and provide the Board with the further particulars required by Rule 7(2), including the broad facts, circumstances and reasons, mitigation measures, findings on the person who caused it, remedial measures to prevent recurrence, and our report on the notices given to you, within 72 hours of becoming aware, or such longer period as the Board may allow on request.
3. Report to CERT-In within 6 hours of noticing or being notified of a reportable cyber security incident, as required by the CERT-In Directions dated 28 April 2022.
4. Notify any other regulator to whom reporting is required, and cooperate fully with any investigation.

We maintain an internal incident response procedure covering detection, containment, assessment, notification and post-incident review, and we test it periodically.

Your personal data is primarily stored and processed in India. Some of our Data Processors may process limited data on infrastructure outside India; the countries and the data involved are identified at Annexure B.

Where personal data is transferred outside India, we do so in accordance with section 16 of the DPDP Act, which permits such transfer except to a country or territory restricted by notification of the Central Government. We will not transfer personal data to any restricted territory, and we monitor those notifications. Any transfer is additionally subject to:

• a written contract with the recipient imposing safeguards at least equivalent to those in this Policy, and obliging the recipient to make the data available to us and to the Central Government on demand where required;
• any requirement of a sectoral law or regulator that requires data to be held in India, including RBI's payment data storage requirements, which our payment gateway is responsible for meeting; and
• data minimisation, so that only the data necessary for the processor's function leaves India.

Section 16 of the DPDP Act does not restrict the applicability of any other law that provides a higher degree of protection or restriction on transfer.

Under Chapter III of the DPDP Act you have the following rights. There is no charge for exercising them.

Identity verification. We may ask you for information reasonably necessary to verify your identity before acting on a request, in order to protect your data from being disclosed to someone impersonating you. We will not use that information for any other purpose.

Timelines. We will act on a valid request as soon as reasonably practicable and in any event within the timelines prescribed under the DPDP Act and DPDP Rules. Where a request is manifestly unfounded, excessive or repetitive, we may decline it, and we will tell you why and how to escalate.

Section 15 of the DPDP Act places duties on you as well. In particular, you must not:

• impersonate another person while providing personal data for a specified purpose;
• suppress any material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State;
• register a false or frivolous grievance or complaint with us or with the Board; or
• furnish any false particulars, suppress material information, or impersonate another person when exercising your right to correction or erasure.

Breach of these duties may attract a penalty of up to ₹10,000 under the First Schedule to the DPDP Act, in addition to any consequence under our Terms & Conditions or the general law.

Step 1: Contact our Grievance Officer. Write to the Grievance Officer named in section 18 with your name, registered email, a description of your grievance and any supporting material.

• We will acknowledge your grievance and issue a unique complaint reference number within 48 hours, in line with Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020.
• We will redress the grievance within 30 days of receipt where it relates to the Services, as required by those Rules.
• For grievances relating specifically to the processing of your personal data, we will in any event respond within the period specified under the DPDP Rules, and no later than 90 days from receipt.

Step 2: Escalate to the Data Protection Board of India. If your grievance remains unresolved, or you are not satisfied with our response, you may complain to the Board under section 13(3) read with section 15 of the DPDP Act. The Board may be approached at the address and through the mechanism notified by it from time to time. You must ordinarily have exhausted Step 1 first.

Step 3: Other routes remain open. Nothing in this Policy limits your right to approach a consumer commission under the Consumer Protection Act, 2019, the National Consumer Helpline (1915) or the e-Daakhil portal, or any other authority or court of competent jurisdiction.

The Grievance Officer is resident in India and is the person able to answer questions about our processing of your personal data, as contemplated by the DPDP Rules. We will publish any change to these details on our website.

We do not make any decision producing legal or similarly significant effects concerning you solely by automated means. Our tools generate a suggested document list and highlight gaps; a human advisor reviews your file and the assessment you receive is a human one. We do not use your personal data to train third-party generative models, and we do not permit our Data Processors to do so.

Our website and communications may link to third-party sites, including government portals, VFS Global, BLS International and airline or accommodation providers. We do not control those sites and are not responsible for their content or privacy practices. Their processing of your data is governed by their own policies, which you should read.

We may update this Policy from time to time. Where a change is material, for example a new purpose, a new category of recipient, a materially longer retention period, or a change in the identity of the Data Fiduciary, we will:

• post the updated Policy on our website with a new version number and "Last updated" date;
• give you at least 15 days' advance notice by email to your registered address, where you have an active account or an open file; and
• where the change requires it, seek your fresh consent rather than relying on your continued use of the Services.

For non-material changes, posting the updated Policy is sufficient. We maintain an archive of previous versions, available on request. Continued use of the Services after a non-material change indicates acceptance of it; continued use is not treated as consent to a material change that requires fresh consent under the DPDP Act.

If any provision of this Policy is held to be invalid, illegal or unenforceable, that provision will be severed to the minimum extent necessary and the remainder will continue in full force. Where any provision of this Policy is inconsistent with the DPDP Act, the DPDP Rules or any other law in force in India, the law prevails and this Policy is to be read as modified to the minimum extent necessary to comply with it. Headings are for convenience only. This Policy is governed by the laws of India.

This Policy should be read together with our Terms & Conditions. In the event of conflict between the two on any matter concerning personal data, this Policy prevails.

This Annexure forms part of the Policy and satisfies the itemised description requirement in Rule 3 of the DPDP Rules. "Consent" means section 6 of the DPDP Act; "Legitimate use" means section 7; "Legal obligation" means processing required by a law in force in India.

Each processor below is engaged under a written contract meeting the requirements of section 8(2) of the DPDP Act. This list is current as at the effective date and is updated on our website.