Privacy notice for applicants
Last updated
This notice is given by the business that sent you this link: the one named at the top of this page (“we”). We are preparing your US visa application (form DS-160) and are responsible for your information as its controller.
What we collect
- Your answers to the DS-160: names, date and place of birth, nationality, national identification and passport details, addresses, phone numbers, email addresses and social media identifiers, travel plans and history, family members, education and work history.
- Your answers about health and criminal history. The DS-160’s security and background questions ask about health (for example communicable diseases, mental or physical disorders and drug use) and about arrests, convictions and other criminal matters. These are special categories of personal data and data about criminal offences, and we collect them only because the US government requires them on the DS-160.
- Your visa photo and documents you upload, such as a passport scan, and your spouse’s or parents’ passports if you upload them to fill in the answers about them.
- If you import your DS-160 from CEAC: the details you enter to retrieve it (the location, Application ID, surname, year of birth and security question answer), and the answers CEAC shows back, which replace your answers here. For a DS-160 already submitted, CEAC makes a new, unsigned copy to read it from, which lapses unless it is used.
- Messages you and our staff write to each other about your application.
- A record of each change to an answer, who made it and when.
- How you use these pages, such as which pages you open.
- Your consent: when you agreed to this notice, in which language, and the browser you used.
Why we use it
To prepare your DS-160 with you, check it, and file it with the US Department of State on CEAC, and to keep a record of what was filed. We may keep your applications together under one record, so that a later application can start from your last one; to do that, we compare your name, date of birth and passport number with our other applications. We may also be reminded when your passport or visa may soon need renewing, so that we can decide whether to contact you. We use your information for nothing else.
Your consent
We ask for your explicit consent before you answer anything, because the DS-160 asks about health and criminal history. You can withdraw your consent at any time with the link at the bottom of these pages. After you withdraw it, this link can no longer change your application unless you agree again; withdrawing does not undo what was done before. Withdrawing does not delete your information: to have it deleted, ask us using the contact details at the top of this page. If someone fills in your form for you through a group link, such as a parent, a guardian or a person you asked, they may give this consent on your behalf. If you then open a link of your own, we ask for your consent again.
Who receives it
- The US Department of State. Filing a DS-160 sends your answers to CEAC, which the US government operates. Once filed, that copy is outside our control and cannot be deleted by us. Importing your DS-160 from CEAC sends CEAC the details you enter to retrieve it.
- Our software provider, which hosts these pages and stores your application for us in the United States, under a written agreement that lets it use your information only on our instructions. It runs on its own servers, and uses these services of its own, each under a written agreement:
| Service | What for | Location |
|---|---|---|
| Backblaze (B2) | Storing photos, documents and filed-application PDFs | United States |
| Google (Gemini API) | Translating free-text answers into English; extracting the details on a passport scan (yours, or your spouse’s or a parent’s) when you or our staff ask | United States |
| Amazon Web Services (SES, S3) | Sending and receiving the emails about your application | United States |
| PostHog | Measuring how these pages are used | United States |
| Google (Analytics) | Measuring how these pages are used | United States |
We do not sell your information.
Transfers outside your country
Your information is stored and processed in the United States. Where data protection law requires a safeguard for that transfer, we rely on the European Commission’s standard contractual clauses, and the services above use the EU-U.S. Data Privacy Framework or standard contractual clauses. Sending your answers to the US Department of State is necessary to file the application you asked for.
How it is protected
Your answers, their history, your messages and the filing records are encrypted when stored, with a key kept apart from the database and its backups. Everything is sent over HTTPS. Only a few people can reach the systems, and staff of our software provider open an application only with our permission to fix a problem.
How long we keep it
As long as we need it to prepare and file your DS-160 and to answer questions about it afterwards, unless you ask us to delete it sooner. Deleted information leaves backups within 7 days. If you import your DS-160 from CEAC, the details you enter are deleted as soon as the import starts, and what it read after 90 days.
Your rights
You have the right to access your information and get a copy, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent. Ask us using the contact details at the top of this page; we answer within one month. You also have the right to complain to a data protection authority, in particular the one where you live or work.