1. Controller
Cyberhosting e.U., proprietor Patrick Binder, Gregorygasse 10/7, 1230 Vienna, Austria, operates and hosts Cybervisa. For privacy enquiries, contact office@cybervisa.at.
2. Website, server logs and spam protection
When you visit the site, our server processes your IP address and technical request information. Depending on the log, access, error and security logs can record information such as the time, requested address, response status and browser or device details. We use these data to deliver the site, diagnose faults and protect against attacks. Our legal basis is our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR).
We use Cloudflare Turnstile to detect automated access to the contact form. Cloudflare, Inc., USA, processes technical signals such as IP address, browser identifier, TLS characteristics and the originating page. Cloudflare processes these signals on our behalf to protect the form and under its own responsibility to improve its bot detection. Our legal basis for spam protection is our legitimate interest in preventing misuse (Article 6(1)(f) GDPR). See the Turnstile privacy notice and Cloudflare’s standard contractual clauses for information about processing and international transfers.
3. Contact and email delivery
For enquiries through our contact form, we process your name, email address, country of residence and passport country, and, where provided, current country, travel date, visa type, callback number and message. The form sends your enquiry to our customer mailbox. The form itself does not store a copy of the message in the website database. We use this information to respond and, where relevant, prepare a quote. For telephone enquiries, we process the information you give us and any necessary notes. Our legal basis is taking steps at your request before entering a contract (Article 6(1)(b) GDPR), or our legitimate interest in handling other enquiries (Article 6(1)(f)).
We use Brevo to send contact enquiries, registration emails and password-reset emails (Sendinblue SAS, France). Brevo processes the email addresses involved, sending and delivery data, and message content. Depending on the settings, Brevo may store message previews and open or click events. The retention period depends on the rules configured in the Brevo account. Information about Brevo delivery logs.
If you follow a messaging link offered on the site, it opens the relevant provider. If you contact us there, we process the contact information shown, your message and its time. The provider’s privacy information applies to its own processing. Send passport copies and financial evidence through the agreed document channel.
4. Customer account, sign-in and cookies
When you register, we store your username, email address and registration time. Passwords are stored as hashes. Sign-in and password reset use session tokens and time-limited reset keys. Session data can include sign-in time, expiry, IP address and browser identifier. Where two-factor authentication is enabled, we store the settings and security data associated with the account for the authenticator app and account recovery. Our legal bases are providing the account for the requested service (Article 6(1)(b) GDPR) and our legitimate interest in protecting accounts (Article 6(1)(f)).
The customer area uses essential cookies to check whether your browser accepts cookies and to keep you signed in during the session. Session duration depends on your “Remember me” choice. Signing out ends the session. Section 165(3) of the Austrian Telecommunications Act 2021 applies to essential cookies.
5. Visa documents and recipients
For the agreed application assistance, we process the necessary identity, contact and travel information and documents such as passport data, a passport photo and proof of travel, accommodation, residence or, where required, financial means (Article 6(1)(b) GDPR). If you provide information about fellow travellers, we receive it from you. Online uploads are currently unavailable. If you send documents by email as agreed, the attachments are processed in the mailboxes involved. Only staff authorised to handle your case have access at Cybervisa.
Depending on the agreed scope, data needed for the application may be made available to the responsible Thai embassy or through the official Thai e‑Visa system. Thai authorities make the decision under their own responsibility. If Cybervisa itself transfers data to a third country, we tell you the specific recipient and the applicable basis under Articles 44 onward of the GDPR before the transfer. You can use the contact address above to obtain information about any safeguards.
6. Booking, payments and records
We process order, invoice and payment details such as amount, currency, payment reference and payer. For bank transfers, the banks involved receive the payment information. We reconcile advance payments and document the agreed forwarding of official fees. Our legal bases are performing the contract and meeting statutory accounting and retention duties (Article 6(1)(b) and (c) GDPR).
7. Retention and deletion
- Server and security logs are kept for operations, troubleshooting and investigating specific security incidents. Retention depends on the rotation cycle for each log and the conclusion of any necessary investigation.
- Enquiries, account data and visa documents are deleted once no longer needed, unless required for an active order, statutory duties or a specific legal claim. Retention depends in particular on the conclusion of the enquiry or order and closure of the account.
- Backups are overwritten or deleted in line with their rotation schedule. Delivery logs and message previews are governed by the settings described in section 3.
- Tax-relevant invoices and supporting records are normally kept for seven years from the end of the relevant calendar year under section 132 of the Austrian Federal Fiscal Code. Pending proceedings may require longer retention.
8. Required information and your rights
We need the required information to handle your enquiry and the relevant application data to carry out the agreed service. Cybervisa makes no automated decision on your booking or visa. Turnstile checks for technical signs of automated form access.
Under the GDPR, you may have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent with effect for the future. Contact office@cybervisa.at. You can also complain to the Austrian Data Protection Authority or another competent supervisory authority.