Global privacy policy

Riogrannde Travels (“Riogrannde”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information entrusted to us. This Privacy Policy explains how we collect, use, store, disclose, transfer, secure and delete personal information when you visit our websites, contact us, book a consultation, purchase or request a travel service, use our visa-documentary support services, communicate with our team, or otherwise interact with us.

We are a United Kingdom-based travel and visa-documentary services business serving clients internationally. Our services may require the processing of substantial personal information because visa, immigration-documentary and travel applications can require identity, passport, financial, employment, family, travel-history and supporting-document information.

This policy is intended to support compliance, where applicable, with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the EU General Data Protection Regulation (“EU GDPR”), applicable Canadian privacy legislation including the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and applicable United States federal and state privacy laws. Privacy rights and obligations vary by jurisdiction; a law is referenced only to the extent that it applies to the relevant individual, processing activity and business.

Data controller / organisation: Riogrannde Travels

Business address: 26 Clement Street, Birmingham, B12SL, United Kingdom

Telephone: 0333 090 3019

Email: hello@riograndetravels.com

Websites: www.riograndetravels.com and rio-grand.lovable.app (or any successor Riogrannde Travels domain).

For privacy enquiries, data-subject requests, complaints, consent withdrawals or questions about this policy, contact us using the email or postal details above and mark the communication “Privacy Request”. If we appoint a Data Protection Officer, UK representative, EU representative or other legally required privacy representative, the applicable contact details will be published on our website.

This policy applies to personal information processed through:

• Our websites, online forms, contact pages, enquiry forms, consultation or appointment-booking tools and service-ordering processes
• Visa-documentary support, application-form assistance, document review, appointment support and related client services
• Travel planning, flight or accommodation support, ground logistics, tours, travel insurance referrals or arrangements and other travel services
• Email, telephone, WhatsApp and other messaging or communication channels used by our business
• Payments, invoices, refunds, accounting, customer support and complaint handling
• Marketing communications, promotions, newsletters, testimonials, reviews and social-media interactions where applicable; and
• Business administration, fraud prevention, security, legal compliance and record keeping.

This policy does not control the independent privacy practices of embassies, consulates, governments, visa application centres, airlines, hotels, insurers, payment providers, social networks or other third parties. Their own privacy notices apply when they act as independent controllers.

• Full name, title, date of birth, gender/sex where required for an application, nationality and place of birth
• Home or correspondence address, email address, telephone number and preferred contact method
• Passport numbers, passport copies, national identity documents, residence permits, eVisa/share-code information and other identity evidence
• Photographs, signatures and application identifiers.
• Visa history, immigration status, previous applications, approvals, refusals, cancellations or travel-authorisation history
• Travel history, intended destination, purpose of travel, itinerary, dates, accommodation, transport and booking information
• Embassy, consulate, visa-centre, biometrics and appointment information
• Invitation letters, sponsorship information and supporting application evidence
• Information needed to prepare forms such as visa, travel-authorisation or consular forms.
• Bank statements, balances, transaction explanations, income, savings, sponsorship and proof-of-funds information
• Payment information, invoices, transaction references and refund records. Full payment-card data is normally handled by the relevant payment provider rather than stored by us
• Employer details, job title, salary, employment letters, payslips, leave information and business ownership records
• Education history, qualifications, admission information or student documentation where relevant.

Visa and travel matters may require information about spouses, partners, children, parents, relatives, hosts, sponsors, employers, inviting organisations or travel companions. If you provide another person’s information, you should have lawful authority to do so and, where appropriate, make them aware that their information may be processed under this policy.

Depending on the service and official application requirements, documents supplied to us may reveal or contain information about racial or ethnic origin, religious or philosophical beliefs, health, biometric identifiers used for identification, sex life or sexual orientation, or other sensitive matters. We do not request such information unless it is relevant to the requested service or supplied by you as part of supporting evidence. Where UK/EU GDPR applies, special-category data is processed only where an applicable Article 9 condition and an Article 6 lawful basis are available, for example explicit consent where appropriate, the establishment/exercise/defence of legal claims where applicable, or another condition permitted by law.

• IP address, browser type, device type, operating system, language, approximate location derived from IP, referring pages and website activity
• Cookie identifiers, analytics information, consent choices and similar online identifiers
• Security logs and information used to detect abuse, fraud or technical problems.

We may retain emails, messages, call notes, consultation notes, documents you upload or send, feedback, reviews, complaints and records of instructions you give us.

We may collect personal information:

• Directly from you when you contact us, submit a form, book a consultation, purchase a service, provide documents or communicate with our team
• From a sponsor, family member, employer, representative, host or travel companion where they provide information for a service involving you
• From service providers and partners involved in a booking, payment or application process
• From government, embassy, consular or visa-service systems where access or information is lawfully provided for the service
• Automatically through cookies, server logs, analytics and website technologies; and
• From publicly available sources where relevant and lawful.

We process personal information for purposes including:

• Responding to enquiries and assessing which travel or documentary service you have requested
• Creating a client file and providing contracted visa-documentary, travel advisory, booking, itinerary, appointment and logistics services
• Completing or assisting with forms and organising supporting documentation on your instructions
• Communicating with you about documents, deadlines, appointments, bookings, payments and service progress
• Submitting, transmitting or making information available to relevant third parties where this forms part of the service you have instructed us to provide
• Processing fees, issuing invoices, managing refunds and maintaining accounting records
• Preventing fraud, document misuse, cyber threats and unauthorised access
• Meeting tax, accounting, regulatory, court, law-enforcement and other legal obligations
• Managing complaints, disputes and legal claims
• Improving our website, services, client experience and internal operations
• Sending marketing communications where permitted by law and respecting applicable opt-out or consent requirements; and
• Publishing a review, testimonial, image or success story only where we have an appropriate lawful basis and any required permission.

Where UK GDPR or EU GDPR applies, we identify an appropriate lawful basis before processing personal data. The basis depends on the purpose and circumstances and may include:

Contract / pre-contract steps

Necessary to provide a requested service or take steps at your request before a contract.

Client onboarding, document preparation, bookings, consultations, service communications.

Legal obligation

Necessary to comply with a legal duty applicable to us.

Tax/accounting records, lawful regulatory obligations, legally required disclosures.

Legitimate interests

Necessary for our or a third party’s legitimate interests where your rights do not override those interests.

Service administration, security, fraud prevention, business improvement, establishing or defending claims.

Consent

Used where consent is the appropriate legal basis and can be freely given and withdrawn.

Certain marketing, optional cookies, selected sensitive-data processing or publication uses where required.

Vital interests / public task

Used only in the limited circumstances recognised by applicable law.

Exceptional situations where the statutory conditions are met.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against the rights and reasonable expectations of the individual. Where we rely on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

To provide visa-documentary services, we may need to handle copies of passports, residence evidence, bank statements, employment records, invitation/sponsor evidence, family documents, travel history and other materials required for an application. We use these materials to perform the service requested by the client, not to determine whether a visa or immigration permission should be granted.

Visa, immigration and border decisions are made solely by the relevant government, embassy, consulate, immigration authority or other competent body. Riogrannde Travels does not control their processing or decision-making and cannot guarantee an application outcome.

Where necessary, lawful and proportionate, information may be shared with:

• Embassies, consulates, immigration authorities, border agencies and government departments
• Visa application centres, biometrics/appointment providers and official application-platform operators
• Airlines, hotels, accommodation providers, transfer providers, tour operators and other travel suppliers
• Travel-insurance providers or intermediaries where requested
• Payment processors, banks and financial-service providers used to process transactions
• Website hosts, cloud-storage providers, email providers, CRM/customer-service platforms, IT/security providers and communications providers
• Professional advisers such as accountants, auditors, insurers or legal advisers where necessary
• Law-enforcement, courts, regulators or public authorities where disclosure is required or permitted by law
• A purchaser, successor or professional adviser in connection with a genuine restructuring, merger, sale or transfer of the business, subject to appropriate safeguards.

We do not sell personal information in the ordinary meaning of selling client visa files or documents for money. If a privacy law uses broader definitions of “sale”, “sharing” or targeted/cross-context behavioural advertising, we will provide any legally required notice and opt-out mechanism if those activities apply to our website.

Because our services are international, personal information may be sent to or accessed in countries outside the United Kingdom, European Economic Area or the individual’s home country. This can occur when dealing with a foreign embassy, consulate, immigration authority, visa centre, airline, hotel, travel supplier, cloud/technology provider or other recipient required for the requested service.

Where UK GDPR or EU GDPR applies to a restricted transfer, we will use an applicable lawful transfer mechanism where required, such as an adequacy regulation/decision, approved contractual safeguards (including applicable standard contractual clauses or UK transfer mechanisms), or a legally permitted derogation for a specific transfer. Some transfers requested by a client may be necessary for performance of a contract or pre-contractual steps connected with international travel.

Different countries may provide different levels of privacy protection. We take reasonable steps to select appropriate providers and safeguards, but we cannot control the independent data-handling practices of foreign governments and authorities.

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the service, answer follow-up queries, meet legal/accounting obligations, resolve disputes, prevent fraud and establish or defend legal claims. Retention periods may vary by record type, service, jurisdiction and legal requirement.

When determining retention, we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use or disclosure, the purposes of processing, whether those purposes can be achieved by other means, client expectations and applicable law.

Where information is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it. Backup copies may persist for a limited period until overwritten under normal backup cycles.

We use reasonable and appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, password protection, role-based access, secure devices, encrypted transmission or storage where appropriate, backups, staff confidentiality obligations, provider due diligence and incident-response procedures.

RIOGRANNDE TRAVELS | GLOBAL PRIVACY POLICY

No internet transmission, email system, messaging platform or electronic storage method is completely secure. Clients should avoid sending unnecessary sensitive documents and should follow any secure-upload or document-transmission instructions we provide.

If a personal-data breach occurs, we will assess the nature, scope and risk of the incident and take appropriate containment and remediation measures. Where applicable law requires notification to a supervisory authority, privacy commissioner or affected individuals, we will make the required notification within the legally applicable timeframe.

Our websites may use cookies and similar technologies to operate essential website functions, remember preferences, understand website performance, improve services, prevent abuse and, where enabled, support analytics or marketing. Non-essential cookies will be handled in accordance with applicable consent requirements.

Where required, users will be offered a cookie banner or preference tool that allows them to accept or reject non-essential cookies. Browser settings may also be used to block or delete cookies, although doing so can affect website functionality.

A separate Cookie Policy or cookie table should be maintained on the live website identifying the actual cookies and technologies in use, their providers, purposes and durations. The web development team should not publish a generic cookie list that does not match the deployed site.

We may send service updates and, where permitted, marketing about Riogrannde Travels services, offers or travel information. Where consent is required, we will seek it before sending marketing. Where another lawful route is available, we will still provide a clear way to opt out. You may unsubscribe at any time by using an unsubscribe facility where provided or by contacting us.

Opting out of marketing does not prevent us from sending necessary transactional or service- related communications.

Our services may involve children travelling with parents or guardians, and visa applications can require a child’s passport, birth certificate, parental-consent information and other supporting documents. We process children’s information only where reasonably necessary for the requested service and with appropriate involvement or authority of a parent, guardian or other person legally entitled to act for the child, subject to applicable law.

Our website and services are not intended to invite children to independently purchase services or provide sensitive personal information without appropriate adult involvement. If we learn that information has been collected inappropriately, we will take reasonable steps to address it.

Where UK GDPR or EU GDPR applies, and subject to legal conditions and exemptions, you may have the right to be informed; access your personal data; correct inaccurate or incomplete data; request erasure; restrict processing; receive certain data in a portable format; object to certain processing; withdraw consent where processing is based on consent; and receive protections in relation to solely automated decisions that produce legal or similarly significant effects.

You have an unconditional right to object to direct marketing. Other rights depend on the lawful basis and circumstances of processing. We may need to verify identity before acting on a request and may retain information where the law permits or requires us to do so.

UK complaints: You may raise a concern with the UK Information Commissioner’s Office (ICO). We encourage you to contact us first so that we have an opportunity to address the concern. EU/EEA individuals may also have the right to complain to the competent data-protection authority in their country of residence, work or the place of the alleged infringement.

Where Canadian privacy law applies, including PIPEDA or applicable provincial private-sector privacy legislation, we aim to follow principles of accountability, identified purposes, meaningful consent where required, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access and the ability to challenge compliance.

Depending on the applicable Canadian law and circumstances, individuals may request access to personal information held about them, request correction of inaccurate information, withdraw consent subject to legal or contractual restrictions, and make a privacy complaint. Canadian provincial laws may apply instead of or alongside federal requirements in particular circumstances.

The United States does not have a single federal law equivalent to the GDPR governing all private- sector personal data. Privacy obligations may arise under federal sector-specific laws and state privacy laws. Where a U.S. state privacy law applies to Riogrannde Travels and grants rights to a resident, we will honour the rights required by that law, subject to applicable thresholds, definitions, exceptions and verification requirements.

Depending on the applicable state law, rights may include knowing/accessing personal information, correcting inaccuracies, deleting certain information, obtaining a portable copy, and opting out of certain sale, sharing, targeted advertising or profiling activities. Some states also provide appeal rights when a request is denied.

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), applies to our processing, eligible California residents may exercise the rights provided by that legislation. We will not discriminate against an individual for exercising an applicable privacy right. If our website engages in activity legally defined as a “sale” or “sharing” of

RIOGRANNDE TRAVELS | GLOBAL PRIVACY POLICY

personal information, we will provide the notices and opt-out mechanisms required by applicable California law.

U.S. residents may submit privacy requests using the contact details in Section 2. We may request reasonable information to verify identity and residency. An authorised agent may make a request where applicable law permits and the required authority can be verified.

Riogrannde Travels does not make visa, immigration or border-admission decisions. Those decisions belong to the relevant authorities. We do not intend to make decisions about clients based solely on automated processing that produce legal or similarly significant effects unless we provide the notices and safeguards required by applicable law.

We may use software or AI-assisted tools for administrative support, drafting, organisation, quality checks or service efficiency. Where such tools are used with personal information, we will seek to apply appropriate confidentiality, data-minimisation, access and provider safeguards. Human review remains appropriate for material client-facing work.

Our website may link to WhatsApp, social-media platforms, payment services, booking platforms, government websites, visa centres and other third-party services. Clicking a link or using an external service may allow that third party to collect information independently. We are not responsible for third-party privacy practices and recommend reviewing the relevant privacy notice before providing information.

Payments may be processed through banks, card processors, payment gateways or other payment- service providers. We may receive transaction status, amount, payer information and reference details needed for accounting and customer support. Unless specifically stated otherwise, we do not need to retain full card numbers or card security codes.

Client passports, bank statements, visa forms and supporting documents are treated as confidential business records. Access should be limited to personnel and service providers who reasonably need the information for authorised purposes. We do not use client documents for unrelated marketing or public display without an appropriate lawful basis and, where required, permission.

You are responsible for providing accurate information and genuine documents. Please avoid sending information that is not required for your service. If you provide personal information about another person, you are responsible for ensuring you are permitted to provide it. You should

also keep your own account, email and device credentials secure and notify us promptly if you believe correspondence or documents have been compromised.

To make a privacy request, contact hello@riograndetravels.com and include:

• Your full name and sufficient information for us to locate the relevant client record
• The right or request you wish to exercise
• Any relevant service or application reference; and
• Where reasonably necessary, information that allows us to verify your identity.

We will respond within the timeframe required by the law that applies to the request. We will not request more identity information than is reasonably necessary for verification. Some requests may be refused or limited where an exemption applies, another person’s rights would be adversely affected, or retention is required by law.

We may update this Privacy Policy to reflect changes to our services, technology, legal obligations, data practices or website. The updated version will display a revised effective date. Material changes may also be highlighted through the website or another appropriate communication method.

This is a global privacy notice. It does not attempt to contract out of mandatory privacy rights. If the law in your jurisdiction grants you stronger or additional rights than those described here and that law applies to our processing, those statutory rights remain available to you. Nothing in this policy limits rights that cannot lawfully be waived.

Privacy and Data Protection Enquiries

Riogrannde Travels

26 Clement Street, Birmingham, B12SL, United Kingdom

Email: hello@riograndetravels.com

Telephone: 0333 090 3019

Website: www.riograndetravels.com