Skip to content

Legal

Last updated 27 October 2026.

This policy explains what personal data Trip and tours collects, why, who receives it, how long we keep it and your rights. It is written to meet the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and applies to everyone, wherever you live.

Who is responsible (data controller)

MERN Solutions, operator of Trip and tours (visaandtrip.com). Contact for anything about your data: hello@mernsol.com — or reply to any order email. We have not appointed a data protection officer; requests are handled by the founder.

What we collect

  • Application details — name, sex, date and place of birth, nationality, occupation, passport number and dates, home address, address at your destination, travel dates and port of entry, email and phone.
  • Documents you upload — passport data page, photo and travel documents.
  • Order records — the service chosen, price, status history, government reference number, emails we send you, and a one-way hash of your IP address for abuse prevention.
  • Newsletter and guide forms — your email and what you enter in the form.
  • Saved trips — if you ask us to save a trip before you book a flight: your email, the airports and dates you searched, the destination country, whether you opened a booking page, and — only if you add them — your flight number, booking reference and arrival airport (stored encrypted). The ticket file you upload to pre-fill a form is read in memory and not stored until you submit an application.
  • Technical data — standard server logs (IP address, browser, pages requested) kept for security for up to 14 days.

Why we use it and our lawful basis

  • To prepare and submit your application, send status emails and deliver your document — performance of our contract with you (Art. 6(1)(b)). Some application data, such as your photo, can reveal sensitive information; we process it only because you explicitly ask us to submit it to the government (explicit consent, Art. 9(2)(a)), which you can withdraw before submission.
  • Accounting, tax and legal records — legal obligation (Art. 6(1)(c)).
  • Fraud prevention, security and handling disputes — legitimate interests (Art. 6(1)(f)).
  • Newsletter — your consent (Art. 6(1)(a)); unsubscribe any time.
  • Saved trips — your consent (Art. 6(1)(a)), given by ticking the box next to the email field. We use it only to email you a private link to continue your visa application for that trip and to send one reminder. Withdraw consent at any time with the unsubscribe link in those emails — your saved trip is then deleted straight away.
  • Partner (affiliate) cookies — your consent, given in the cookie banner.

We do not sell your data, use passport data for marketing, or make automated decisions about you.

Who receives it

  • The government authority of your destination, through its official system, when we submit your application. It then holds your data under its own rules.
  • Our hosting provider (a virtual server in the European Union), which stores the encrypted data.
  • Our email delivery provider, which sends our emails, and, once enabled, our payment processor (card details are handled by the processor, never stored by us).
  • Professional advisers and authorities where the law requires it.

International transfers

We operate from Pakistan, our server is in the EU, and your application necessarily goes to the destination country, which may be outside the UK/EU. Transfers to destination governments are necessary to perform the service you request (Art. 49(1)(b)). Where our service providers process data outside the UK/EU, we rely on adequacy decisions or standard contractual clauses.

How we protect it

  • HTTPS (TLS) everywhere. Passport numbers, dates of birth, contact and address details, and every uploaded file are encrypted at rest with AES-256-GCM, with the key kept separately from the data.
  • Only authorised staff can view decrypted details, through a password-protected admin dashboard; every status change is logged.

How long we keep it

  • Passport data and uploaded documents: deleted 90 days after your order is completed (delivered, refused or cancelled).
  • Applications that are never confirmed or paid: deleted 30 days after the last activity.
  • A minimal order record (order ID, destination, status history, price) is kept as long as tax law requires.
  • Saved trips: deleted 90 days after your last activity on the trip, when you unsubscribe, or when you ask us to delete them. Once you submit an application the trip stops sending reminders and follows the order retention above.
  • Guide applications and requests: 12 months. Newsletter: until you unsubscribe (then deleted within 30 days). Backups roll off within 14 days.

Your rights

You can ask for access to your data, a copy in a portable format, correction, deletion, restriction, or object to processing based on legitimate interests, and you can withdraw consent at any time (this does not affect processing already done). Email hello@mernsol.com with your order ID; we reply within one month. Once an application has been submitted, the destination government keeps its own copy, which we cannot delete.

You also have the right to complain to a data protection authority — in the UK the Information Commissioner’s Office (ico.org.uk), in the EU the authority of the country where you live or work. We would appreciate the chance to resolve your concern first.

Cookies and similar technologies

  • Essential (no consent needed): your passport-country preference, saved trips and your cookie choice, stored in your browser; a secure session cookie for staff in the admin area.
  • Partner / affiliate (only if you click “Accept”): the Travelpayouts script, which turns our flight, hotel and travel links into tracked partner links and sets cookies so partners can credit us with a commission. If you choose “Essential only”, it is not loaded. Change your choice any time with “Cookie settings” in the footer.
  • Flight and hotel search: the route, dates and number of travellers you enter are sent to our server and, to fetch prices, to our data partner (Travelpayouts/Aviasales). We keep anonymous search and click counts (with a one-way hashed IP, no name or email) to run and improve the service. When you select an option, you are redirected through our partner’s tracking link so the partner can credit us; that happens only because you clicked.
  • When you open a partner’s site, that partner’s own privacy and cookie policy applies.

Children

Our service is meant for adults. A parent or legal guardian may apply for a child and provides the child’s details on their behalf; we do not knowingly collect data directly from children under 16.

Changes

We will post any changes here with a new “last updated” date, and tell customers with open orders about significant changes by email.