Privacy policy
Updated 3 October 2026
This privacy notice describes how Rustravel Oy processes personal data on viisumit.fi and when handling visa orders, including the online visa application details form.
Controller
Rustravel Oy, business ID 1743918-3, Tehtaankatu 12, Helsinki. Contact: info@viisumit.fi, +358 40 350 7428. Rustravel Oy is the controller both for viisumit.fi and for the leima.rustravel.fi service used to handle orders.
Contact form
Through the viisumit.fi contact form we collect the details you provide: name, email, phone number, the service you ask about, destination country and your message. Together with the message we also store, as technical details, the page the form was submitted from, the session's landing page and the referrer domain of the visit. Form data is deleted within 12 months at the latest. No documents or personal identity codes are sent through this site.
Visa application details form
When you order a visa service, you receive a link to your order page at leima.rustravel.fi. The details form there asks for the information the official visa application requires: personal and passport details including the passport number, travel details, and the employment, education and family details the destination country's form demands. On the same page you can submit the documents the application needs, such as a passport copy and a visa photo. Data and files are stored in the EU.
Sensitive data
Some countries' official forms also ask sensitive questions: for example the India and China applications include questions about religion, health, criminal record and organisation memberships. We ask these only because the destination country's form requires them, and only with your explicit consent. The answers are stored separately from the rest of the application and deleted within one month.
Purpose and disclosure to the destination authority
We process application data for one purpose: preparing your visa application and filing it with the destination country's authority. Disclosing the data to the embassy, consulate or visa centre is therefore the core of the service, and the recipient can be located outside the EU. We disclose only what the destination country's form requires. We never sell your data or share it for marketing.
Legal bases
We process order data to perform the contract. Submitting the details form requires your consent, and processing sensitive data requires the explicit consent you give on the form. We answer contact requests based on our legitimate interest. You can withdraw consent by contacting us. Withdrawal does not affect an application already filed with the authority.
Feedback request
When your assignment has ended, we may send one email asking for a review on Google and at most one reminder. Every customer receives the same request, and no reward is given for a review. We use only your email address, your language and which service you used, and we send no information about you to Google. The legal basis is our legitimate interest in feedback on our service. You can object to these messages through the link in the message or by contacting us.
Retention periods
We delete data and documents automatically: passport copies after 24 months, visa photos after 6 months, application details after 24 months, powers of attorney and contracts after 24 months, and degree certificates and other documents after 12 months. A copy of an issued visa is kept until the passport expires, at most 10 years, so that we can send a copy on request and earlier visas are on file for the next application. Sensitive supplementary answers are deleted within one month. A private customer's contact details (name, email, phone number, service language) and the travellers' names are anonymised 5 years after their last assignment closed, so that a returning customer can be recognised. Company customer data is not personal data, and invoice records required by the Accounting Act are kept in the accounts for its statutory periods. The 24-month period for application details and passport copies exists so that a returning customer's new application can start from the previous one.
Service providers
We use the following providers to process data: Supabase (database and file storage, EU/Ireland), Vercel (website hosting), Resend (email delivery) and Shopify (orders and payments). They process data on our behalf under data processing agreements.
Cookies and analytics
The site sets no non-essential cookies before you accept them. Visitor analytics (Google Analytics) starts only after acceptance, and advertising cookies are never used. The map embed on the contact page also loads only after acceptance. Declining is as easy as accepting, and your choice is stored in your own browser.
Your rights
You have the right to access your data, request rectification or erasure, restrict processing and withdraw your consent. Contact: info@viisumit.fi. We delete data on request unless the law requires us to keep it.
Right to complain
If you believe your data is processed unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).