Legal
Privacy policy
Summary
- We collect the information you give us, information created when you use our services, and limited technical information from your device.
- We use it to provide our services, keep them safe, meet our legal duties and, only with your permission where the law requires it, to improve and market them.
- We never sell your personal information, and we do not share it for targeted advertising.
- You can ask to see, correct, delete or move your information, and to object to some uses. Email privacy@visarogroup.com.
1. Who we are
VisaroGroup, VisaroCraft, VisaroRide and VisaroHealth are brands of VisaroCraft Technology, LLC, a Wyoming limited liability company with its principal office at 539 W Commerce St #7862, Dallas, TX 75208, United States (“VisaroGroup”, “we”, “us”).
For the purposes of data protection laws such as the UK and EU General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act 2023 (NDPA), VisaroCraft Technology, LLC is the controller of the personal information described in this policy unless we tell you otherwise. You can contact us about privacy at privacy@visarogroup.com.
2. What this policy covers
This policy applies to visarogroup.com, our company websites (including www.visarocraft.com and www.visarohealth.com), our emails and forms, and the services of our three companies. Some services have additional notices that you will receive when you sign up, and those notices also apply:
- VisaroCraft. Your client engagement terms explain how we handle the documents and evidence you give us to prepare your petition.
- VisaroRide. Your hire purchase agreement explains the identity, credit, driving-record and vehicle information we process to provide and manage your plan.
- VisaroHealth. Health information you give us as a patient may be “protected health information” under the US Health Insurance Portability and Accountability Act (HIPAA). Where HIPAA applies, our Notice of Privacy Practices, given to you at registration, controls how that information is used, and it takes priority over this policy if the two differ.
3. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, phone, postal address, date of birth | You |
| Enquiries and communications | Messages, call notes, feedback, survey answers | You |
| VisaroCraft case information | CV, publications, awards, reference letters, passport and immigration history, employment and education records | You, people you ask to write for you, public sources such as publication databases |
| VisaroHealth health information | Health questionnaire answers, medical history, consultation notes, prescriptions, delivery details | You, our clinicians, partner pharmacies |
| VisaroRide driver and finance information | Driving licence, driving record, right-to-work and ID documents, platform earnings, bank details, payment history, vehicle location and condition data where your agreement provides for it | You, identity and background check providers, credit reference agencies, ride-hailing platforms with your permission, vehicle tracking devices |
| Payment and transaction | Payments made, amounts, dates, invoice details (card numbers are handled by our payment processors, not stored by us) | You, payment processors |
| Job applications | CV, cover letter, references, interview notes | You, referees |
| Technical and usage | IP address, browser and device type, pages viewed, referring site, approximate location derived from IP | Your device; cookies and similar technologies (see our cookie policy) |
| Marketing preferences | Your choices about receiving news and offers | You |
If you do not give us information we need to provide a service (for example, identity documents for a VisaroRide plan), we may not be able to provide that service.
4. How we use it and why
Where the GDPR or NDPA applies, we must have a legal basis for each use. The table shows what we do and the basis we rely on.
| What we do | Legal basis |
|---|---|
| Provide the services you ask for: prepare petitions, arrange consultations and prescriptions, set up and manage hire purchase plans | Contract with you; explicit consent or other lawful condition for sensitive information |
| Answer enquiries and provide customer support | Legitimate interests (responding to you); contract |
| Verify identity, check driving records and assess affordability and creditworthiness (VisaroRide) | Contract; legal obligation; legitimate interests (responsible lending and fraud prevention) |
| Take payments, collect amounts owed and keep financial records | Contract; legal obligation |
| Prevent fraud, misuse and security incidents | Legitimate interests; legal obligation |
| Meet legal, regulatory, tax and record-keeping duties, and respond to lawful requests | Legal obligation |
| Establish, exercise or defend legal claims | Legitimate interests |
| Measure and improve our websites and services with analytics | Consent (for analytics cookies); legitimate interests (aggregated service improvement) |
| Send news and offers by email or text | Consent, or legitimate interests for similar services where the law allows; you can opt out at any time |
| Consider job applications | Steps before entering a contract; legitimate interests |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where VisaroRide uses scoring tools to help assess affordability, a person reviews the outcome and you can ask for a human review.
5. Sensitive information
Some of our services involve sensitive information: health data (VisaroHealth), immigration and nationality information (VisaroCraft), and financial, credit and criminal-record or driving-offence information (VisaroRide). We only collect what we need for the service, limit access to staff and partners who need it, and process it only where the law allows, usually with your explicit consent, to provide care, or where required by law. Under California law, we use sensitive personal information only for purposes permitted by regulation, so a right to limit its use does not apply.
6. Who we share it with
We share personal information only as needed and under appropriate contracts:
- Within VisaroGroup: between our brands where it is needed to provide a service you asked for or to run the group (for example, shared customer support and technology). We do not use your VisaroHealth health information for VisaroCraft or VisaroRide purposes.
- Service providers who act on our instructions: hosting and cloud storage, email and messaging, payment processing, customer support tools, identity verification, analytics (only with consent) and professional advisers.
- Care partners (VisaroHealth): independent licensed clinicians and certified pharmacies who provide your care, and shipping providers who deliver your medication.
- Finance and vehicle partners (VisaroRide): credit reference and background check agencies, insurers, vehicle suppliers, maintenance providers, vehicle tracking providers, and debt recovery agents if payments are not made.
- People you direct us to share with: for example, an immigration attorney you instruct, referees writing letters for your petition, or a ride-hailing platform.
- Authorities and others where required by law: courts, regulators, law enforcement and tax authorities, or to protect the rights, safety and property of our customers, our staff or the public.
- Business transfers: if all or part of our business is sold, restructured or merged, personal information may transfer to the new owner, who must protect it as described here.
7. We do not sell your data
We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined under US state privacy laws. We have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.
8. International transfers
We are based in the United States and our main systems are hosted there. If you are in the UK, the European Economic Area, Nigeria or elsewhere, your information will be transferred to and processed in the US and possibly other countries with different data protection laws. Where required, we protect these transfers with recognised safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other mechanisms permitted under the NDPA, and with security measures described below. You can ask us for more information about these safeguards.
9. How long we keep it
| Information | Typical retention |
|---|---|
| General enquiries | Up to 2 years after our last contact |
| VisaroCraft client files | For the engagement and up to 7 years afterwards, to support follow-up filings and legal claims |
| VisaroHealth medical records | As required by the medical record laws of the state where care was given (often 7 to 10 years, longer for minors) |
| VisaroRide agreements and payment records | For the agreement and 7 years after it ends |
| Job applications (unsuccessful) | 12 months, unless you ask us to keep it longer for future roles |
| Analytics data | Up to 14 months |
| Marketing preferences and opt-outs | Until you ask us to delete them; opt-outs are kept so we respect them |
When information is no longer needed, we delete it or make it anonymous.
10. How we protect it
We use technical and organisational measures appropriate to the sensitivity of the information, including encryption in transit, access controls based on role, multi-factor authentication for staff, vendor due diligence, staff training and logging. No system is completely secure; if a breach affects your information, we will tell you and the relevant authorities where the law requires.
11. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and get a copy;
- Correct information that is inaccurate or incomplete;
- Delete your information, subject to legal exceptions;
- Port information you gave us to another provider in a usable format;
- Object to or restrict some uses, including direct marketing at any time;
- Withdraw consent where we rely on it, without affecting earlier processing;
- Opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do not do these);
- Appeal a decision we make about your request.
How to make a request: email privacy@visarogroup.com or write to us at the address above. We will confirm receipt, may ask for information to verify your identity, and will respond within the time the law requires (usually one month in the UK, EU and Nigeria, and 45 days in US states, which we may extend where allowed). You may use an authorised agent; we may ask for proof of their authority. We will not discriminate against you for exercising your rights.
For VisaroHealth patient records covered by HIPAA, your rights are described in the Notice of Privacy Practices.
12. US state privacy rights
Residents of California, Texas, Colorado, Connecticut, Virginia, Oregon and other US states with comprehensive privacy laws have the rights listed in section 11, as provided by their state’s law. In the preceding 12 months, we collected the categories of personal information shown in section 3 (identifiers; customer records; protected classification characteristics such as age; commercial information; internet activity; geolocation data where a VisaroRide agreement provides for it; professional, employment and education information; sensitive personal information as described in section 5; and inferences used for affordability assessment). We collected them from the sources, used them for the purposes and disclosed them to the categories of recipients described in sections 3, 4 and 6. We retain them for the periods in section 9.
If we decline your request, you may appeal by replying to our decision or emailing privacy@visarogroup.com with the subject “Privacy appeal”. If you are not satisfied with the outcome, you can contact your state Attorney General.
Nevada residents: we do not sell covered information as defined by Nevada law.
13. UK, EU and Nigeria rights
If you are in the UK, the EEA or Nigeria, the rights in section 11 apply under the UK GDPR, the EU GDPR or the NDPA. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country; in Nigeria, the Nigeria Data Protection Commission (ndpc.gov.ng). We would appreciate the chance to resolve your concern first.
14. Job applicants
When you apply for a role, we use your application, CV, interview notes and references to assess your suitability, communicate with you and, if you are successful, prepare an offer. Only people involved in hiring can see your application. We may carry out background or right-to-work checks for some roles, and we will tell you before we do. We keep unsuccessful applications for 12 months so we can answer questions about our decision, unless you ask us to delete them sooner or keep them for future roles. Do not include sensitive information in your application unless it is relevant, for example a reasonable adjustment you would like.
15. Children
Our services are for adults aged 18 and over. We do not knowingly collect personal information from children under 18 through this website. VisaroCraft petitions may include information about a client’s dependent children; we receive that from the parent or guardian and handle it with extra care. If you believe a child has given us information, contact us and we will delete it.
16. Cookies and browser signals
We use only strictly necessary storage unless you agree to analytics. You can change your choice at any time through “Cookie settings” in the footer. Full details are in our cookie policy. We honour the Global Privacy Control signal as a request to opt out of the sale or sharing of personal information. Because there is no common standard for “Do Not Track”, we treat it the same as declining analytics cookies.
17. Changes to this policy
We will update this policy when our practices or the law change. We will post the new version here with a new “last updated” date and, if the changes are significant, tell you by email or a notice on our websites before they take effect.
18. Contact and complaints
Questions, requests or complaints about privacy:
Email: privacy@visarogroup.com
Post: Privacy, VisaroCraft Technology, LLC, 539 W Commerce St #7862, Dallas, TX 75208, United States