Privacy Policy

VisaHelm is a trading name of [LEGAL ENTITY NAME], a limited liability company licensed in Abu Dhabi (mainland), licence no. [LICENCE NUMBER], with its registered address at [REGISTERED ADDRESS] ("VisaHelm", "we", "us"). We are the controller of the personal data described in this policy.

• Website: visahelm.com
• Privacy contact: privacy@visahelm.com

We help UAE residents prepare and manage applications for Portugal's D7 and D8 visas and the residence permit that follows. We are independent and not affiliated with any government.

This policy applies when you visit visahelm.com, use our eligibility calculator, message us (including on WhatsApp), book a call or become a client. It explains what we collect, why, who we share it with, how long we keep it and what rights you have.

We follow UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Where the EU General Data Protection Regulation (GDPR) also applies, for example while you are in Portugal or another EU country during our work with you, we apply its standards too. [REVIEW: confirm when GDPR applies and whether an EU representative under GDPR Article 27 is needed]

• Contact details: your name, phone or WhatsApp number, email address and preferred language.
• Calculator answers: income type, monthly income, currency, savings, the number of adults and children moving, nationality and planned timing.
• Case information (clients only): copies of your passport and Emirates ID, UAE residence visa, photos, income and bank statements, pension or tenancy documents, employment or client contracts, tax-residence certificates, marriage and birth certificates, police certificates, health or travel insurance, accommodation documents, and details of your NIF (Portuguese tax number) and Portuguese bank account.
• Communications: messages, call notes, emails and booking details.
• Payment information: amounts, dates and invoice details. Card details are handled by our payment provider. We do not store full card numbers.
• Technical data: IP address, device and browser type, pages visited and cookie data. Analytics and advertising cookies are used only with your consent. See our Cookie Policy.

We collect information from you directly. With your permission, we also receive it from people acting for you (for example, a spouse providing family details) and from our service provider in Portugal about your NIF, bank account and fiscal representation.

Some documents needed for a visa contain sensitive personal data under the PDPL. These include police certificates (criminal records), family information (marriage and birth certificates), health insurance details and biometric data such as passport photos.

• We process this data only with your explicit consent, and only for your application.
• We collect it only through our secure upload portal. Never send passports, bank statements or certificates by WhatsApp or as email attachments. We will never ask you to.
• Access is limited to the people working on your case.

You can withdraw your consent at any time. If you do, we may not be able to continue with your application.

• To reply to your enquiry and show your calculator result and Readiness Report.
• To arrange and hold calls with you.
• To assess which route may fit you and prepare a proposal.
• To deliver our services: document checklists and reviews, your application pack, your VFS appointment and the AIMA stage.
• To coordinate your NIF, Portuguese bank account and fiscal representation with our service provider in Portugal.
• To send you updates about your case.
• To issue invoices, take payments and keep our accounts.
• To send you news and offers, only if you have opted in.
• To understand how our website is used and to measure our ads, only with your cookie consent.
• To keep our systems secure, prevent fraud and meet our legal obligations.
• To establish, exercise or defend legal claims.

[REVIEW: confirm these legal bases against the PDPL exceptions to consent and its Executive Regulations once issued]

Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.

We share only what is needed, with these categories of recipients:

• Our service provider in Portugal, to obtain your NIF, open your Portuguese bank account and arrange fiscal representation.
• Our CRM and case-management platform, where we keep enquiries and case files.
• Messaging (WhatsApp Business), email and scheduling providers.
• Payment providers.
• Analytics and advertising providers, only with your cookie consent.
• Cloud storage and hosting providers.
• Translators and couriers, when your documents need translating or delivering.
• The bodies you apply to, on your instructions: VFS Global (the contractor that receives applications for the Portuguese embassy), the Portuguese embassy in Abu Dhabi and AIMA in Portugal. These bodies handle your data under their own rules.
• Professional advisers (such as auditors and insurers) and authorities, where the law requires it.

Our service providers act on our instructions under written contracts that require confidentiality and security. We never sell your personal data. If you ask, we will tell you the identity of the specific recipients of your data.

Your data is processed in the UAE. Some of it is also transferred to:

• Portugal and other EU countries, because your application is decided there and our service provider in Portugal works there.
• Other countries where our service providers host data, such as EU countries and the United States.

We transfer data only to countries with an adequate level of protection, under contracts with appropriate safeguards, or where another exception allowed by law applies, for example when the transfer is necessary to perform our contract with you or you have given explicit consent. [REVIEW: confirm transfer mechanisms under the PDPL and, for data coming from the EU, GDPR Chapter V]

When the period ends, we delete the data or make it anonymous.

• Encryption in transit and at rest.
• A secure upload portal for documents, with links that expire.
• Multi-factor authentication and role-based access for our team.
• Logs of who accesses case files.
• Confidentiality undertakings from staff and contractors.
• If a data breach requires it, we notify the UAE Data Office and you without undue delay.

No system is completely secure, but we review our safeguards regularly.

Under the PDPL, you have the right to:

• be informed about how we process your data
• access your data and receive a copy
• have inaccurate data corrected
• have your data erased
• restrict processing
• object to processing or ask us to stop it, including for marketing
• data portability: receive your data in a structured format and have it transferred to another organisation
• withdraw your consent at any time
• object to decisions based solely on automated processing that have legal effects (we do not make such decisions)

Where GDPR applies, you have similar rights under it.

How to exercise your rights: email privacy@visahelm.com. We may ask you to confirm your identity first. We reply within 30 days [REVIEW: confirm the response deadline] and normally charge nothing.

Complaints: please contact us first. You also have the right to complain to the UAE Data Office. Where GDPR applies, you can complain to Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the country where you live.

We send you news and offers only if you have opted in separately. The consent you give in the calculator covers contact about your enquiry only.

You can opt out at any time: reply STOP on WhatsApp, use the unsubscribe link in any email, or write to privacy@visahelm.com.

We do not offer our services to children directly. We process children's data only as family members included in a parent's or guardian's application, and only as provided by that parent or guardian.

The calculator compares your answers with the 2026 thresholds and shows an indicative result. It is not a decision on your application. We do not make any decision with legal or similarly significant effects based solely on automated processing. A member of our team reviews your situation before we suggest next steps.

We may update this policy from time to time. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or on our website.

[LEGAL ENTITY NAME], trading as VisaHelm

• Address: [REGISTERED ADDRESS]
• Privacy: privacy@visahelm.com
• General enquiries: hello@visahelm.com
• Data protection officer: [REVIEW: confirm whether a DPO is required, given the sensitive data we process]