Privacy Policy & GDPR
Last updated: June 1, 2026
MigraGate complies with the General Data Protection Regulation (GDPR — EU 2016/679). Your data is processed with transparency, security, and solely for the purpose of providing our services.
1. Who are we?
MigraGate SAS (hereinafter "MigraGate") is the controller of your personal data collected via the migragate.com platform. Data Protection Officer (DPO): dpo@migragate.com Address: MigraGate SAS, 12 rue de la Mobilité, 75001 Paris, France
2. Data collected
We collect only the data strictly necessary for processing your requests: Identity data: surname, given name (Latin and Cyrillic where applicable), date and place of birth, nationality, marital status, occupation. Contact data: email address, phone number, WhatsApp, postal address. Document data: passport (number, dates, issuing authority), identity photo, residence documents, transport tickets. Financial data: payment currency, proof of payment (never a card number). Browsing data: IP address, technical cookies, pages visited, session duration.
3. Purposes and legal bases
Your data is processed for the following purposes: • Processing your visa / invitation / insurance file — Contract performance • Managing your user account — Contract performance • Communicating on the progress of your file — Contract performance • Legal compliance and anti-fraud — Legal obligation • Improving our services (anonymised analytics) — Legitimate interest • Sending commercial offers (with your consent) — Consent We carry out no automated processing with legal effect without human intervention.
4. Retention periods
Your data is retained for the following periods: • Active account data: for the duration of your relationship with MigraGate, then 3 years after the last activity. • Application files: 5 years after the file is closed (legal obligation). • Billing data: 10 years (accounting obligation). • Browsing cookies: maximum 13 months. Upon expiry of these periods, your data is deleted or anonymised irreversibly.
5. Data sharing
Your personal data is never sold to third parties. It may be transmitted to: • Consular and governmental authorities: in connection with your visa, invitation or permit applications. • Technical service providers (hosting, email, support): bound by GDPR-compliant processing agreements. • Insurance and hotel partners: only the data necessary for the service ordered. • Judicial authorities: upon legal requisition. When your data is transferred outside the European Union, we ensure appropriate safeguards are in place (standard contractual clauses, adequacy decision).
6. Your rights
Under the GDPR, you have the following rights: • Right of access: obtain a copy of your personal data. • Right of rectification: correct inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of your data, subject to our legal obligations. • Right to restriction: request temporary suspension of processing. • Right to portability: receive your data in a structured, readable format. • Right to object: object to processing based on our legitimate interest or to direct marketing. • Right to withdraw consent: at any time for processing based on your consent. How to exercise your rights: send your request to dpo@migragate.com with a copy of your ID. We respond within one month. If you disagree, you may lodge a complaint with your national data protection authority.
8. Data security
MigraGate implements appropriate technical and organisational measures to protect your data: • Encrypted communications (HTTPS / TLS 1.3) • Encryption of sensitive data at rest • Data access restricted to authorised personnel, on a least-privilege basis • Access logging and monitoring • Regular security testing In the event of a data breach likely to result in a high risk to your rights, we will notify you within 72 hours.
9. Policy amendments
This Privacy Policy may be updated to reflect changes in our practices or applicable regulations. Any substantial amendment will be notified by email and/or by a visible notification on the Platform at least 30 days before it takes effect.
Exercise your GDPR rights: dpo@migragate.com