Privacy Policy

This document sets out the privacy principles applicable to the online service entryforms.app — https://entryforms.app/ — regarding the collection, processing and use of personal data obtained by the Data Controller.

Personal information is processed in accordance with Regulation (EU) 2016/679 (GDPR).

Pursuant to Article 4(7) GDPR, the Data Controller is Iran Markaz International Tour Operator, No. 1045, 12th Farvardin Cross-Road, Jomhoory Ave, Tehran, Iran, phone: +98 21 66970970, e-mail: info@iranmarkaz.ir.

The Data Controller makes every effort to protect the privacy and information of website users.

Personal data is processed in accordance with Article 5 GDPR. It will be:

• processed lawfully, fairly and transparently ('lawfulness, fairness and transparency');
• collected for specified, explicit and legitimate purposes ('purpose limitation');
• adequate, relevant and limited to what is necessary ('data minimization');
• accurate and, where necessary, kept up to date ('accuracy');
• kept in a form permitting identification of data subjects no longer than necessary ('storage limitation');
• processed in a manner ensuring appropriate security ('integrity and confidentiality').

We only use your personal data if one of the following applies: you have given consent; we need it to perform a contract; we need to comply with legal obligations; we need to protect vital interests; it is necessary for the public interest; we have a legitimate interest.

Categories of Personal Data:

• Identity data: first name, last name, date of birth, gender — required to identify the traveller.
• Contact details: e-mail address, telephone number — for dispatch of documents and contact.
• Passport data: passport number, country of issue, expiry date — for correct application completion.
• Travel information: date of arrival, intended stay, purpose of visit, destination country.
• Device information: device type, operating system, browser type, IP address, advertising ID.
• Payment information (we do not store this information).

The legal basis derives from the GDPR:

• Article 6(1)(a) — processing based on consent.
• Article 6(1)(b) — processing necessary to perform a contract or to take steps prior to entering into it.
• Article 6(1)(c) — processing necessary to comply with a legal obligation.
• Article 6(1)(f) — processing necessary for the legitimate interests pursued.

The primary basis for processing customer data is the necessity to perform the contract (Article 6(1)(b) GDPR).

Data is processed only for as long as necessary for the designated purpose. Afterwards it is irrevocably deleted or destroyed.

Data processed under consent is processed until consent is revoked.

We process data during the term of the agreement and during the period of expiry of claims under the Polish Civil Code.

Your personal data, including passport information, is used exclusively for the purpose of submitting your travel document application to the relevant government authorities.

Our commitment to your data:

• We DO NOT sell your personal data.
• We DO NOT share your data for advertising.
• Government submissions only — data is transmitted solely to the official government systems of your destination country.
• No unnecessary retention — data is kept only as long as needed for our services and legal obligations.

Specific use of sensitive data:

• Passport number and passport details — transmitted via secure, encrypted connections directly to official government portals.
• Date of birth and identity information — submitted only to government systems for identity verification.
• Travel dates and itinerary — shared only with immigration authorities as required.
• Email address — used to deliver approved travel documents and essential communication; never shared with third parties for marketing.

We take the security of your personal data seriously and have implemented comprehensive technical and organizational measures:

• SSL/TLS Encryption: data between your browser and our servers is encrypted with industry-standard 256-bit SSL/TLS.
• Secure Payment Processing: handled by PayPal's PCI DSS-compliant systems; we never store credit card details.
• Access Controls: access is strictly limited to authorized personnel.
• Secure Data Transmission: encrypted API connections when submitting applications to government systems.
• Regular Security Audits: systems are reviewed regularly to identify and address vulnerabilities.
• Data Minimization: we collect only strictly necessary information.

Important: no method of transmission over the Internet is 100% secure. We use commercially acceptable means to protect your data and continuously improve our practices.

Recipients may include entities carrying out orders on behalf of the Data Controller: employees, associates, accounting companies, IT providers, payment companies, banks, marketing service providers, telecom providers, law firms, and authorized state authorities.

Destination administrative authorities (e.g. Thailand, Singapore, Aruba) receive data for the purpose of processing Digital Arrival Card applications.

For transfers outside the EEA, the Controller applies safeguards required under Chapter 5 GDPR, including standard contractual clauses adopted by the European Commission.

You have the right to:

• access your personal data (Article 15 GDPR);
• rectify your personal data (Article 16 GDPR);
• erase your personal data — 'right to be forgotten' (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object to processing (Article 21 GDPR).

If you believe processing violates the GDPR, you may lodge a complaint with the President of the Office for Personal Data Protection.

Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cookies are small text files sent by the server and stored on the user's device in connection with the use of the website.

Cookies are used for the proper functioning of the website and to improve the user experience. They are safe for user devices.

Types of cookies:

• Session cookies — stored until the browser session ends.
• Persistent cookies — stored until deleted.

Cookies by purpose:

• Necessary — required for the proper functioning of the website.
• Statistical — allow us to study traffic and user preferences.
• Marketing — allow us to tailor content and advertisements.

Users can change cookie settings at any time. Restricting cookies may affect some functionalities.

We use: Google Analytics, Google Ads, PayPal.

We reserve the right to change or modify the Privacy Policy and Cookies Policy. Changes will be posted on the homepage.

This version is effective from 04.02.2026.