Privacy policy

Updated 15 October 2026

This notice explains what personal data Rustravel Oy processes, why, for how long, and what rights you have. It covers the online shop rustravel.fi, our office, and dealings by email and phone.

1. Controller

Rustravel Oy
Business ID 1743918-3
Tehtaankatu 12, 00140 Helsinki, Finland
+358 40 350 7428
info@rustravel.fi

For privacy matters, contact info@rustravel.fi.

2. What data we process

Customer data. Name, email, phone number, address, company name for business customers, orders and their status, payment status and invoicing details. We do not see card details: the payment service handles them.

Visa application data for each traveller. A copy of the passport and a photo, name and previous names, date and place of birth, citizenship, address and contact details, travel dates and destinations, work and study details, previous trips and visas, insurance details and the other attachments of the application. We collect only what the destination country's authority requires for the application.

Special categories of data. Our forms do not ask about health, religion, criminal record, origin or other special categories of personal data. If the destination country's official application asks for them, our office asks you separately and enters the answers only in the authority's own application. We do not store these answers in our own systems. We record only who carried out the check and when.

Messages. Emails, contact form messages and notes of phone calls about your matter.

Website usage data. Technical data such as IP address, browser and pages visited, and data collected with cookies (section 8).

3. Why we process data and on what basis

Purpose	Legal basis
Handling your order and visa application, receiving and returning your passport	Contract (GDPR Art. 6(1)(b))
Special categories of data that we enter in the authority's application on your behalf	Your explicit consent (Art. 9(2)(a))
Customer service and replying to enquiries	Contract or steps before a contract, otherwise legitimate interest (Art. 6(1)(b) and (f))
Accounting, taxation and consumer protection duties, such as cancellation notices	Legal obligation (Art. 6(1)(c))
Feedback request after the service	Legitimate interest (Art. 6(1)(f)). You can refuse feedback requests with one click.
Website analytics and marketing cookies	Your consent (Art. 6(1)(a))
Preventing misuse and keeping data secure	Legitimate interest (Art. 6(1)(f))

We do not make automated decisions about you or profile you.

4. Who receives the data

Authorities and partners without whom no visa can be obtained:

the Consular Section of the Embassy of Russia in Helsinki, or the mission or visa centre of another destination country
the Russian tour operator issuing the invitation or tourist confirmation, and its partner
a Russian insurance company, when you order travel insurance for a trip to Russia from us
Matkahuolto or Posti, when you choose to have your passport returned by delivery

Service providers who process data on our behalf:

Shopify: online shop and payment processing (Shopify Payments)
Supabase and Vercel: our office system, servers in Ireland
Google: email (Google Workspace) and, with your consent, website analytics (Google Analytics)
Resend: sending emails, data stored in the United States
Netvisor and our accounting firm: bookkeeping
HulkApps: application forms on the website, being phased out

We disclose data to other authorities only when the law requires it. We do not sell data or pass it on for anyone else's marketing.

5. Transfers outside the EU and EEA

Visa application data is disclosed to the destination country's authority, for a Russian visa also to the issuer of the invitation, and the data of travel insurance ordered from us to a Russian insurance company. These recipients are outside the EU, and the disclosure is necessary to provide the service you requested (GDPR Art. 49(1)(b)).

Some of our service providers (Shopify, Google, Resend) may process data outside the EU. These transfers rely on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on the Commission's standard contractual clauses.

6. How long we keep data

Data	Retention period
Passport copy, application data and attachments	24 months from storage
Photo	6 months from storage
Copy of the issued visa	Until the passport expires, at most 10 years
Emails	24 months
Delivery address	24 months after the matter is closed
Customer data	Anonymised 5 years after your last dealings with us
Accounting records	As required by the Accounting Act, at most 10 years

We delete expired data automatically every day.

7. Your rights

You have the right to:

see what data we hold about you
have incorrect data corrected
have data erased when it is no longer needed and the law does not require us to keep it
restrict processing, or object to it where it is based on legitimate interest
receive the data you gave us in a machine-readable format
withdraw your consent at any time. Withdrawal does not affect the lawfulness of earlier processing.

Send your request to info@rustravel.fi. We reply within one month. We may ask you to prove your identity.

If you think we process your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

8. Cookies

We use necessary cookies that the online shop needs to work, for example for the shopping cart. We switch on analytics (Google Analytics) and marketing cookies only with your consent. You can change your choice at any time in the cookie settings at the bottom of the website.

9. Security

Only employees whose work requires it process the data. Signing in to our office system requires two-step verification, connections are encrypted, and every opening of a document is logged. Passports are kept in a locked safe at the office.