Privacy Policy

N.Sh. Aplikodv is the data controller for this website and the DV application preparation service. Aplikodv is a private service and does not represent the United States government.

Data-protection contacts are at the end of this document. If a request concerns a specific application, include the reference number.

To prepare the application: first, middle and last name, date and place of birth, nationality, gender, education level, marital status, spouse and children details, contact details and the other answers you provide in the form.

Photos you upload for the applicant, spouse and children. Photos may contain biometric data; they are used only to prepare and file the application and for quality review.

Payment data: method, amount, reference, receipt date and reconciliation notes. In cash mode we do not store card data. When card payment is enabled, card details are processed by the payment provider and are not stored on this site.

Communications with staff, change or data requests, audit records and technical data needed for security (for example access times). Business logs do not store full IP addresses; rate limiting uses a temporary address.

To provide the service you request (preparation, review, filing and support), to meet legal obligations (for example accounting and tax) and for legitimate interests such as system security and fraud prevention.

For processing that requires consent (for example marketing communications, if offered in the future), consent is given separately and can be withdrawn. Consent for children's data is given by the parent or legal guardian.

Photos are stored in private storage with role-based access. They are not shown publicly and are not sold. Only authorised staff and, where necessary for maintenance, limited administrators can view them.

The automated dimension and format check is advisory. Staff decide whether to accept or reject a photo; there is no automated decision with legal effect.

The service uses Neon (PostgreSQL) for the database, photo storage and sign-in tokens, an email provider for sign-in links and notifications and, if enabled, a payment provider for cards. These providers process data only under the relevant instructions and agreements.

Some providers may process data outside Kosovo. International transfers and the required safeguards (for example standard contractual clauses) must be confirmed in provider agreements before launch; this is still under review.

In demo mode, data is stored on the application's local server and emails are not delivered. Demo is not a production environment.

Retention periods are not final. The current proposal, pending approval, is: applications 24 months, photos 12 months, payment records 84 months, audit logs 60 months and notifications 12 months. These periods may change according to legal obligations.

For transparency, the proposed values in the code are: applications 24 months, photos 12 months, payments 84 months, audit 60 months, notifications 12 months.

You may request earlier deletion; the request is reviewed in light of legal obligations and evidence needed for disputes.

You may request access, correction, deletion, restriction or objection to processing, and withdraw consent. In the portal you can submit a data or change request. For other requests use the official contact.

You may complain to the Kosovo Agency for Information and Privacy. Where the basis is consent, withdrawal does not affect the lawfulness of processing before withdrawal.

We use encrypted connections (HTTPS), signed sessions, single-use portal links, hashed draft secrets, rate limiting and staff action logging. No system is perfectly secure; if you notice a problem, contact us immediately.

This draft will be replaced by the final version after legal approval. Material changes will appear on this page with a new version.