Cookie Policy
1. What cookies are
Cookies are small files a website stores in your browser. Similar technologies include browser storage (sessionStorage / localStorage).
2. Our approach
We use only strictly necessary cookies unless you choose otherwise. No analytics, advertising or social-media cookies are set, and no optional third-party script is loaded, until you click "Accept all" or turn a category on in "Cookie settings". You can change your choice at any time with the "Cookie settings" link at the bottom of every page.
3. The cookies we use
The full, current list (name, purpose, duration and provider) is shown in the table below this policy. It is generated from the site's cookie inventory, so it stays up to date.
4. Third-party content
Our fonts are served from our own server. Some pages show country flag images from flagcdn.com; your browser sends your IP address to that provider to fetch the image, but no cookie is set. Card payments open on PayHere's own pages, which set their own cookies under PayHere's policy.
5. How to control cookies
Use our "Cookie settings" link, or delete or block cookies in your browser settings. If you block strictly necessary cookies, signing in and forms will not work.
Every cookie we use
| Name | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
PHPSESSID | Strictly necessary | Keeps you signed in, protects forms against forgery (CSRF) and remembers form steps. HttpOnly, Secure, SameSite=Lax. | Browser session (server session ends after 1 hour idle) | navivisas.com (first party) |
nv_cc | Strictly necessary | Remembers your cookie choices and a random ID used to prove them. Signed, HttpOnly, Secure, SameSite=Lax. | 12 months | navivisas.com (first party) |
nvcc_chat_token (sessionStorage) | Strictly necessary | Only if you use the chat assistant: links your messages into one conversation. Removed by "Delete chat". | Until you close the tab | navivisas.com (first party) |
_ga, _ga_<id> | Analytics | NOT SET unless analytics is switched on by NVCC (GA4_ID) AND you accept analytics cookies. Counts visits and pages. | Up to 2 years | Google Analytics (Google LLC, USA) |
PayHere cookies | Strictly necessary | Only on PayHere's own payment pages when you choose to pay online; governed by PayHere's own policy. | Set by PayHere | PayHere (payhere.lk, Sri Lanka) |
How long we keep data (retention schedule)
| Data | Kept for | Then |
|---|---|---|
| Old notification_queue table (plain-text messages and addresses, no longer written) | Not kept (removed) | deleted |
| Old whatsapp_log table (plain-text messages and phone numbers, no longer written) | Not kept (removed) | deleted |
| Login lockout counters | 2 days | deleted |
| Data export ZIP files made for rights requests | 7 days | deleted |
| Used or expired set-password links | 7 days | deleted |
| Sealed retry copies of messages that are stuck or finished | 14 days | deleted |
| Public AI chat conversations | 30 days | deleted |
| Unsubscribed newsletter addresses (a hash stays on the suppression list) | 30 days | deleted |
| Uploaded documents rejected in review and replaced | 180 days | file deleted |
| Security event log (IP addresses, user agents) | 180 days | deleted |
| Website inquiries that did not become a client | 2 years | anonymised |
| Finished applications (approved, rejected, cancelled, collected) - review for anonymisation | 7 years | reviewed, then deleted or anonymised unless the law requires us to keep it |
| Audit log, consent records, rights requests, breach register | 10 years | reviewed, then deleted or anonymised unless the law requires us to keep it |
| Invoices, payments, ledger, credit notes, refunds | 10 years | reviewed, then deleted or anonymised unless the law requires us to keep it |