Data Processing Agreement

1. Parties and scope

This agreement is between you, the account holder, as controller, and the company that operates eSIMLab, as processor. That company has no published registration yet, so it is not named here; this draft is not in force until it is. It applies whenever we process personal data on your behalf in connection with the platform.

Where data protection law applies to you, this agreement is intended to meet the requirements placed on a processor, including Article 28 of the GDPR and its UK equivalent.

2. Roles

You are the controller of your customers personal data. You decide what is collected, why, and for how long, and you are responsible for having a lawful basis and for your own privacy notice.

We are the processor and act only on your documented instructions, which include the instructions given through the platform itself.

For our own account and billing data we are the controller, and the Privacy Policy applies.

3. Subject matter, duration, nature and purpose

Subject matter: the provision of the eSIMLab platform.

Duration: for as long as your account is open, plus the retention periods described below.

Nature and purpose: hosting your storefront, taking orders, ordering eSIMs from your chosen provider, delivering them, and keeping order and customer records for you.

4. Categories of data and data subjects

Data subjects: your customers, and the members of your team you invite into the workspace.

Categories: name where provided, email address, order and payment references, the plan purchased, eSIM activation identifiers, language and currency, and technical data such as IP address.

We do not require special categories of data, and you must not use the platform to process them.

5. Our obligations

• Process personal data only on your instructions, and tell you if an instruction appears to breach data protection law.
• Ensure people authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures described in Annex II and on our Security page.
• Assist you, taking into account the nature of processing, with data subject requests, impact assessments and consultations with regulators.
• Make available the information needed to demonstrate compliance with this agreement.

6. Subprocessors

You give general authorisation for us to engage subprocessors. We do not publish a subprocessor list yet. The three the platform cannot run without are named here: Stripe, which processes card payments on your storefront; the eSIM provider you connect, which today is eSIM Access; and Cloudflare, which issues and serves the certificate for a domain you connect. Hosting, email delivery and backup storage are subprocessors too, and are named when the list is published.

We give notice before adding or replacing a subprocessor, over a period that is not yet set, and you may object on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected service.

We impose data protection obligations on each subprocessor that are no less protective than those in this agreement, and remain responsible for their performance.

7. Security

We implement the measures set out in Annex II, which include encryption in transit, access control with roles, logging of administrative actions, backups, and separation of environments.

We review these measures periodically and may update them, provided the level of protection is not reduced.

8. Data subject requests

If a data subject contacts us directly about data we process for you, we will not respond to the substance ourselves. We pass the request to you promptly and help you answer it.

9. Personal data breaches

We notify you without undue delay of becoming aware of a personal data breach affecting the data we process for you. The outer limit that Article 33 expects a processor agreement to state is not yet set in this draft.

The notification describes what happened, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed.

10. Return and deletion

On termination you may export your data for a period that is not yet set. After that we delete or anonymise it, except where a law requires us to keep it, in which case we keep it only for that purpose and for that period.

11. Audits

We provide the information necessary to demonstrate compliance, including our security documentation and any third party reports we hold. Where that is not sufficient, you may audit us, at reasonable notice, at a frequency that is not yet set unless a regulator or a breach requires otherwise, at your cost, and subject to confidentiality.

12. International transfers

The hosting region and the transfer mechanism for processing outside it are part of the review this document is waiting on. Neither is stated here, and neither is incorporated into this draft, because a transfer mechanism named on a web page and never executed protects nobody.

13. Annexes

Annex I lists the parties, the processing details and the categories of data.

Annex II sets out the technical and organisational measures.

Annex III lists the approved subprocessors.

None of the three annexes is written yet. They are drafted with counsel alongside the rest of this document, and the agreement is not in force without them.