Privacy Policy

1. Who we are

This policy is issued by the company that operates eSIMLab. It has no published registration yet, so this section names no company, no registration number and no registered office, and the policy is a draft until it does.

For data you enter about your own business, we are the controller. For the personal data of your customers, you are the controller and we act as your processor under the Data Processing Agreement.

Our data protection contact is the contact form, with "Legal and invoicing" as the reason. No data protection officer and no EU or UK representative has been appointed; if one is, this is where they will be named.

2. What we collect

Account data

Name, work email, company name, billing details, and the content you add to your workspace such as branding, storefront copy and pricing rules.

Storefront customer data

When a traveller buys from your storefront we process the data needed to sell and deliver an eSIM: name where provided, email address, order details, the plan purchased and delivery status. Card details are processed by Stripe and never reach us.

Usage and technical data

Log data, IP address, device and browser information. We do not run an analytics tool on this site today, so nothing records which pages you visited; if that changes it is asked for through the cookie banner first.

3. Why we process it

• To provide the platform, your workspace and your storefront, which is the performance of our contract with you.
• To take payment for your plan and to send invoices, which is a legal and contractual obligation.
• To keep the service secure, prevent abuse and investigate incidents, which is our legitimate interest.
• To send service messages you cannot opt out of, such as billing or incident notices.
• To send product updates by email, only where you have given consent, and which you can withdraw at any time.

4. Who we share it with

We share data with the subprocessors needed to run the service: hosting, payment processing, email delivery and certificate issuing. We do not publish a subprocessor list yet. The three the platform cannot run without are named here: Stripe, which processes card payments on your storefront; the eSIM provider you connect, which today is eSIM Access; and Cloudflare, which issues and serves the certificate for a domain you connect. Hosting, email delivery and backup storage are subprocessors too, and are named when the list is published.

We share order data with the eSIM provider you selected, because provisioning the plan requires it.

We do not sell personal data and we do not share it for advertising purposes.

We may disclose data where a law obliges us to, and we tell you unless we are legally prevented from doing so.

5. International transfers

The hosting region and the transfer mechanism for processing outside it are part of the legal review this draft is waiting on, and are stated here when that is done rather than guessed at now.

6. How long we keep it

Account data is kept while your account is open, and for a period after closure that is not yet set, unless a legal retention period requires longer.

Order records are kept to meet accounting and tax obligations, for the period the applicable law requires. The exact figure is set with the company record.

Retention periods for support messages and for logs are not set yet.

You can export your data before closing an account, and can ask us to delete data we are not legally required to keep.

7. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable form, and withdraw consent.

Send requests through the contact form. We answer within the period the law allows us, and may ask for information to confirm your identity.

If a traveller who bought from your storefront contacts us with such a request, we pass it to you, because you are the controller for that data.

You can also complain to the supervisory authority where you live. We cannot name the lead authority for this service until the operating company is registered.

8. Cookies

This site sets four cookies, all of them necessary for it to work, and no analytics or advertising cookies at all. They are listed one by one in the Cookie Policy, and preferences can be reopened at any time from the footer.

9. Security

We describe our technical and organisational measures on the Security page, including encryption in transit, access control, logging and backups. No system is perfectly secure, so we also describe what happens if an incident occurs.

10. Children

The platform is sold to businesses and is not directed at children. We do not knowingly collect data from children.

11. Changes to this policy

If we change this policy we update the date at the top and, where the change is significant, we tell account holders by email before it takes effect. Previous versions are available on request.