This policy explains what personal data we collect when you visit europesim.eu or buy an eSIM, how we use and protect it, how we measure the site and what you can ask of us. We are a Polish company, so we handle personal data under the EU General Data Protection Regulation (GDPR). Section 9 also sets out the rights you have under the data protection laws of the United Kingdom and Switzerland.
1. Who we are
europesim.eu is operated by LuKas Holdings sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warsaw, Poland, KRS 0001233010, NIP 7011306806 (“EuropeSIM”, “we”, “us”). We are the controller of the personal data described here.
For every question, request or complaint about personal data, write to contact@europesim.eu.
2. What we collect
When you visit europesim.eu
- Your browser sends technical data with every request: IP address, browser and device type, the page requested and the referring page. Our content delivery network, Cloudflare, uses it to deliver pages and to protect the site from attacks.
When you browse the site
- The pages you view, the referring site and campaign parameters, your browser and device type and an approximate location derived from your IP address. We measure this with Umami, which we run on our own server: no analytics company receives it, Umami does not store your IP address and we keep no visitor profile. The site sets no cookie and stores nothing on your device for this. If your browser sends the Global Privacy Control signal, we do not measure your visit at all.
When you buy an eSIM
- The details you enter on the Stripe payment page: email address, name on the card, billing country and, for some cards, postal code. Card numbers are handled by Stripe and never reach us.
- Order data: the plan, price, currency, language, time of purchase, the version of the Terms of sale you accepted, and the eSIM delivered to you (its ICCID and activation code, which we store encrypted).
- Where the order came from: the campaign parameters of the link that brought you (for example utm_source), the referring site and the pages you visited before buying. We keep these with the order to know which channels bring customers.
- When your order page is opened, we record the time and a one-way hash of the IP address, to protect your eSIM code against misuse.
- When you start a checkout, your IP address is used in memory to limit repeated attempts. It is not stored.
When you write to us
- Your email address, name and the content of your message.
3. Why we use it and on what legal basis
| Purpose | Legal basis under the GDPR |
|---|---|
| Selling and delivering the eSIM, support and refunds | Performance of the contract with you (Article 6(1)(b)) |
| Accounting and tax records | Our legal obligations (Article 6(1)(c)) |
| Preventing fraud, securing payments and eSIM codes, protecting the site | Our legitimate interest in a secure shop (Article 6(1)(f)) |
| Answering your questions and partnership enquiries | Our legitimate interest in answering you, or steps before a contract you ask for (Article 6(1)(f) or (b)) |
| Measuring how the website is used, and which pages and channels bring visitors and customers | Our legitimate interest in understanding and improving our own website, with no cookie and no visitor profile (Article 6(1)(f)); you can object to it at any time, and a Global Privacy Control signal stops it at once |
We use personal data only for these purposes. We do not send marketing messages and we do not sell personal data.
4. Automated decisions
Stripe screens payments for fraud with automated risk scoring. A payment judged high risk may be blocked or may need extra verification such as 3D Secure. If you think a payment was blocked by mistake, write to us and a person will review it.
5. Who receives your data
- Stripe processes payments and screens them for fraud, under its privacy policy at stripe.com/privacy.
- Cloudflare, Inc. delivers and protects the website.
- Our hosting company runs the servers in the European Union that host the website, the order database and our Umami, and a standby server in Singapore.
- The company that sends our emails delivers the email with the link to your order page.
- Our eSIM distributor receives no personal data from us. We buy eSIM profiles without sending your details.
- Our accountants and legal advisers, and public authorities where the law requires it.
6. Transfers outside the European Economic Area
The website, the order database and our analytics are hosted on servers in the European Union, with a standby server in Singapore. Stripe, Cloudflare and the company that sends our emails may process data in the United States and other countries. When personal data leaves the European Economic Area, we rely on the safeguards the GDPR provides: the European Commission’s standard contractual clauses, or its adequacy decision for companies certified under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.
7. How long we keep it
We keep personal data only as long as we need it for the purposes above or as the law requires:
- Order and payment records, including the encrypted eSIM details: as long as accounting and tax law requires, normally 5 years from the end of the year of purchase.
- Order page access records (hashed IP address): 12 months.
- Email correspondence: as long as needed to handle the matter and related claims, and no longer than 3 years after it is closed.
- Analytics data: no longer than 14 months.
- The visit numbers stored with an order (the anonymous visitor and visit number, IP address and browser captured at checkout): 90 days.
8. Cookies
europesim.eu sets no cookies of its own, and it stores nothing on your device. There is no cookie banner, because there is nothing to ask you about: no cookie, no local storage and no device fingerprint.
We do measure how the site is used, and we do it without cookies. Every measured page sends one short, anonymous message to our own server, which passes the counts to Umami on our own infrastructure:
- the page you view, the referring site and any campaign parameters in the link, the plans you look at and the moment you start a checkout;
- your browser and device type and an approximate location derived from your IP address;
- a visitor number and a visit number, both computed on our server from your IP address and browser name together with a secret salt, and rotated every month. They are numbers only, they are never written to your device, they are not linked to your name, your email or your order, and we build no profile of you. Nobody outside our hosting infrastructure sees them.
Cloudflare, which delivers the site, sees the requests it serves, and our servers keep ordinary access logs; both are covered by our hosting agreement and the sections above.
Two other things may put a cookie on your device, and neither is ours:
- Cloudflare may set strictly necessary security cookies to tell people from automated traffic.
- The Stripe payment page, which is served by Stripe, uses its own cookies for payment processing and fraud prevention; see stripe.com/legal/cookies-policy.
You can delete or block cookies in your browser settings; blocking Stripe’s cookies may prevent payment.
9. Your rights
Under the GDPR you can ask us:
- for access to the personal data we hold about you and a copy of it;
- to correct data that is wrong or incomplete;
- to delete data we no longer need or have no basis to keep;
- to restrict how we use your data while a question about it is settled;
- for the data you gave us in a portable format;
- to stop using data we process on the basis of our legitimate interests (you can object);
- and you can withdraw a consent at any time, without affecting what was done before.
Write to contact@europesim.eu. We reply within one month, or tell you within that time why we need longer.
You can complain to the President of the Personal Data Protection Office in Poland (UODO, uodo.gov.pl), or to the data protection authority of the EU country where you live or work.
If you are in the United Kingdom, you also have the rights that the UK GDPR and the Data Protection Act 2018 give you, and you can complain to the Information Commissioner’s Office (ICO, ico.org.uk).
If you are in Switzerland, you also have the rights that the Federal Act on Data Protection (FADP) gives you, and you can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
You can use all of these rights the same way, by writing to us.
10. Security
Card data stays with Stripe. eSIM activation codes are encrypted at rest with AES-256-GCM. Access to the order system is restricted, and every time an eSIM code is shown to an administrator it is logged. The site is served only over HTTPS. If a data breach is likely to put your rights at risk, we notify the supervisory authority within 72 hours and, where the risk is high, you as well, as the GDPR requires.
11. Children
europesim.eu is not aimed at children under 16, and we do not knowingly collect their data.
12. Changes
When our processing changes, we update this policy and the date at the top of this page.