Privacy

Eurosimo LLC (in Georgian, შპს „ევროსიმო“), a limited liability company registered in Georgia, which runs this website and the Eurosimo app under the name Eurosimo. We decide why and how your data is used, which makes us the controller of your data under Georgia’s Law on Personal Data Protection and, where it applies to you, the EU General Data Protection Regulation (GDPR). Our registration details are on the Company details page. This policy covers the website eurosimo.com and the Eurosimo app for iPhone and Android. Both use the same account, and everything here applies to both unless a section says otherwise.

By email, at info@eurosimo.com. Say that your message is about your data, and include the email address you sign in with, so we know which account it concerns.

What we collect depends on what you do with us. Most of it you give us yourself. Your account: your email address and, if you add one, your name. The name is optional, and we use it only to show it back to you. If you sign in with Apple or Google, that company shares your email address with us and, where you let it, your name, with the identifier it uses for your account. Signing in: a one-time code we send to your email address, which stops working after ten minutes. We keep only a one-way code made from it. To stop anyone flooding the sign-in form, we also keep, for a day, one-way codes made from your email address and your IP address. Your orders: the plan you buy, its price and currency, when you paid, which versions of our terms of sale, our refund policy and the request to deliver straight away applied to the order, any promo code you used, and the order’s number. If the link that brought you to the checkout named a campaign, we note the campaign’s name with the order. Payments: our payment processor tells us whether a payment went through. Its message includes your card number with all but the first six and last four digits hidden, and any email address or phone number you typed on its payment page. Your full card details go to the payment processor, and never reach us. Saved cards: if you choose to save a card during checkout or add one from Saved cards, our payment processor gives us a reference to that card, which we keep encrypted, with the card’s brand and last four digits so you can recognise it. We never receive or keep the card number. We use the reference only when you choose that card to pay, and you can remove it in your account at any time. Your eSIMs: what our eSIM supplier tells us about each eSIM you buy, such as whether it is installed, whether its plan is running, when it ends and how much data it has used. If you make a private install link to install an eSIM on another phone, we keep when you made it and when it was opened, but never the link itself. Identity checks: we do not collect new check results while checks are disabled. Any records from earlier checks are described in “Identity checks”. Messages: what you write to us, and our replies. Notifications in the app: if you turn notifications on, a token that lets us send notifications to your phone, with your phone’s platform (iPhone or Android) and the app’s language. Optional emails: which of the optional emails described in “Why we are allowed to process it” we sent you and when, which order it was about, if any, the promo code we made for you, and, if you unsubscribe or turn them back on, that choice and when you made it. Technical data: when your browser or the app connects to us, our servers and our hosting providers receive your IP address and technical details such as your browser or the app’s version, and record them in server logs. The app also tells us its version with each request, so we can tell you when it needs an update. We do not keep it. Cookies and measurement, as “Cookies” explains. Website measurement starts only if you agree. In app versions with analytics, measurement is on by default after your saved preference is read, unless you previously turned it off. The measurement service receives the screens or pages you open, the destinations and plans you view and the plan you choose. It also learns when you start to sign in, whether you signed in to an account you already had or created a new one, and how you signed in: with a code by email, with Apple or with Google. From checkout it receives when a payment is opened and the way you chose to pay, whether a payment failed and the general reason (for example, a decline or the time running out), and each purchase, with its plan, price and currency. All of this comes with an identifier for your browser or app installation. It does not receive your name, email address, order number or card details. We do not ask for your phone number, postal address or date of birth, we do not track your location, and we never ask you for a password.

Most of it comes from you: what you type, choose and buy on the website or in the app. Some comes from your browser, your phone and the app when they connect to us: your IP address and technical details. Website measurement and advertising data is sent while you use the website, as “Cookies” explains. App measurement follows the setting described in “Changing your cookie choice”. The rest comes from companies you deal with through us: Apple or Google, if you sign in with them; our payment processor, about your payments; and our eSIM supplier, about your eSIMs.

To give you an account and sell you what you order. Your account, your sign-in, your orders, your payments, your eSIMs, and the emails and notifications about them, are needed to carry out the contract between us, or to take the steps you ask for before it. Without an email address you cannot sign in, and we cannot sell you an eSIM. If you sign in with Apple or Google, what that company shares with us is needed for the same reason: it is how you sign in. Because the law requires it. We keep order and payment records to meet our duties under Georgian tax and accounting law. We also answer requests from authorities where the law obliges us to. Because of our legitimate interests, where your interests and rights do not outweigh them. Keeping the website, the app and your account safe, for example by counting sign-in attempts and keeping server logs, is our legitimate interest. So is knowing how the shop is doing: we count visits to the website as daily totals that identify nobody, and note a campaign’s name with an order, to learn which pages are read and which links lead to purchases. So is answering your messages and dealing with complaints, disputes and legal claims. You can object to any of these, as “Your rights over your data” explains. Because of our legitimate interests, too, we measure how the website is used and how our advertising performs. Analytics and advertising services use cookies on the website to count visits, show our ads and count the purchases they lead to. You can object, as “Your rights over your data” explains, and block these cookies in your browser, as “Changing your cookie choice” explains. Because you agreed to it. The name on your account is optional: we keep it because you chose to give it, and you can remove it at any time. Because of our legitimate interest in selling our plans and learning what customers think of us, we send three kinds of optional email. An unfinished purchase. If you start paying for a plan while signed in and the payment isn’t completed, we may send you one email shortly afterwards with a promo code for a discount. The code works once, on any of our plans, only on your account, for 24 hours. We send it only if nothing was charged and you haven’t bought anything from us since, and at most once in 30 days. A review invitation. After you buy a plan from us, usually three days after its eSIM is first used, or three weeks after delivery if we don’t see it in use, we may send you one email inviting you to review Eurosimo on Trustpilot, at most once in 90 days. Every customer gets the same invitation, whatever their experience, and we offer nothing in return for a review. Occasional offers. If you have an account, we may send you an email with an offer on our eSIMs, such as a promo code, at most once a month. These emails use your email address, your name if you added one, and the plan and order they are about, if any. Each has a link to unsubscribe in one click, and you can also write to us. Unsubscribing stops all of them at once. Emails about your account, your orders and your eSIMs still come, because we need them to carry out our contract with you. We send no other marketing email.

Your account, your orders and our payment records are kept in our database. When you place an order, we keep your email address with that order. We share your data only with the companies that help us run the shop, and give each only what it needs for its part: Hosting and database providers, which run the website, the app’s server and our database, and so receive the technical details of each connection, such as your IP address. Our payment processor, which takes your payment on its own payment page or payment form and tells us the result. Our eSIM supplier, which issues your eSIM. It receives our reference for the order and the plan you chose, and nothing that identifies you, and tells us how your eSIM is used. Email delivery services, which send your sign-in codes, the emails about your orders and the optional emails described in “Why we are allowed to process it”, and so receive your email address and those messages. Push-notification delivery services, including the notification service of your phone’s operating system, which receive the notification token and each notification, only if you turn notifications on in the app. Analytics and measurement services, and advertising services, receive the website’s usage events, including checkouts and payments with their amount, and set their own cookies on it, as “Cookies” explains. The events we send them do not include your name, email address or order number. The app’s measurement has its own setting, described in “Changing your cookie choice”. Customer support tools, such as the service that hosts our mailbox, which keep the messages you send us and our replies. These companies process your data for us, as our processors, on our instructions and under contracts that require them to protect it. Apple or Google, if you sign in with them, and our payment processor, for the card details you type on its page, also handle your data under their own privacy notices. Trustpilot, the independent review site our review invitation links to, receives nothing from us. If you follow the link, you deal with Trustpilot directly, under its own privacy notice. We do not sell your data. We give it to anyone else only where the law requires it, for example to a tax authority or a court on a lawful request, or where it is needed to establish or defend a legal claim. If our business, or part of it, is ever sold or reorganised, your data may pass to the new owner, who must keep to this policy.

Your account, your orders and our payment records are stored in the European Union, in Germany. Germany is on the list of countries that Georgian data protection rules recognise as protecting personal data adequately. Some of the companies in “Where it is stored, and who else can see it” may process data in other countries, for example where a hosting provider’s network receives a connection at a data centre near you, or where a service provider’s staff work. When your data goes to a country that is not recognised as protecting it adequately, we rely on appropriate safeguards the law allows, such as standard contractual clauses approved for this purpose, or, where none applies, on an exception the law provides, such as your consent. You can ask us about these safeguards, as “How to contact us about your data” explains.

We keep your data only as long as we need it for the purpose we collected it for, or as long as the law requires. Your account: until you close it. You can close your account at any time. We then delete your account and your name, and keep only the order and payment records the law requires us to keep. Orders and payments: we keep order and payment records, with the email address each order was placed with, for at least three years after the end of the year in which the order was placed, because Georgian tax law requires it. When your account is closed, we remove your email address from any order that never took money, and the campaign names noted with your orders. Saved cards: until you remove the card, the reference stops working, or you close your account. Closing your account removes every saved card first. Sign-in: the one-way codes we use to count sign-in attempts are kept for a day. Private install links: the record of each one is kept with your account, and deleted with it. Earlier identity-check records: as “Identity checks” explains. Notifications: the token is kept until you turn notifications off, sign out of the app or close your account. Optional emails: the record of each one we send, and the promo code made for you, are kept as long as the order they are about, or, for an offer about no order, as long as your account exists. If you unsubscribe, we keep that choice for as long as your account exists, so that we keep to it. Messages to us: as long as we need them to deal with what you wrote about. Server logs: for a short time, to keep the service safe and to find faults, and then our hosting providers delete them. Measurement: what the measurement service receives visit by visit is kept for no more than two months. After that only totals made from it, which identify nobody, remain. Our own daily totals of visits identify nobody, and we keep them. Cookies: as “Cookies” explains.

This is our cookie policy. It covers the website and the app. Cookies are small files a website asks your browser to keep and send back on your next visit. Browsers and apps can also keep information in similar storage on your device, such as a browser’s local storage or an app’s storage on your phone. Here, we call all of these cookies. We use three kinds. Strictly necessary cookies. The website and the app cannot work without them, so they do not need your consent. They keep you signed in and keep signing in safe, protect account actions such as closing your account, and remember your language and currency. In the app, the same kind of storage on your phone keeps you signed in, remembers your language and your recent searches, and keeps the notification token if you turn notifications on. Analytics and measurement cookies on the website. They tell us which pages and plans are viewed, how often signing in is started and whether it creates a new account, which checkouts end in a purchase and which payments fail, so we can improve the website. The events we send never include your name, email address or order number. App measurement uses its own setting, described below. Advertising cookies on the website. Advertising services use cookies to show our ads and to count the visits and purchases our ads lead to. Analytics and advertising cookies are set when you visit the website; we do not ask first. You can block or delete them in your browser, as “Changing your cookie choice” explains. We also count visits to the website ourselves, as daily totals that identify nobody, and we do that without any cookie.

On the website, analytics and advertising cookies are set when you visit, without a question first. To stop them, block or delete them in your browser, or use the opt-outs those services offer. In app versions with analytics, measurement is enabled by default after your saved preference is read. There is no first-launch analytics question. You can switch it off under Profile → Analytics → Share usage statistics. Switching it off stops collection and resets the app’s measurement identifier. Your choice is saved on that phone and does not expire. If the saved preference cannot be read, measurement stays off. The app setting and your website cookie choice are separate. Your browser also lets you see and delete cookies, and block some or all of them. How depends on the browser, and its help pages explain it. If you block the strictly necessary cookies, parts of the website, such as signing in and checkout, will not work. Deleting the app deletes what it keeps on your phone.

The app uses the same account as the website, and this whole policy applies to it. A few things work differently on a phone. Notifications: the app sends you notifications only if you turn them on, for example about your orders and your eSIMs. It then registers your phone’s notification token with your account. You can turn them off in the app or in your phone’s settings, and signing out removes the token. Permissions: the app asks for no permission other than notifications. It does not use your location, camera, microphone, contacts or photos. Payments: you pay on our payment processor’s payment form in the app, or on its payment page, and your card details never reach us. On your phone: the app keeps your sign-in in your phone’s secure storage, and your language and recent searches on the phone. Your recent searches are never sent to us. Measurement: when analytics is included in your version, it follows the app setting described in “Changing your cookie choice”. The app shares screen, destination and plan events, sign-in events with the way you signed in and whether a new account was created, and checkout, payment and purchase events, including a failed payment and its general reason, without your name, email address or order number. It does not collect an advertising identifier or use measurement for advertising. Closing your account: you can close your account in the app, under Profile, as on the website.

Identity checks are currently disabled. We do not ask you to show an identity document or your face to buy a plan on our website or in the app. We do not send new identity-check requests to our verification provider. Any records from earlier checks contain only the result, the provider’s reference, the destination and rule, and the times when the check was opened and decided. We do not hold identity documents or face images. An earlier check linked to an order is kept with that order for as long as its records are kept. An earlier check not linked to an order is deleted once 90 days have passed since it last changed. If identity checks are enabled again, we will update this policy before asking you to complete one.

Under Georgian law and, where it applies to you, the GDPR, you can ask us what data we hold about you and how we use it, and for a copy of it. You can ask us to correct data that is wrong or incomplete, and to delete your data, unless the law requires us to keep it. You can ask us to restrict how we use it, or to block it while we look at a request or a complaint, so that nobody uses it in the meantime. Where the law gives you that right, you can ask for the data you gave us in a form you can take elsewhere. You can object to our using your data for our legitimate interests, and you can stop our optional emails at any time with the unsubscribe link in any of them. And you can withdraw any consent you gave at any time. You can change your name, and close your account, from your profile on the website or in the app. If closing your account is not offered there, write to us and we will close it. For anything else, write to us as “How to contact us about your data” explains. Asking is free. We answer within 10 working days, or within 3 working days if you ask us to block data. We may ask you to confirm that the account is yours. If you think we have not respected your rights, you can complain to the State Audit Office of Georgia, which supervises data protection (sao@sao.ge, +995 32 243 81 81), or go to court. If the GDPR applies to our use of your data, you can also complain to the data protection authority in the EU or EEA country where you live or work, or where you think the law was broken.

The website and the app are not meant for children under 16, and we do not knowingly collect data about them. If you think a child under 16 has given us their data, write to us and we will delete it, unless the law requires us to keep it.

We use technical and organisational measures to protect your data against loss, misuse and access by anyone who should not have it. Connections to the website, the app and our service providers are encrypted. Only the people and services that need your data can reach it. We keep one-way codes in place of sign-in codes and private install links, and your card details never reach us. No system can be made completely safe. If something goes wrong, we act as the next section says.

If your data is lost, stolen, or seen by someone who should not see it, we report it to the State Audit Office of Georgia within 72 hours of finding out, unless it is unlikely to cause any real harm, and to any other authority the law requires. If it is likely to cause you serious harm, we also tell you directly, without delay, what happened.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you, and we do not build a profile of you. The optional emails described in “Why we are allowed to process it” follow the same fixed rules for everyone, such as an unfinished payment, a completed order or an offer sent to every customer. They do not rely on a profile of you, and they have no legal or similarly significant effect on you.

We change this policy when what we do with your data changes, or when the law does. The date at the top says when it last changed. If a change affects how we use your data, we tell you by email or in the app before it takes effect.