Privacy policy

0. Provisional document — legal review pending

This document has not yet been reviewed or approved by a lawyer. It is published so that the service can be tested.

Legal review by an Austrian legal adviser will take place before the service opens to the public.

The protection of your personal data matters to us. In this privacy policy we inform you which personal data we process when you use our website, buy an eSIM, make a purchase in our store or contact our customer support.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Eljhat Kadrii e.U., trading as HAUS DES HANDYS, Hernalser Hauptstraße 135, 1170 Wien, Austria.

Firmenbuchnummer (company register number): FN 628945w, Handelsgericht Wien. UID number: ATU81376119.

Data protection and support enquiries: contact@esimple.at.

2. What data we process

Depending on how you use our services, we may in particular process the following personal data:

Contact data:

• first and last name;
• email address;
• telephone number;
• billing address;
• where applicable, company details.

Order and contract data:

• order number;
• eSIM plan purchased;
• price;
• currency;
• date of purchase;
• destination country or plan region;
• payment status;
• invoicing information.

eSIM and technical data. Insofar as necessary for provision of the service or for support, the following may in particular be processed:

• the eSIM/ICCID reference;
• activation status;
• installation status;
• plan status;
• start and end of the plan’s validity;
• data volume used or remaining;
• assigned technical network identifiers;
• mobile network or roaming partner;
• technical error and diagnostic data.

Device and connection data. When you visit our website or in support cases, the following may in particular be processed:

• IP address;
• browser type;
• operating system;
• device type;
• date and time of access;
• technical log data;
• where applicable, language settings and cookie preferences.

Payment data. Payments may be processed by external payment service providers. In that case we generally receive only the information necessary to allocate and process the payment, for example:

• payment status;
• transaction reference;
• payment method;
• where applicable, the last digits of a means of payment.

Complete credit card information is as a rule processed directly by the payment service provider used, insofar as the technical payment processing is set up accordingly.

Support data. When you contact our customer support, we may in particular process:

• your contact details;
• your order number;
• the content of your enquiry;
• technical information;
• screenshots or files you send us;
• previous correspondence with our support.

Identity data. Where identity verification is required by law or by mandatory requirements of the telecommunications or eSIM partner concerned, identification data may additionally be processed.

In such cases we will inform you which data is specifically required.

3. Purposes of processing

We process personal data in particular for the following purposes:

• handling and processing orders;
• providing and activating eSIM products;
• managing data packages;
• processing payments;
• issuing invoices;
• customer support;
• fault analysis and technical assistance;
• preventing misuse and fraud;
• ensuring the security of our systems;
• complying with tax, commercial and other legal obligations;
• handling refunds and complaints;
• improving our services;
• marketing, where an appropriate legal basis or consent exists.

4. Legal bases

Depending on the nature of the processing, we rely in particular on the following legal bases:

Performance of a contract – Article 6(1)(b) GDPR. We process personal data where this is necessary in order to:

• conclude a contract with you;
• process your order;
• provide your eSIM;
• allocate payments;
• provide support in connection with your contract.

Legal obligation – Article 6(1)(c) GDPR. Certain data must be processed or retained on the basis of legal obligations, in particular for:

• accounting;
• tax law;
• financial reporting;
• legally required records.

Legitimate interests – Article 6(1)(f) GDPR. Insofar as the law permits, we process personal data on the basis of our legitimate interests, in particular for:

• IT and network security;
• prevention of misuse and fraud;
• asserting and defending legal claims;
• improving the technical stability of our services;
• internal business organisation.

In doing so, we always take into account the rights and interests of the data subjects.

Consent – Article 6(1)(a) GDPR. Where processing requires your consent, for example for certain marketing activities or for analytics or advertising cookies, the processing takes place only after your consent has been given.

Consent once given may be withdrawn at any time with effect for the future.

5. eSIM, mobile and roaming partners

In order to provide our eSIM services, certain technical and contract-related data must be passed on to companies involved in providing the mobile connection.

These may include:

• eSIM platform providers;
• mobile network operators;
• international roaming partners;
• telecommunications providers;
• technical platform operators.

Data is transferred only to the extent necessary to provide, manage and troubleshoot the eSIM concerned, or where another legal basis applies.

Some of these companies may process personal data for certain processing operations under their own data protection responsibility.

6. Payment service providers

For the purpose of processing payments, personal data may be transmitted to the payment service provider selected during the ordering process.

The payment service provider processes in particular the data necessary to authorise and carry out the payment.

For certain processing operations, the payment service provider may be a controller in its own right within the meaning of the GDPR.

The payment methods offered in each case are displayed during the ordering process.

7. Hosting and technical service providers

To provide our website, the online shop and our eSIM platform, we may use external technical service providers.

These may in particular provide services in the following areas:

• web hosting;
• cloud infrastructure;
• databases;
• sending email;
• IT security;
• monitoring;
• customer support;
• fault analysis.

Insofar as these companies process data exclusively on our behalf, they are engaged as processors in accordance with the requirements of the GDPR.

8. Disclosure of data

Personal data may – where necessary – be transmitted in particular to the following categories of recipient:

• eSIM and telecommunications partners;
• mobile network operators;
• payment service providers;
• hosting and cloud providers;
• email and communication service providers;
• IT support and security service providers;
• tax advisers and accounting;
• banks;
• authorities and courts, where required by law.

Personal data is not sold without a legal basis.

9. Transfers of data to third countries

For international eSIM services, service providers or mobile partners outside the European Economic Area may be involved.

Where personal data is transferred to a country outside the European Economic Area and no adequacy decision of the European Commission exists, appropriate safeguards under the GDPR are used where necessary, for example the European Commission’s standard contractual clauses.

In certain cases, transfers may additionally take place on another basis permitted under Chapter V of the GDPR.

10. Retention period

We retain personal data only for as long as is necessary for the relevant purpose or as long as statutory retention obligations require.

Contract, invoicing and accounting data is in particular retained in accordance with the applicable Austrian statutory retention periods.

Where a statutory retention obligation of seven years applies, the documents concerned are as a rule retained for that period.

Technical log and security data is as a rule retained only for as long as is necessary for security, fault analysis and evidentiary purposes.

Support correspondence may be retained for as long as is necessary to handle the support case and any subsequent legal claims.

Data processed solely on the basis of consent is deleted once that consent is withdrawn, unless another legal basis justifies its further processing.

11. Cookies and similar technologies

Our website may use cookies and comparable technologies.

Technically necessary cookies. Cookies that are strictly necessary for our website or online shop to function may be used without additional consent. These may include, for example:

• the shopping basket;
• login status;
• security functions;
• session management;
• cookie settings.

Analytics, marketing and other non-necessary cookies. Cookies that are not technically necessary, and comparable tracking technologies, are as a rule used only after the user has given the required consent.

Consent may be changed or withdrawn at any time via the cookie settings.

Further information about the cookies actually used, their providers, purposes and retention periods is provided in the cookie banner or in the cookie settings.

12. Newsletter and marketing

If you sign up for our newsletter or other electronic marketing communications, we process the contact data required for that purpose on the basis of your consent or another legally permitted basis.

You may withdraw your consent at any time with effect for the future.

Every marketing email contains, where required, a means of unsubscribing.

Service and transaction messages necessary for an order or an active eSIM are not marketing messages.

13. Security

We take appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss;
• alteration;
• disclosure;
• destruction;
• misuse.

These may include, among others, encryption, access controls, logging, data backups and security monitoring.

14. Your rights

Subject to the statutory conditions, you have in particular the following rights:

Right of access. You may request information as to whether, and which, personal data we process about you.

Right to rectification. You may request the rectification of inaccurate or incomplete data.

Right to erasure. You may, under the statutory conditions, request the erasure of your personal data.

Right to restriction of processing. You may, under certain conditions, request the restriction of processing.

Right to data portability. Where the statutory conditions are met, you may receive personal data in a structured, commonly used and machine-readable format.

Right to object. For processing based on legitimate interests, you may, under the statutory conditions, object to the processing.

Withdrawal of consent. You may withdraw consent once given at any time with effect for the future.

The lawfulness of processing carried out up to the withdrawal remains unaffected.

15. Exercising your data protection rights

To exercise your rights you may contact us at: contact@esimple.at.

We may request additional information where this is necessary to verify your identity and to protect your data against unauthorised access.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

In Austria this is in particular: Österreichische Datenschutzbehörde.

Irrespective of this, you may at any time contact us first at contact@esimple.at.

17. Automated decisions

If we take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you, we will inform you separately in accordance with the statutory requirements.

18. External links

Our website may contain links to websites of external providers.

Responsibility for the processing of personal data on external websites lies as a rule with their respective operators.

19. Amendments to this privacy policy

We may adapt this privacy policy where our services, our technical systems or the legal requirements change.

The version in force is published on our website.

In the event of material changes we will, where necessary, additionally provide appropriate notice.

20. Contact

For any questions about data protection or the processing of your personal data:

HAUS DES HANDYS – Eljhat Kadrii e.U., Hernalser Hauptstraße 135, 1170 Wien, Austria.

Email: contact@esimple.at.