This policy describes how we process your personal data when you use the eSIM Surfer mobile app, the esimsurfer.app website or our customer support. We process data in accordance with the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian law, in particular the 2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról (Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, "Infotv.").

1. The controller

We are not required to appoint a data protection officer (Art. 37 GDPR), and therefore we have not appointed one. You can contact us directly with data protection questions at the e-mail address above.

2. Legal bases for processing

• Performance of a contract (Art. 6(1)(b) GDPR): processing necessary to provide your account, your eSIMs and the services you order.
• Legal obligation (Art. 6(1)(c) GDPR): for example, issuing and retaining invoices.
• Legitimate interest (Art. 6(1)(f) GDPR): the security of the service, the prevention of abuse, the detection of errors and the development of the service. You may object at any time to processing based on legitimate interest (see section 8).
• Consent (Art. 6(1)(a) GDPR): for example, marketing notifications and the advertising measurement cookies on the website. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

3. What data we process, for what purposes and for how long

3.1. Account and sign-in

Your Google profile picture is displayed only on your device; we do not upload it to our servers.

3.2. Purchase, payment and invoicing

Card details are processed by Stripe; we never see or store the full card number. With Apple Pay and Google Pay, Stripe also receives your name and billing address. Invoices are issued in the Billingo system, which, as required by law, reports data to the Nemzeti Adó- és Vámhivatal (NAV, the Hungarian National Tax and Customs Administration).

3.3. eSIMs

If you provide someone else's e-mail address (eSIM sharing, travel companion), you are responsible for making sure you are entitled to do so.

3.4. Balance, refunds, referral and promo codes

3.5. Trips and location data

You can turn off location services at any time in your device settings; the app does not request location data in the background.

3.6. Booking travel services

If you book an airport lounge, accommodation or a flight in the app (where available), we transfer the data needed for the booking (name, contact details and, for flights, additionally your gender, date of birth, nationality and travel document details) to the partner fulfilling the booking. Legal basis: contract. The travel document number is stored encrypted and deleted after the trip; the other booking data are kept until the account is deleted, and the invoice for 8 years.

3.7. Notifications and e-mails

We send service notifications (for example about purchases, eSIM status, expiry, data allowance) to perform the contract. We send offers and promotions only if you have consented to this in the app; you can turn this off at any time in the settings.

3.8. Customer support

The in-app chat runs on the Crisp service. If you are signed in, the chat receives your user ID, e-mail address, name, the app version, the platform and the screen currently open, so that we can help you faster. We keep the content of conversations for 2 years from the closing of the request. If you choose the WhatsApp channel, messaging is handled by Meta under its own terms; you can also reach us by e-mail at support@esimsurfer.app. Legal basis: contract and legitimate interest.

3.9. Security and abuse prevention

3.10. App analytics and debugging

To develop the app and detect errors we use the PostHog service, with data stored in the EU (Frankfurt). PostHog receives events (for example screens, button taps, purchase steps), device and system data, your user ID and e-mail address, and screen recordings of how the app is used. The content of input fields is hidden in the recordings. We receive error reports about crashes (Sentry, Expo), which by default contain no personal data. On Android devices, on first launch we record which campaign (for example a blog article) the installation came from. Legal basis: legitimate interest (operating and developing the service); you can object to this at any time at support@esimsurfer.app. Retention: event data for up to 2 years, screen recordings for up to 90 days.

3.11. Website

• Hosting: the website is provided by Vercel. To serve requests, the server processes your IP address and browser data briefly, as logs.
• Visitor measurement: Vercel Analytics measures visits in aggregate, without cookies and without storing IP addresses (page, referring page, country, device type); after 24 hours the data are kept only in aggregate.
• App store redirect: if you open the App Store or Google Play through the /get page, we record the browser data, the referring page and the campaign name, with a new random identifier for each visit (without cookies). On Android devices, Google Play also receives the campaign name.
• Advertising measurement (Google Ads): we measure whether a visitor who clicks one of our ads opens the app store page. Google (Google Ireland Ltd.) places a cookie only if you consent in the banner shown at the bottom of the page; if you decline, Google receives only an aggregated signal without cookies. Legal basis: consent.
• Data stored in your browser: we store your consent choice (localStorage) and, for the duration of the visit, the campaign name and the promo code (sessionStorage) in your browser.
• Embedded content: some pages may display content from third parties, whose provider receives your IP address when it loads.

You can change or withdraw your advertising measurement consent here at any time:

4. Processors and recipients

Processors process data on our instructions, under a contract.

The following receive data as independent controllers: Google (Google sign-in, Android push notifications, maps on Android and, with your consent, Google Ads), Apple (Apple sign-in, iOS push notifications), Meta (if you choose the WhatsApp channel) and the Nemzeti Adó- és Vámhivatal (Hungarian National Tax and Customs Administration; invoice data).

* On the basis of the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCC).

** On the basis of the European Commission's Standard Contractual Clauses (SCC).

5. Transfers outside the EU

We store your data primarily in the European Union. Where data are transferred outside the EU (for example to the USA or Singapore), we do so on the basis of an adequacy decision (for example the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses (SCC) approved by the European Commission.

6. Deleting your account

You can request deletion of your account in the app (Profile → Settings) or by e-mail. You can withdraw the request within 30 days; after that, the account and its associated data are permanently deleted. As long as an active eSIM, or one waiting to be installed, belongs to the account, we postpone deletion so that you do not lose the service you purchased. The following are kept even after deletion:

• invoices and accounting records for 8 years (legal obligation, Billingo and NAV);
• a record of the fact of deletion (e-mail address, name, time) for 5 years (section 3.9);
• payment data retained by Stripe under its own legal obligations.

What happens to any unused balance is governed by the Terms and Conditions.

7. Children

The service is not intended for persons under 16, and we do not knowingly process the data of children under 16. If we become aware that we are processing such data without the consent of a parent or legal guardian, we delete it without delay. If you are a parent and notice this, please write to support@esimsurfer.app.

8. Your rights

• Access (Art. 15 GDPR): you can ask for information about what data of yours we process, and request a copy of it.
• Rectification (Art. 16): you can ask us to correct inaccurate data and to complete incomplete data.
• Erasure (Art. 17): you can ask us to delete your data (see section 6).
• Restriction (Art. 18): you can ask us to restrict processing, for example if you contest the accuracy of the data.
• Data portability (Art. 20): you can ask us to provide the data you gave us in a machine-readable format to you or to another controller.
• Objection (Art. 21): you can object to processing based on legitimate interest; to direct marketing without giving reasons.
• Withdrawal of consent: at any time, without giving reasons; this does not affect the lawfulness of earlier processing.

You can submit your request in the app or at support@esimsurfer.app. We reply without undue delay and in any event within one month; where justified, this period may be extended by up to two further months, in which case we will inform you within one month (Art. 12(3) GDPR).

9. Automated decision-making

We do not take decisions concerning you based solely on automated processing, nor do we carry out profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

10. Data security

• Encrypted data transmission (HTTPS/TLS)
• Sign-in links and tokens stored only in hashed form
• Encrypted storage of travel document details
• Access control, logging and regular backups
• Data stored in an EU data centre (Frankfurt)

11. Remedies

If you feel that we have infringed your data protection rights, please write to us first at support@esimsurfer.app. You may also lodge a complaint with a supervisory authority:

• Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian National Authority for Data Protection and Freedom of Information), 1055 Budapest, Falk Miksa utca 9–11., phone: +36 1 391 1400, e-mail: ugyfelszolgalat@naih.hu, https://naih.hu
• or the data protection authority of the EU/EEA member state where you live or work, or where the infringement took place (Art. 77 GDPR).

If your rights are infringed, you may also go to court; proceedings may also be brought before the regional court (törvényszék) of your place of residence or stay.

12. Changes to this policy

We may amend this policy when the service or the law changes. We will notify you in advance of material changes in the app or by e-mail. This policy is available in several languages; in case of any discrepancy, the Hungarian version prevails.

Contact

Derecskei Miklós egyéni vállalkozó (sole proprietor), 1039 Budapest, Jendrassik György utca 2., Hungary. E-mail: support@esimsurfer.app