Privacy Policy

1. General

This Policy describes how personal data of esimprom.online users is processed. It is drawn up to meet the requirements of Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

The data controller is the entity identified in the requisites section below.

Using the site constitutes agreement with this Policy.

2. Data processed

— The e-mail address supplied at checkout — the only mandatory identifier of a customer.

— Order data: selected package, destination, price, date, order and payment status.

— Technical connection data: IP address, device type and language, browser headers.

— Issued eSIM identifiers: profile ICCID and data usage, received from the operator to display in the account.

— Support enquiries and the address they were sent from.

The controller does NOT process or store payment card details: these are handled by the payment provider on its own side.

No special or biometric categories of data are processed, and no profiling with legal effect on the user is carried out.

3. Purposes

— Concluding and performing the agreement: placing the order, issuing the eSIM profile with the operator, delivering the QR code.

— Sending service messages: payment confirmation, the QR code and installation instructions, order status updates.

— User support, including refund requests.

— Site security: rate limiting, detecting and preventing abuse.

— Meeting statutory obligations, including tax and accounting records.

4. Legal basis

Processing is based on performance of the contract to which the data subject is a party, and on the consent given when placing an order.

Technical connection data is processed for security purposes on the basis of the controller’s legitimate interest.

5. Recipients and cross-border transfer

Personal data is never sold or shared for advertising. Transfers are limited to what performance of the contract requires:

— eSIM Access (eSIM provider, Hong Kong) — technical order details needed to issue the profile. The customer’s e-mail address is not passed to the provider.

— Resend (e-mail delivery, USA / EU) — the e-mail address and the contents of the service message.

— YooKassa (rouble payments, Russian Federation) and 2328.io (cryptocurrency payments) — amount, order number and e-mail address for the receipt, to the extent required by the payment provider.

Transfers to Hong Kong and the USA are cross-border. By placing an order the user consents to such transfer, which is necessary to perform the agreement being concluded.

Data may be disclosed to public authorities upon a reasoned request in the manner prescribed by law.

6. Retention

Order data is kept for the term of the agreement and for three years after it is performed; accounting records are kept for the statutory periods.

Technical connection data is kept for no longer than 12 months.

Support correspondence is kept for one year after the last message.

Once the purposes are met, or upon withdrawal of consent, data is destroyed except where retention is required by law.

7. Security measures

Traffic between the user’s device and the site is protected by TLS.

Secrets of issued eSIMs are stored encrypted in the database.

Access to personal data is limited to those who need it to perform their duties, and actions on the data are logged.

Rate limiting is applied to the interfaces that serve order data.

Databases containing personal data of Russian citizens are located within the Russian Federation.

8. Cookies and local storage

The site uses strictly necessary cookies: a cookie storing the chosen interface language. Browser local storage keeps the chosen colour theme.

No third-party advertising or analytics cookies are set on the eSIM pages.

Disabling cookies does not prevent checkout, but the interface will stop remembering the chosen language.

9. Your rights

You may obtain information about the processing of your data, request its correction, blocking or deletion, and withdraw your consent.

Send your request to support@esimprom.online from the e-mail address used at checkout. A reply is provided within 10 business days, extendable by no more than 5 business days with notice.

Withdrawing consent ends processing and leads to deletion, unless processing continues on another lawful basis. Withdrawal after an eSIM has been issued does not cancel the performed agreement and is not a ground for a refund.

You may lodge a complaint with Roskomnadzor or in court.

10. Changes

This Policy may be amended. A new version takes effect upon publication at /privacy. The date of the current version is shown at the top of this page.

The Russian-language version of this document prevails in case of discrepancy.