Legal

Privacy Policy

Last update: October 27, 2026

Welcome to eSIM World (“we”, “us”, “our”)!

We are dedicated to protecting your privacy and ensuring that your personal data is processed in a secure and transparent manner. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and, where it applies to you, the UK GDPR.

By using our services, you acknowledge that you have read this Privacy Policy. This is not a consent to the processing: the legal ground for each use of your data is stated in section 5. If you have any questions, feel free to contact us using the information below.

The controller of your personal data on eSIM World is NOBRIX Sp. z o.o., ul. Nowogrodzka 42, 00-695 Warszawa, Poland, registration number 0001274394. eSIM World is operated by NOBRIX Sp. z o.o.

We determine how and why your personal data is processed and are responsible for protecting it. You can contact us about your personal data through our contact form.

We collect personal data through:

  • Direct Collection: Data you provide when registering, communicating with us, or using our services.
  • Automated Collection: Data collected automatically when you use the website, through the strictly necessary cookies described in our Cookie Policy.
  • Third-Party Sources: Data received from our payment provider (the result of a payment) and from the eSIM providers that issue your eSIM (delivery status).

We may collect and process the following types of personal data:

  • Contact Information: Name, e-mail address, phone number and billing address, as you enter them when you register, buy or contact us.
  • Account Information: Account ID, e-mail verification status, password (stored in hashed form) and account settings.
  • Transaction Data: Your orders, Top-Ups, Points Balance and Points history, and billing information.
  • Payment Information: Your card details are entered with and processed by our payment processor. We do not store them. We receive the result of the payment and a payment reference.
  • Purchase Consent Records: When you buy an eSIM, we store with your order the date and time and the exact wording of your consent to immediate delivery and of your acknowledgement that you lose your right to cancel, so that we can show it later.
  • eSIM Data: Identifiers and activation details of the eSIMs you buy (such as the eSIM’s ICCID, activation code and QR code) and the delivery status of your order.
  • Communication Logs: Messages you send us through the contact form or by e-mail, and our replies. We also send you service e-mails, such as e-mail verification, password reset, order confirmation and the e-mail with your eSIM details.
  • Technical Data: Device and browser information, IP addresses (and, for about one to two days, a hashed form of your IP address that remembers the currency you choose), and the strictly necessary cookies and browser storage described in our Cookie Policy. Our web server also records IP addresses, the pages requested, the date and time and the browser type in its access logs, for security and troubleshooting; these logs are deleted after at most 13 months.
  • Customer Support Information: Inquiries and support-related data.

If you have any questions about the data we process, feel free to contact us.

Some data is required for us to provide services, while others are optional. You are free to manage or update your optional data through your account settings or browser settings.

We process personal data based on the following legal grounds:

(a)            Account Management: To establish and administer your user account, ensuring you have access to our services and can utilize them effectively. (Legal Basis: Performance of a contract)

(b)            Provision of Services: To deliver the services you have requested, ensuring their efficiency and alignment with your needs. (Legal Basis: Performance of a contract)

(c)            Account Verification and Security: To verify your e-mail address and secure your account, thereby safeguarding against fraud and unauthorized access. (Legal Basis: Performance of a contract, Legitimate interests)

(d)            Legal Compliance: To meet our legal obligations, such as accounting, tax and consumer-protection record-keeping, and to respond to requests from authorities. (Legal Basis: Compliance with a legal obligation)

(e)            Order Fulfillment: To process and complete your orders, including the efficient handling of payments and delivery of goods or services. (Legal Basis: Performance of a contract)

(f)             Transaction Management: To manage and facilitate transactions, ensuring their accuracy, security, and compliance with applicable standards. (Legal Basis: Performance of a contract, Legitimate interests)

(g)            Risk Management: To assess, monitor, and manage business risks, ensuring the continued smooth operation of our services. (Legal Basis: Performance of a contract, Compliance with a legal obligation, Legitimate interests)

(h)            Customer Communication: To engage with you regarding your account, provide customer support, and address any inquiries or issues you may have. (Legal Basis: Performance of a contract, Legitimate interests)

(i)              Marketing: We do not currently send marketing communications. If we start to, we will ask for your consent first, and you can change or revoke your choice at any time. (Legal Basis: Consent)

(j)              Fraud Prevention: To detect, prevent, and respond to fraud and other unlawful activities, thereby protecting both our services and your data. (Legal Basis: Compliance with a legal obligation, Legitimate interests)

(k)            Security: To safeguard our information systems and assets from unauthorized access, ensuring the integrity and confidentiality of data. (Legal Basis: Performance of a contract, Compliance with a legal obligation, Legitimate interests)

(l)              Technical Support: To diagnose and resolve technical issues, maintaining the functionality, stability, and reliability of our services. (Legal Basis: Performance of a contract)

(m)          Service Improvement: To enhance, refine, and develop our services based on user feedback and the support requests we receive, ensuring they continue to meet your evolving needs. (Legal Basis: Legitimate interests)

(n)            Dispute Resolution: To manage and resolve any legal claims or disputes, protecting our legal interests and ensuring compliance with our legal obligations. (Legal Basis: Performance of a contract, Compliance with a legal obligation, Legitimate interests)

(o)            Purchase Consent Records: To record your consent to immediate delivery of an eSIM and your acknowledgement that you lose your right to cancel, to confirm it to you by e-mail, and to handle corrections of charges and chargebacks. (Legal Basis: Compliance with a legal obligation, Performance of a contract, Legitimate interests: proof of compliance and defence of legal claims)

(p)            Payments: To take payment for Top-Ups through our payment provider and to process refunds. (Legal Basis: Performance of a contract)

(q)            Currency choice: To remember the currency you choose (EUR or GBP), using a hashed form of your IP address kept on our server. We use it for one day; expired entries are deleted automatically, normally within a further day. We do not store this choice in a cookie. (Legal Basis: Legitimate interests)

We share your data only with service providers who help us deliver the services, and only what they need: our payment processor, which processes card payments for Top-Ups and refunds; the eSIM and network providers that issue your eSIM; and e-mail delivery and hosting providers. We may also disclose data to authorities, courts or advisers where the law requires it or to establish or defend legal claims. We do not sell your personal data. Any sharing is done in accordance with legal requirements and proper safeguards.

Your data may be transferred outside the UK or EU/EEA for processing, and we take appropriate measures to ensure it is protected, including using Standard Contractual Clauses or other legal mechanisms.

We retain your personal data only for as long as necessary for the purposes it was collected. Account data is kept while your account is open. Order, payment, Points and consent records are kept for as long as required by applicable law (including accounting, tax and consumer-protection law), and for as long as we may need them to establish or defend legal claims. Messages you send us are kept for as long as needed to handle your request and any follow-up. When we no longer need data, we delete or anonymise it.

We protect your data with technical and organisational measures, including encrypted connections (HTTPS) and restricting access to personal data to the people and systems that need it. Your card details are handled by our payment provider and we do not store them. No online service is completely secure, so we cannot guarantee absolute security.

You have the following rights regarding your personal data:

  • Right to Access: Request a copy of the data we hold about you.
  • Right to Rectification: Correct any inaccurate data.
  • Right to Erasure: Request deletion of your data, subject to legal exceptions.
  • Right to Restrict Processing: Limit the processing of your data.
  • Right to Object: Object to processing based on legitimate interests or for marketing purposes.
  • Right to Data Portability: Request your data in a machine-readable format and transfer it to another service.
  • Right to Revoke Consent: Change or revoke your consent to data processing, where applicable.

To exercise any of these rights, please contact us through our contact form. We may need to verify your identity before processing your request. We respond within one month; where the law allows, we may extend this period and will tell you why.

We do not use automated decision-making or profiling that significantly affects you.

If you are concerned about how we handle your data, please contact us directly. If you are unsatisfied with our response, you can lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. You can find the authorities on the European Data Protection Board’s list of members. If you live in the UK, the relevant authority is the Information Commissioner’s Office (ICO).

UK contact details:

The Information Commissioner’s Office (ICO)

Website: https://ico.org.uk/global/contact-us/  

Data protection Complaint Mechanism: https://ico.org.uk/make-a-complaint/data-protection-complaints/?answers=g

We may update this Privacy Policy to reflect changes in data processing or legal requirements. The latest version will always be available on our website, and any significant updates will be communicated to you. We encourage you to review the Privacy Policy regularly.

Our services are not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we become aware that we have inadvertently collected such data, we will take immediate steps to delete it.

If you have any questions about this Privacy Policy or our data practices, please contact us via the Contact form.

Welcome back