Privacy Policy

1. Who is responsible

NoBorderSim, Het Eeuwsel 57, 5612 AS Eindhoven, Netherlands, Commercial register KvK 42126798Email: hilfe@nobordersim.comPhone: +31 40 240 5999

We have not appointed a data protection officer because we are not legally required to.

2. The key points

To buy, we only need your email address. There is no customer account. You enter your card details directly with our payment provider; we do not see them. Our eSIM partner receives neither your name nor your email address from us. We only set advertising cookies if you agree.

3. When you visit our website

Hosting. Our website runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every visit, Vercel processes technically necessary data: IP address, date and time, the page visited, the previous page, browser, operating system and language setting. This is needed to deliver the page to you and to run it securely. The legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). These server logs are deleted after 30 days. Vercel is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses also apply. We have concluded a data processing agreement with Vercel.

Country and language. From your IP address we determine your country, to suggest a suitable language and, when you order, to charge the correct VAT. We do not store the IP address itself for this, only the country, and only when you order.

Your device. We detect which device you use (for example iPhone or Android) so that we can show you the right way to install. This is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR). We do not store anything on your device for this.

4. When you buy an eSIM

Which data. Your email address, the destination you chose, the number of days and eSIMs, the price, the payment method, date and time, the country of your IP address and the country of your payment method, your consent to immediate delivery (wording and time), the order number, and the identifier of your eSIM (ICCID) and its status (installed, active, usage, expiry date). If you enter a name or company for the invoice on your order page, these details as well.

Why. To deliver the eSIM, show your order page, send you the invoice, help you with questions and carry out refunds. The legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR). We store the country of your IP address and of your payment method because we pay VAT in your country of residence and have to prove this (Art. 6(1)(c) GDPR in conjunction with Articles 24b and 24f of Implementing Regulation (EU) No 282/2011). We store your consent to immediate delivery as evidence (Art. 6(1)(f) GDPR).

Your order page. You reach your order through a personal link without a password. Anyone who has this link can see your order and your eSIM. So do not share it.

How long. We keep order and invoice data for ten years because tax law requires it (among others Article 63c of Implementing Regulation (EU) No 282/2011 for VAT under the OSS scheme). After that we delete it.

Database and email. We store the order data with Neon, Frankfurt am Main region (AWS eu-central-1). We send and receive our emails through Google Workspace from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework. Both process the data only on our behalf and according to our instructions.

5. Payment

Stripe (all payment methods). Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your payment data, the amount, your email address and device and connection data for fraud prevention. Stripe acts partly on our behalf and partly as an independent controller, for example for fraud prevention and to meet its own legal obligations. Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. If you pay with Apple Pay or Google Pay, Apple and Google also process data under their own privacy policies; for Google Pay this is Google Ireland Limited (address below). We only load Stripe's scripts on the payment page. So that Google Pay can appear there if your device supports it, the payment page also loads a script from Google; Google receives your IP address and details about your browser.

If you choose PayPal or a bank payment such as iDEAL | Wero, Bancontact or eps, Stripe forwards you to PayPal or to your bank.

PayPal. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal, Stripe forwards you to PayPal. PayPal is itself responsible for the processing there. Through Stripe we receive the payment status, your name, your email address and the country of your PayPal account. We do not load any PayPal scripts.

Banks (iDEAL | Wero, Bancontact, eps). If you pay by bank payment, you confirm it with your bank. Through Stripe we receive the payment status, the name of your bank and its code (BIC). We use the code to determine the country for VAT. For Bancontact and eps we pass on to Stripe the name you enter for it.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Automated checks. Stripe and PayPal automatically check payments for fraud and may decline a payment. If this happens, contact us and we will look into it.

6. Our eSIM partner

We obtain the eSIM and the connection in the destination country from ESIM ACCESS LIMITED, Flat/Room 8, 15/F, Witty Commercial Building, 1A-1L Tung Choi Street, Kowloon, Hong Kong. For this we only transmit the chosen plan and an internal order number. We receive the identifier of your eSIM (ICCID), the installation data and the status and usage of your plan.

When you use the eSIM, eSIM Access and the mobile networks in the destination country process the data that arises with every mobile connection, for example the time and amount of data use, the radio cell and device identifiers. They do this under their own responsibility as providers of the connection.

There is no adequacy decision of the EU Commission for Hong Kong. We base the transfer on Art. 49(1)(b) GDPR, because the transfer is necessary for the performance of your contract. The legal basis for the transfer is the performance of your contract (Art. 6(1)(b) GDPR).

7. Emails

Emails about your order. We send you the confirmation with your eSIM, your invoice, a reminder if you have not installed the eSIM yet, and a notice shortly before your plan ends (Art. 6(1)(b) GDPR).

Offers by email. As a customer, you also receive offers for similar eSIMs at the address from your order, for example a new eSIM for more days, and after your trip a request for a review. This is permitted under § 7(3) UWG; the legal basis is our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). You can object to this at any time, through the unsubscribe link in each of these emails or by email to hilfe@nobordersim.com. This only costs you the transmission costs at the basic rates. After your objection, we only keep your address on a block list so that we no longer send you offers.

8. Help by email and WhatsApp

If you write to us, we process your message, your contact details and the order concerned (Art. 6(1)(b) GDPR). For WhatsApp we use WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes your phone number and metadata under its own terms; data may be transferred to the USA (EU-US Data Privacy Framework). If you do not want this, email us instead. We delete requests 2 years after the last message, unless they belong to an order that we have to keep for longer.

8a. Help assistant (chat)

On many pages you can open our eSIM assistant. It answers questions about eSIM, prices and installation automatically.

Which data. Your message, the page on which you opened the chat, and the language. To protect against misuse we process your IP address only as a check value (hash), never in plain text.

Why. To answer your question, to prevent misuse and to improve our answers.

Who creates the answer. The language model Claude by Anthropic PBC, San Francisco, USA, as our processor. Anthropic does not use the content to train its models. The transfer to the USA is covered by the standard contractual clauses of the EU Commission.

How long. We store the conversation for 30 days. Email addresses, phone numbers and order numbers are made unreadable before that. After that it is deleted.

Legal basis. Art. 6(1)(b) GDPR (your request) and Art. 6(1)(f) GDPR (protection against misuse, better answers).

No cookies. The assistant sets no cookies and stores nothing on your device. Please do not write payment details in the chat.

9. Withdrawal and refunds

If you use our online function "Withdraw from contract", we store your name, the order number, your email address and the time of receipt, send you the acknowledgement of receipt and process the refund. We are legally required to do this (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). If you request a refund for an eSIM that is not installed, we process the order and the status of the eSIM (Art. 6(1)(b) GDPR). We keep this data as long as the order.

10. Cookies and similar technologies

Strictly necessary. Without these the website does not work, so they do not need consent (§ 25(2) no. 2 TDDDG): your language choice, your cookie decision, the session on the payment page, fraud prevention by Stripe on the payment page, and the check there whether your device supports Google Pay.

Only with your consent: Google Ads. If you tap "Accept", we use Google Ads conversion measurement. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you come to us through an ad, we store the ad's click identifier (gclid) for 90 days. If you buy within that time, we report the purchase to Google with this identifier and with your email address as a hash value (pseudonymised), so that Google can match the purchase even without a cookie. This shows us which ads lead to purchases. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, Google's script loads without cookies and without identifiers of your device (Google Consent Mode). Only anonymous signals then go to Google; we do not store a click identifier and do not transmit an email address. With your consent, Google sets cookies and we measure fully. You can change your decision at any time under "Cookie settings".

Only with your consent: Google Analytics. With the same consent we use Google Analytics 4 from Google Ireland Limited (address above). This shows us how our pages are used and how many orders there are. Google Analytics sets cookies and processes information about your device, your browser and the pages you visit; Google Analytics 4 does not store IP addresses. If you buy from us, we report the order number, the destination and an order value to Google Analytics, not your name and not your email address. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, Google Analytics loads without cookies and without identifiers of your device (Google Consent Mode); only anonymous signals then go to Google. With your consent, Google Analytics sets cookies and we measure fully. You can change your decision at any time under "Cookie settings".

Microsoft Clarity (temporary trial). For a limited time we use Microsoft Clarity from Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records mouse movements, clicks and scrolling and creates heatmaps, so that we can see where visitors get stuck on the website and improve the pages. Input fields are masked. Clarity sets the cookies _clck and _clsk. Microsoft may transfer data to the USA; Microsoft is certified under the EU-US Data Privacy Framework. This happens without consent on the basis of Art. 6(1)(f) GDPR (legitimate interest in a clear and error-free website), for a limited time; the cookie settings do not apply to it. You can object to the processing at any time by writing to us.

Changing your decision. Through "Cookie settings" at the bottom of every page you can withdraw or give your consent again at any time. We store your decision for twelve months.

11. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). To do so, write to hilfe@nobordersim.com.

Right to object. Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

Complaints. You can complain to any data protection supervisory authority, for example the authority in your country or region, or the Autoriteit Persoonsgegevens, which is responsible for us, Postbus 93374, 2509 AJ Den Haag, Netherlands.

12. Do you have to give us data?

To buy, we need your email address, because we send you the eSIM and the invoice. Without it, a purchase is not possible. All other details are optional.

13. Security

Our website is encrypted with TLS throughout. Only people who need access to order data for their work have it.

14. Changes

If our processing changes, we update this policy. The version shown here applies.