Privacy policy

This is a translation provided for convenience. In case of any discrepancy the Polish version prevails.

1. Controller

The controller of your personal data is Łukasz Wicenciak, doing business as Keysender - Łukasz Wicenciak, address: ul. Sarnia 2/84, 61-058 Poznań, NIP: 7822386443, REGON: 302410980 (the "Controller"). For anything about your personal data, write to kontakt@esimka.pl or to the Controller's postal address.

2. What data we process

• the email address you give when ordering (we deliver the eSIM to it),
• order data: the Package chosen, order number, the eSIM's ICCID, payment status and history and, for top-ups, the ICCID you enter,
• invoice details if you ask for an invoice (e.g. name or company name, address, tax ID),
• the content of correspondence if you contact us (email, phone, WhatsApp, contact form),
• technical data: IP address, browser and device information, the time of the order and the statements made with it (acceptance of the Terms, request for delivery of the eSIM),
• eSIM usage data provided by the eSIM supplier (e.g. activation status and data used) – as needed to handle complaints and top-ups.

We do not process card details – you enter them directly with the payment provider.

3. Purposes and legal bases

• concluding and performing the contract (delivering the eSIM, top-ups, order support) – Article 6(1)(b) GDPR,
• processing payments, issuing invoices and keeping accounting records – Article 6(1)(c) GDPR together with tax and accounting law,
• handling complaints and withdrawals – Article 6(1)(c) GDPR (obligations under the Consumer Rights Act),
• documenting statements made, and establishing, pursuing and defending claims – Article 6(1)(f) GDPR (our legitimate interest),
• answering messages – Article 6(1)(f) GDPR or, where the message concerns an order, point (b),
• keeping the Shop secure and preventing abuse – Article 6(1)(f) GDPR,
• visitor statistics, if enabled – Article 6(1)(f) GDPR or, where the tool needs non-essential cookies, your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

Providing your email address is voluntary but necessary to conclude the contract and deliver the eSIM. We do not make decisions about you based solely on automated processing, including profiling, that have legal effects.

4. Recipients

Your data may be received only by entities that help us run the Shop, to the extent needed for their tasks:

• payment providers: Stripe Payments Europe Ltd. (Ireland) and, once that method is live, mBank S.A. (Paynow); for bank transfers also inFakt sp. z o.o. (which provides the pro forma invoice and payment page),
• the eSIM supplier and network operators delivering the data service – the ICCID and technical eSIM data (not your email address unless needed for a complaint),
• the SendItNow sales platform on which orders are handled, and hosting, server and email providers,
• inFakt sp. z o.o. – invoicing and accounting system,
• accountants, lawyers and couriers (for postal correspondence) – where needed,
• public authorities – only where the law requires it.

Some providers (e.g. Stripe) may transfer data outside the European Economic Area, on the basis of a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses approved by the Commission.

5. How long we keep data

• order data and accounting documents – 5 years from the end of the calendar year in which the tax payment deadline passed,
• data needed to establish, pursue or defend claims, including the record of statements made at checkout – until the claims become time-barred (generally 6 years, or as the Civil Code provides for claims between consumers and businesses),
• complaints – 2 years after they are resolved or, in a dispute, until it ends,
• correspondence unrelated to an order – up to 12 months after it ends,
• data processed on the basis of consent – until consent is withdrawn.

6. Your rights

You have the right to:

• access your data and receive a copy,
• rectification,
• erasure ("right to be forgotten") where there is no ground for further processing,
• restriction of processing,
• data portability for data processed under a contract or consent,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.

To exercise your rights write to kontakt@esimka.pl. We reply without undue delay and within one month at the latest.

7. Cookies and similar technologies

1. The Shop uses cookies and browser storage that are necessary for it to work (e.g. keeping the payment session, remembering a shop unlock, protecting forms). These do not require consent.
2. If visitor statistics are enabled we prefer a cookieless tool (Plausible Analytics). Tools that use analytics cookies (e.g. Google Analytics) are only started with your consent.
3. You can delete or block cookies in your browser settings at any time; blocking necessary cookies may prevent you from placing an order.

8. Security

We use technical and organisational measures appropriate to the risk, including an encrypted (HTTPS) connection, restricted access to data and working only with trusted providers bound by data processing agreements.

9. Changes

We may update this policy, e.g. when providers or laws change. The date of the last update is shown at the top of the page.