Privacy Policy

ValaeSIM Ltd. (“ValaeSIM”, “we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights under applicable data protection law, including the EU General Data Protection Regulation (GDPR).

By using our website (valaesim.com) and services, you acknowledge this Privacy Policy. If you do not agree, please discontinue use of our services.

ValaeSIM Ltd. is the data controller responsible for your personal data. We are registered in Albania and operate globally.

Contact: support@valaesim.com

Information you provide directly:

• Name and email address (account registration and order fulfilment)
• Payment details (processed by Stripe — we do not store card data)
• Support messages and correspondence
• Contact form submissions

Information collected automatically:

• IP address and approximate location (country/city)
• Browser type, operating system, device type
• Pages visited, time spent, referrer URL
• Cookies and similar tracking technologies (see Section 10)

Information from third parties:

• Payment processors (Stripe) for transaction verification
• Analytics providers (aggregated, anonymised data only)

• Order fulfilment: Deliver eSIM QR codes and purchase confirmations to your email
• Customer support: Respond to enquiries and resolve technical issues
• Account management: Maintain your account and purchase history
• Service improvement: Analyse usage patterns to improve our platform
• Legal compliance: Meet regulatory obligations and prevent fraud
• Marketing: Send promotional emails only with your explicit consent (opt-in)

We process your data under the following legal bases:

• Contract performance — processing necessary to fulfil your order
• Legitimate interests — fraud prevention, service improvement, security
• Legal obligation — compliance with applicable laws
• Consent — marketing communications (you can withdraw at any time)

We do not sell your personal data. We share data only as necessary:

• Stripe — payment processing (PCI DSS compliant)
• eSIM network providers — to activate your data plan (email address only)
• Email service providers — to deliver your QR code and receipts
• Analytics providers — anonymised/aggregated data only
• Law enforcement — only when required by a valid legal request

Some of our service providers operate outside the European Economic Area (EEA). Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

We retain personal data only as long as necessary:

• Order records — 7 years (legal/tax obligation)
• Account data — until you delete your account + 30 days
• Support tickets — 2 years after resolution
• Marketing consent — until you withdraw consent
• Analytics data — 14 months (Google Analytics default)

If you are in the EEA or UK, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data (“right to be forgotten”)
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw marketing consent at any time
• Right to lodge a complaint — with your national Data Protection Authority

To exercise your rights, email: support@valaesim.com. We will respond within 30 days.

We use cookies and similar technologies to operate our website and improve your experience:

• Essential cookies — required for the website to function (cannot be disabled)
• Analytics cookies — help us understand how visitors use our site (you can opt out)
• Marketing cookies — used for retargeted advertising (only with your consent)

You can manage cookie preferences through the cookie banner displayed on your first visit, or through your browser settings.

We implement industry-standard security measures including TLS encryption, secure data centres, access controls, and regular security audits. However, no internet transmission is 100% secure. We will notify you promptly in the event of a data breach affecting your personal data.

Our services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us immediately at support@valaesim.com and we will delete it.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email (if you have an account) and update the “Last updated” date at the top. Continued use of our services after changes constitutes acceptance of the updated policy.

For any privacy-related questions or to exercise your rights:

• Email: support@valaesim.com
• Website: Contact form
• Address: ValaeSIM Ltd., Tirana, Albania