On this page
In short
- We collect what we need to sign you in, take and deliver your order, and answer your messages.
- Payment happens on the payment provider's page (OnePay, or PayPal for orders paid with PayPal). We keep a payment reference, not your card details.
- Your eSIM details are emailed to your order address. They are shown in your signed-in account, to anyone who has the private link from that email, and on the confirmation page in the browser you paid with.
- We use a small set of service providers to run the site. They are listed below.
- With your consent only, we use Google Analytics to count visits and see which pages are used. It stays off until you accept; you can change your choice at any time from "Privacy settings" in the footer.
1. Who is responsible for your data
The controller is TECHWAY JOINT STOCK COMPANY (ChoEsim). For privacy questions, contact support@choesim.com.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account data | Name and email address, and an account identifier, through Google sign-in or email and password sign-in. For email sign-in, password handling and password-reset emails are done by Firebase Authentication | You, via Firebase Authentication |
| Order data | Plans ordered, quantities, amounts, currency, discount code if used, referral code if you arrived through a referral link, order status and refunds | Your order |
| Payment reference | PayPal or OnePay order and transaction references and payment status. Card, bank or PayPal login details are handled by the payment provider, not stored by us | PayPal or OnePay |
| eSIM data | The eSIM name, ICCID, activation code, QR code link and status for each eSIM delivered | Our eSIM supplier |
| Contact messages | Name, email, subject, message, site language | You, through the contact form |
| Email delivery records | Whether and when an installation email was sent | Our systems and Amazon SES |
| Details for an order without an account | Name, email address and, if you add it, phone number | You, at checkout |
| Access data | The order number shown on the confirmation page and in the email, a private access code (we keep only a one-way scrambled form of it), when it expires and when it was last used | Our systems |
| Record of accepting the terms | The version of the terms, the time, and a one-way scrambled form of your IP address | Your order and our systems |
| Security check | A one-time result token from Cloudflare Turnstile, which we check with Cloudflare and do not store. The check itself runs in your browser (see section 4) | Cloudflare |
3. Why we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Sign you in and show your orders and eSIMs | Account data | Contract |
| Take payment and confirm your order | Order data, payment reference | Contract |
| Deliver your eSIM and email installation details | Order data, eSIM data, email address | Contract |
| Issue refunds and handle payment problems | Order data, payment reference | Contract and legal obligation |
| Answer your messages | Contact messages | Legitimate interests |
| Keep the service secure and working | Order, delivery and email delivery records | Legitimate interests |
| Send you offers and news, only if you agreed | Name, email address | Consent |
| Take and deliver an order without an account | Details for an order without an account, order data, eSIM data | Contract |
| Open your eSIM through the private link and send it again when you ask | Access data, email address | Contract |
| Keep a record that you accepted the terms | Record of accepting the terms | Legitimate interests |
| Protect checkout and the resend form from automated abuse | Security check, order records | Legitimate interests |
| Reach you about an order if there is a problem, only if you gave a phone number | Phone number | Contract |
| Add earlier orders to your account when you sign in with the same verified email address | Email address, order data | Contract |
4. Who we share it with
We use these service providers to run ChoEsim:
| Provider | What they do | What they receive |
|---|---|---|
| PayPal (orders paid with PayPal) | Takes payment and processes refunds | Order amount, order reference and the payment details you give PayPal. When a refund is issued, the reason recorded by the operator is sent with it and may appear in PayPal's notification to you |
| OnePay | Takes payment when you choose OnePay (cards, local bank cards, QR, e-wallets) | Order amount, order reference, the language of the page, your IP address and the payment details you give OnePay. OnePay refunds are made by our operator in the OnePay portal |
| Firebase and Google | Sign-in (Google account, or email and password) and password-reset emails | Your sign-in details and account identifier |
| Amazon SES | Sends our emails: eSIM installation details and contact notifications | Recipient email address and the email content, which includes your QR code link, your activation code and, for an order without an account, the private link that opens your eSIM |
| eSIM supplier | Issues your eSIM | An order reference, the order amount and the list of plans ordered |
| Cloudflare | Runs the security check (Turnstile) when you start the checkout form or ask us to send your QR code again | Technical data your browser sends when the check loads, such as your IP address. When we confirm the result from our server, we send Cloudflare the one-time token and not your IP address, name or email address |
We do not sell or rent your personal data. We share it only with the providers listed above and where the law requires it.
5. Cookies, local storage and tracking
- To keep you signed in, the site stores a sign-in session in your browser's local storage.
- The site loads sign-in code from Google and fonts from Google Fonts, so Google receives a request from your browser when those load.
- If you arrive through a referral link, the code is remembered for 30 days. The referral code and the time of the click are kept in a first-party cookie named
choesim_reffor 30 days. - If you arrive through a campaign link (one that carries tags such as utm_source), the tags, the page you landed on and the date are remembered in your browser's local storage for 30 days. They are saved with an order you place, only so that we can see which channel it came from. They are not shared with anyone and are not used to identify you.
- If you order without an account, your browser keeps a private access code in its local storage for 24 hours, so the confirmation page can show your QR code. You can remove it earlier with "Hide QR on this device".
- While you fill in the checkout form, your name, email address and phone number are kept in your browser tab until you close the tab or your order page opens.
- When you start the checkout form or ask us to send your QR code again, the page loads a security check (Cloudflare Turnstile) from Cloudflare, so Cloudflare receives a request from your browser. It is used to protect checkout from automated abuse.
- If you accept analytics, Google Analytics sets cookies and receives page views and basic events (such as viewing a plan or starting checkout) linked to a random identifier. It does not receive your name, email address, phone number, order number, QR code or payment details, and advertising features are off. If you reject, do not answer, or your browser sends a Global Privacy Control signal, nothing is sent. Your choice is kept for up to 12 months and can be changed from "Privacy settings" in the footer. Analytics data is kept for up to 14 months.
6. Security
- Sign-in tokens are checked on our server before an order or eSIM is shown.
- Orders are shown to the account that placed them, or to someone who has the private link or access code for that order. The code is long and random, is sent in the email to the address on the order, and we keep only a one-way scrambled form of it.
- QR codes and activation codes are not placed in public pages or shared caches.
- Payments are handled on the payment provider's pages, not ours.
No system is perfectly secure, so please also keep your QR code private.
7. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account is active, and for a reasonable period after it is closed. |
| Order and payment records | Up to 7 years, as tax and accounting rules require. |
| eSIM data | For as long as your order is shown in My eSIMs or can be opened through its private link, and for a reasonable period afterwards. |
| Contact messages | Up to 2 years after our last contact with you. |
| Marketing contact details, only if you agreed to receive offers | Until you withdraw your consent. |
| Aggregated and anonymised statistics | May be kept indefinitely. They no longer identify you. |
| Name given when ordering without an account | 24 months after the order, then removed or made anonymous. |
| Phone number given when ordering without an account | 60 days after the order, then removed. |
| Name and phone number of an order that was never paid | 30 days after the order was started, then removed or made anonymous. |
| Private links and access codes | A link in our emails works for up to 180 days, and the code kept in your browser works for 24 hours. A newer email replaces the older link. The stored scrambled forms are deleted 90 days after the code expires or is replaced. |
| Record of accepting the terms | As long as the order record it belongs to. |
8. Your choices and requests
You can ask us for a copy of your personal data, ask us to correct it, or ask us to delete it, unless we must keep it by law (for example order and payment records). You can also ask us to restrict how we use it, to move it to another provider, or withdraw a consent you gave us. We reply to these requests within 30 days, and we may need to confirm your identity first.
We send offers and news only with your consent. You can opt out at any time with the unsubscribe link in a message or by writing to support@choesim.com. Service messages, such as order updates and security notices, are not affected.
To contact us about your personal data, write to support@choesim.com and tell us the email address of your account or, if you ordered without an account, the email address and order number of that order. You can also sign out at any time.
9. Children
You must be at least 16 years old to use ChoEsim.
ChoEsim is not meant for children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it after checking.
10. International transfers
Our providers may process your data in countries other than the one you live in, and those countries may have different data protection laws. We use contracts with our providers and security measures such as encryption and access controls to protect your data.
11. Changes to this policy
We may update this policy. The "Last updated" date shows the latest change.
12. Contact
support@choesim.com