A Privacy Notice You Can Actually Read
Selling You an eSIM Needs Surprisingly Little Personal Data: an Address to Send It To, What You Bought, and the Device It Goes On. This Page Says What Happens to That Data Next — Who Else Ever Sees It, How Long We Keep It, and How You Get It Back. The Long Sections Open with a Plain Summary, and the Legal Wording Sits Underneath It
Ten Data Protection Laws. We Meet Every One of Them
The List Nobody Prints — We Do
What This Notice Covers
This notice explains what travelData.shop does with personal data — what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it. It applies to this website, to the checkout, to the eMails we send you and to the account area.
It does not apply to what you do once your eSIM is connected. Once the plan is running, your traffic goes over a mobile network in the country you are visiting, and what happens to it there is between you, that network and the sites you visit. We are not a party to it and we do not receive it.
It is written to be read. Where the law requires a specific term — a legal basis, a retention period, a right — the term is there, but the sentence around it is plain.
Who You Are Dealing With
travelData.shop is an eSIM marketplace: we compare data plans from several wholesale connectivity providers and sell them under our own name. The shop, the account area and this notice are operated by Wissen & Wohlstand GmbH Slowakei s. r. o., registered at Lermontovova 3, 811 05 Bratislava, Slovakia, European Union, which is the controller of everything described here.
Privacy questions, and any request about your own data, go through our contact form, where they reach a person rather than a queue. We answer within 30 days.
We have not appointed a data protection officer. Nothing we do requires one — we do not process special categories of data, we do not monitor anyone systematically, and our processing is not large-scale in the sense the law means. If that changes, this paragraph changes with it.
If Somebody Else Gave Us Your Details
You may be reading this because you received something from us without ever having bought anything. That happens in one case: somebody sent you a gift card. To deliver it we were given your name and eMail address by the person who bought it, and we use them for that delivery and for nothing else — you are not added to any mailing list and your address is not used to advertise to you.
The rights in §8 are yours in full, including the right to have the record deleted. If you would like that, or would simply rather we had not been given your address, tell us through our contact form and it is done.
1. What We Collect
1.1. What You Give Us
To buy, you need to give us an eMail address — that is where the eSIM goes. If you create an account you can also add a name, a phone number and a billing address, choose a language and a currency, and set whether you want to be told when a plan is running low or about to expire. A password is optional: most people sign in with a one-time code sent to their eMail, and where a password is set we store only a cryptographic hash of it, never the password itself.
You give us more only when something calls for it: the recipient’s name and eMail and your message when you send a gift card, your rating and comments when you leave a review, whatever you write to us in a support ticket or through the contact form, and — rarely, and only where a payment or a regulator requires it — a photograph of an identity document.
Business accounts work the same way with one addition: where a company buys for its staff, we hold the contact details of the people it names as users of its portal, and the company — not us — decides who those are. The eSIMs themselves are then allocated by the company, and we see the allocation rather than the reason for it.
1.2. What Your Browser and Device Tell Us
Like any website, ours records the requests it serves: the pages you opened, the time, your browser and operating system, the site that referred you, and the IP address the request came from. Your IP is used to work out an approximate country — for currency, language and fraud checks — and for security logging.
When you check whether a phone supports eSIM, that check runs against a device list and tells us the model you asked about. If you use our mobile app, it also reports the device identifier, model, manufacturer, operating system and app version, and a push token if you allow notifications. We do not ask for your precise location on the website, and where an app feature would need it, your device asks you first and refusing it costs you only that feature.
1.3. A Basket You Did Not Finish
If you reach the payment step and leave without paying, the basket is kept for a short while with the eMail address you had entered, so we can send you one or two reminders that it is still there — sometimes with a discount code. You can stop those at any time with the unsubscribe link in the message, and the basket is deleted once it expires.
We do this because an unfinished checkout is usually an interrupted one rather than a change of mind. If you would rather not be reminded at all, say so through our contact form and we will mark the address.
1.4. What an eSIM Produces
A purchased plan carries its own identifiers: an ICCID, the activation code and QR code you install it with, the destination and validity, and the dates it was activated and expires. While the plan is live we receive a running total of how much data it has used, so we can show you the balance and warn you before it runs out.
That total is a number of megabytes and nothing else. We do not receive, store or have any way to look at the sites you visit, the apps you use, your messages, your calls or your location while the eSIM is connected.
1.5. Payment Details
Card numbers never reach our servers. The card form belongs to the payment provider, and what comes back to us is the outcome: an amount, a currency, a status and a reference. If you choose to save a card for later, we keep the last four digits, the brand and the expiry date so you can recognise it — the card itself stays with the payment provider under a token.
2. Why We Use It, and on What Legal Basis
Every purpose below has a legal basis under Article 6 of the GDPR, and we have named it rather than leaving you to guess:
- To deliver your order — performance of a contract. Buying the plan from the network, sending you the eSIM and its installation steps, showing your remaining data, handling top-ups, renewals, refunds and support.
- To keep records — legal obligation. Invoices and accounting records, tax reporting, and responding to a lawful request from an authority.
- To run and protect the service — legitimate interests. Preventing fraud and abuse, keeping the site secure and available, understanding in aggregate which pages and plans people use, and crediting a partner who referred you. We weighed each of these against your interests before relying on it, and none of them involves building a profile of you.
- To finish a basket you left — legitimate interests. If you reach the payment step and leave, we send up to two reminders — one about an hour later and one about a day later, the second sometimes with a one-off discount code. We do it because an interrupted checkout is usually an interruption rather than a decision, and we weighed that against your interest in not being written to: it is two messages, never more, and it stops the moment you use the unsubscribe link in either of them. We do not send it to anyone who has unsubscribed.
- To send marketing eMail — consent. Newsletters and offers go only to people who asked for them. Every one carries an unsubscribe link that works immediately, and withdrawing consent does not affect anything we sent before. eMails about an order you placed — your eSIM, its installation steps, a low-data warning, a receipt, a renewal notice — are not marketing and are sent under the contract instead.
Nothing here makes an automated decision that has a legal or similarly significant effect on you. Our fraud checks can flag a payment for review, but a person decides what happens next.
3. Who Else Sees It
Your data reaches four kinds of recipient, and no others:
- The connectivity provider behind your plan. To issue an eSIM, the wholesale provider is told which plan and destination, and it returns the eSIM identifiers. Depending on the provider this is done with your eMail address or with an order reference alone. They never receive your payment details.
- The payment provider you pay through. Your card and billing details go to them directly and are processed under their own privacy notice. We see the result, not the card.
- The companies that run our infrastructure. Hosting, eMail delivery and the measurement described in §5.2. They act on our instructions under a data processing agreement and may not use your data for their own purposes.
- An authority, a court, or a buyer of the business. Where the law obliges us, or to establish or defend a legal claim. If the business were ever sold or merged, customer records would transfer with it and you would be told before anything about this notice changed.
Partners in our affiliate programme are a special case, and a narrow one. A partner who referred you is shown that a sale happened, its value and its country — never your name, your eMail address or what you bought.
4. Sending Data Outside the EEA
We are based in the European Union and your data is held here. Some of the companies listed above operate outside the European Economic Area, so a transfer sometimes happens — most obviously when you buy a plan for a destination whose network is not in Europe.
Where it does, we rely on one of the safeguards the GDPR provides: an adequacy decision by the European Commission for that country, or the European Commission’s Standard Contractual Clauses in our agreement with that company. Where a transfer is genuinely necessary to deliver a service you asked for in that country, Article 49(1)(b) applies instead. You can ask us which one covers a particular transfer and we will tell you.
6. How Long We Keep It
When you close your account we deactivate it and stop using it: you can no longer sign in, we stop sending you anything, and the profile is no longer visible in the shop. Two things go with it that are not about data, so they are worth saying here as well as in the Terms: any travelData Coins, promotional credit and unredeemed reward balance are cancelled and are not paid out, so spend them first, and an activated plan runs to its end rather than being refunded. What we cannot do is erase the orders behind it — an invoice is a legal record and accounting law requires it to survive for ten years. Once that period ends, the records go.
One thing does outlive a closure, and it is fairer to say so than to leave you to find out. Our free trial and our referral rewards are for new customers, and the only way to tell whether somebody is new is by their eMail address — so when we erase yours we keep a one-way hash of it, and nothing else. It cannot be turned back into an address, we cannot contact you with it, and it is used for that single check and for nothing else. Without it, closing an account would be the way to claim a new-customer offer a second time.
Where something is held in a backup rather than in the live system, it is deleted on the backup’s own cycle rather than on request, and it is not used for anything in the meantime.
7. How We Protect It
Traffic to and from this site is encrypted in transit. Passwords are stored only as hashes. Card numbers are never on our servers at all. Access to customer records is limited to the people who need it and every administrative action is logged. Identity documents, where we have had to ask for one, are held separately and deleted once the check is done.
No system is perfectly secure and we will not pretend otherwise. If a breach ever put your rights at risk, we would report it to the supervisory authority within 72 hours as the law requires, and tell you directly where the risk to you was high.
8. Your Rights
Under the GDPR you have the right to be told what we hold and to get a copy of it; to have it corrected if it is wrong; to have it deleted where we have no continuing reason to keep it; to have our use of it restricted while a dispute is resolved; to object to processing we base on our legitimate interests; to receive what you gave us in a portable format; and to withdraw consent at any time where consent is what we relied on.
You do not have to write to us for most of this. Your profile is editable in your account, your orders and eSIMs are listed there, marketing eMail has an unsubscribe link in every message, and closing your account is a button rather than a request. For anything else, use our contact form — we may need to check that the request is really yours before we act, and what you send us for that check is used for nothing else.
If you think we have got this wrong, you can complain to a data protection authority — in Slovakia that is the Office for Personal Data Protection of the Slovak Republic, and if you live elsewhere in the EEA, to the authority in your own country. We would rather you told us first, but it is your choice and you do not have to.
9. If You Are Outside the EEA
We apply the standard in this notice to everyone, wherever they live, because running two different standards would mean holding some customers to a worse one. Where your local law gives you a right this notice does not name, you still have it and we will honour it.
California residents: we do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the past twelve months. You have the right to know what we collect and why, to request deletion or correction, and not to be treated differently for exercising either. Residents of the United Kingdom, Switzerland, Canada, Brazil, Australia, Japan, South Korea and Singapore have equivalent rights under their own laws, and the same contact form answers all of them.
10. Children
This is a paid travel service and it is not meant for children. Buying from us requires you to be 18 — that is a rule about who can enter a contract and it is in section 2 of the Terms. This section is about something narrower: we do not knowingly collect data from anyone under 16, or under the age your own country sets if it is different, which is the age data-protection law uses. If you are a parent or guardian and believe your child has given us something, tell us through our contact form and we will delete it and close any account behind it.
11. Changes to This Notice
We update this notice when what we do changes — not on a schedule. The date at the foot of this page is the date of the last change, and every version we publish is archived: if you need the wording that was in force on a particular day, ask through the contact form and we will send it to you.
A change that materially affects you — a new purpose, a new kind of recipient, a shorter list of your rights — will be announced by eMail or on the site before it takes effect, not slipped in.
Questions, corrections and anything here you disagree with go to the same contact form, and a person reads every one.
12. Language and Law
This notice is published in several languages for your convenience. The English version is the original and is the one that governs: where a translation differs from it, the English version prevails.
It is given under the GDPR and is read alongside the Terms & Conditions and the Refund Policy, which govern the purchase itself and are subject to the law and the courts named in section 10 of the Terms. This notice is information about what we do with your data rather than something you agree to, and your rights under it do not depend on accepting anything.
One Form. A Person Reads It
Access, Correction, Deletion, Restriction, Objection, Portability or Withdrawing Consent — Every Request Goes Through One Form
Sorted? Pick Your Next Destination
You Already Know What We Do With Your Data. Here Is What We Do With Your Trip: One Destination, Every Network Side by Side, and the Real Price of Each — No Asterisk. Install Over Wi-Fi Before You Leave, and the Moment the Wheels Touch Down You Are Online, Maps Open, Messages Sending. The Rest Is Yours — Enjoy the Next Adventure