Privacy Policy of the siEmanko! shop
This is a translation for convenience. The Polish version of this document is legally binding.
Version of 19 October 2026. In force from 19 October 2026.
This document explains what personal data we process when you use the siEmanko! shop (https://esimanko.pl, the "Shop"), why, for how long and to whom we pass it, and what rights you have. We apply Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR (RODO)").
One Account in the siEmanko! and GlobalPass shops
siEmanko! and GlobalPass (https://globalpass.pl) are two shops of the same Seller (section 1), which run on a shared system and have a shared base of Accounts. This means that:
- an Account created in one shop is your Account in the other one too — you sign in to both with the same e-mail address and password, and in the Account in each of them you see the eSIMs and purchases from both shops;
- with every order we record in which shop it was placed;
- the data from both shops is processed by the same controller, for the same purposes and for the same periods (section 3), and you ask for access to, a copy of or erasure of your data once — this covers both shops (section 8);
- deleting the Account deletes it in both shops at the same time.
1. Data controller
The controller of your data is Aliaksandr Nazaruk, an entrepreneur carrying on a business entered in CEIDG (the Polish Central Register and Information on Economic Activity), NIP (tax identification number) 9512452796, REGON (statistical number) 529368437, address for service: ul. Marcina Kasprzaka 31 lok. 119, 01-234 Warszawa ("we", the "Seller"). The Seller runs the siEmanko! and GlobalPass shops and is the data controller in both.
On matters of personal data write to: [email protected]. We have not appointed a data protection officer.
2. What data we process and where we get it from
We collect only what is needed to sell and service eSIMs. We do not ask for your first name, surname, address, phone number or date of birth.
| Category | What exactly | Where from |
|---|---|---|
| Account data | e-mail address; password — we store only its cryptographic hash, not the password itself; the date the Account was created; if you turn on a second sign-in factor — its technical data. The Account is shared by siEmanko! and GlobalPass | from you |
| Session and security data | IP address and browser information (user agent) recorded at sign-in, the time of sign-in and of session expiry, security events (e.g. a password reset or change, signing in with a code from an e-mail, the time of a password sign-in) | from your browser |
| Orders | the chosen Package, price, currency, time and status of the order; the shop in which it was placed (siEmanko! or GlobalPass); the two statements ticked before payment, with the version of the Terms and the time | from your actions in the Shop |
| Payments and refunds | the payment identifier in Stripe, amount, currency, payment status, refunds and their status. We do not receive the card number or the BLIK code | from Stripe |
| eSIM | eSIM identifiers (e.g. ICCID), the Installation Code (stored in encrypted form), the eSIM's status (e.g. whether it has been installed), data usage readings, a record of every display of the Installation Code (when and on what basis) | from the eSIM provider and from your actions in the Shop |
| Correspondence | messages sent to support, refund requests, complaints, withdrawals from the contract and our replies; e-mails you write to [email protected] | from you |
| Technical data of a visit | IP address and request headers (among others browser information and the address of the page you come from); the country Cloudflare assigns to the IP address; server logs, including the Shop's visitor log (time, page visited, page you come from, browser, IP address and country) | from your browser, through Cloudflare |
| Visit statistics | pages visited (without address parameters other than the campaign tag, e.g. utm_source), the page you come from, clicks on purchase buttons and the successive steps of an order (without amounts), device type, operating system, browser, screen resolution, language, country; an anonymous visit identifier computed from the IP address and the browser with a key changed daily — the IP address itself we do not store | from your browser (the Umami tool on our server) |
| Preferences | the language of each purchase (Polish), recorded with the order | from your actions in the Shop |
Using the internet through an eSIM means that local network operators process data about connections (e.g. traffic data and data about the network the device connects to) — they do so as independent controllers, on their own terms. From the eSIM provider we receive only the total data usage and the eSIM's status.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | How long |
|---|---|---|
| Creating and maintaining the Account | Article 6(1)(b) GDPR (contract) | until the Account is deleted |
| Selling the Package, accepting payment, issuing the eSIM, displaying the Installation Code and data usage | Article 6(1)(b) GDPR | for as long as the Contract is being performed, then as in the rows below |
| E-mails relating to the Account and orders: the eSIM is ready and how to install it, a code for signing in without a password, a link to set a new password, the password has been changed, the eSIM could not be issued and the money is coming back, the refund has been sent, most of the Package's data has been used | Article 6(1)(b) GDPR | in the Shop's database we record only that and when the message was sent, and in what language it was written; a copy of every message goes to the Seller's mailbox (section 5) and is kept for as long as the data of the order it concerns |
| Correspondence with support | Article 6(1)(b) and (f) GDPR — replying to your message | until the Account is deleted; if it concerns a refund or a complaint — as in the row below |
| Cancellations, refunds, withdrawals from the contract and complaints | Article 6(1)(c) GDPR (obligations under the Consumer Rights Act, ustawa o prawach konsumenta) and (b) | until the limitation period for claims arising from the Contract expires |
| Tax and accounting settlements (evidence of sales and refunds) | Article 6(1)(c) GDPR (tax law) | 5 years from the end of the calendar year in which the tax payment deadline passed |
| Security of the Account and the Installation Code (sessions, the register of Code displays, locking the eSIM after a password reset or a sign-in with a code from an e-mail) | Article 6(1)(f) GDPR — our legitimate interest: protecting your eSIM from being taken over | session data — until the Account is deleted; the register of displays — as evidence of sales, because it confirms that the eSIM was issued |
| Preventing payment fraud (automatically holding an order for checking — section 6) | Article 6(1)(f) GDPR — protecting Customers and the Seller from fraud | as the order data |
| Establishing, pursuing and defending claims | Article 6(1)(f) GDPR | until the limitation period for claims expires |
| Demonstrating the statements made before payment (acceptance of the Terms, request for the eSIM to be issued at once) | Article 6(1)(c) GDPR (obligations under the Consumer Rights Act) and (f) (defence against claims) | until the limitation period for claims arising from the Contract expires; also after the Account is deleted |
| Data usage readings | Article 6(1)(b) GDPR | until the Account is deleted |
| Server logs | Article 6(1)(f) GDPR — maintaining the Shop and keeping it secure | overwritten automatically once a size limit is reached (currently 3 files of 10 MB per service) |
| Statistics of visits to the Shop (number of visitors, page views, traffic sources, countries) computed from the visitor log; for this purpose IP addresses are only counted, and only numbers go into the statistics | Article 6(1)(f) GDPR — our legitimate interest: knowing how many people visit the Shop and from where | the visitor log — until the server deletes it automatically; the statistics contain no personal data |
| Visit statistics (Umami) — improving the Shop | Article 6(1)(f) GDPR — our legitimate interest: improving the Shop | 25 months, then the data is deleted automatically |
| Database backups | Article 6(1)(f) GDPR — restoring the Shop after a failure | at most 12 months from when the backup was made |
| Remembering the language of each purchase — it is the language of the Contract and of our e-mails about the order | Article 6(1)(b) GDPR | in the Shop's database, for as long as the order data |
Database backups kept on the Shop's server are deleted automatically: all backups from the last 14 days are kept, of older ones only the newest from each calendar month, and none is older than 12 months. Apart from that, the Shop does not yet delete data automatically once these periods have passed — we delete it manually, for example when you ask for your Account to be deleted (section 8).
Visit statistics. To improve the Shop, we count which pages are viewed, where visitors come from and how many people go through the successive steps of an order. We use the Umami tool, running on our own server, for this. It stores no cookies and nothing on your device, and the IP address is only transformed into an anonymous identifier (with a key changed daily) and is not stored. We do not combine this data with the Account or with orders. The basis is our legitimate interest (Article 6(1)(f) GDPR). If your browser sends a "Do Not Track" signal, we count nothing. We keep the statistical data for 25 months, after which it is deleted automatically.
4. Do you have to provide data
Providing an e-mail address is voluntary, but without it you cannot create an Account (you can replace the password with a code sent to that address), and without an Account you cannot buy an eSIM. You provide your payment data to Stripe; without it you cannot pay.
5. To whom we pass data
We pass data only to those who are needed for the Shop to work. Processors act on our instructions.
| Recipient | Role | What data | Where |
|---|---|---|---|
| IONOS SE (Montabaur, Germany) | processor: the server on which the Shop and its database (shared with GlobalPass) run, and the Seller's mailbox that receives messages sent to [email protected] | all the data in section 2; in the mailbox — your e-mail address and the content of the message | Germany (data centre in Frankfurt am Main) |
| Cloudflare, Inc. | processor: DNS, content delivery network and protection of the Shop — all traffic to the Shop passes through Cloudflare; the outgoing mail server through which we send e-mails from the address [email protected]; forwarding of messages sent to [email protected] and [email protected] to the Seller's mailboxes | IP address, request headers and their content in transit; e-mail address and the content of messages from us; the content of e-mails while being forwarded | USA and the global network — section 7 |
| home.pl S.A. (Szczecin) | processor: the backup database from which we restore the state of orders after a failure | order and payment identifiers and an encrypted copy of the Installation Code (without the key that allows it to be read) | Poland |
| Google (the Gmail service) | processor: the Seller's mailbox that receives copies of messages sent to Customers and messages sent to [email protected] | your e-mail address and the content of the message | Google Ireland Limited (Ireland); Google transfers data to Google LLC (USA) — section 7 |
| Stripe Payments Europe, Limited (Ireland) | payment operator; for some purposes (e.g. fraud prevention, legal obligations) Stripe acts as an independent controller | the payment data you enter in the Stripe form; your Account's e-mail address, with which we fill in the form so that Stripe Link can find you by it — Stripe receives it as soon as the form is displayed, whether or not you pay; amount, currency, device data for risk assessment | Ireland; Stripe transfers data to Stripe, Inc. (USA) — section 7 |
| ESIM ACCESS LIMITED — eSIM provider | issues the eSIM and passes us its status and data usage | we pass only our order identifier and the Package code — without your e-mail address or any contact data; the provider processes the eSIM's technical data (e.g. ICCID, data usage) | outside the European Economic Area — section 7 |
| Local network operators | independent controllers of connection data | data on use of the network | the country you are staying in |
| Apple (Apple Pay), Google (Google Pay), Polski Standard Płatności (BLIK), your bank | independent controllers, if you choose the payment method concerned | the data needed for the payment | on their own terms |
| Accounting office — if the Seller entrusts the accounts to one | processor: accounting | data from the evidence of sales and refunds | Poland |
| Public authorities | when the law requires it | the data the request concerns | — |
We do not sell data and do not share it for marketing purposes.
6. Automated decisions
With every paid order the system automatically checks its value and the number and value of paid purchases on the Account concerned in the last 24 hours. If they are unusual, issuing the eSIM is held for checking by a person, and the payment page and your Account show that the order is being checked. The system never refuses to issue an eSIM by itself. If a person confirms the order, the eSIM is issued; if the order is not confirmed within 60 minutes of the payment being accepted, it is cancelled and the whole amount goes back to your payment method. You can express your point of view and ask for a reconsideration by writing to support. Refund requests are always decided by a person.
7. Transfers of data outside the European Economic Area
Cloudflare, Stripe (through Stripe, Inc.) and Google (through Google LLC) also process data in the USA. The basis for the transfer is the European Commission's adequacy decision under the EU-US Data Privacy Framework — for entities covered by the certification — or standard contractual clauses approved by the Commission. We do not pass your e-mail address or other contact data to the eSIM provider; it processes the eSIM's technical data on its own premises, outside the European Economic Area. You can obtain information about the safeguards by writing to the address in section 1.
8. Your rights
You have the right to:
- access your data and receive a copy of it (Article 15 GDPR);
- rectification of your data (Article 16);
- erasure of your data (Article 17);
- restriction of processing (Article 18);
- portability of the data you have given us (Article 20);
- object to processing based on our legitimate interest (Article 21);
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl) or with the supervisory authority of the country in which you live.
How to exercise your rights. Write from your Account's e-mail address to the address in section 1. We will reply within a month; in complex matters we may extend this period by a further two months, informing you of this. We reply to the Account's e-mail address; if you write from another address, we will ask for confirmation from the Account's address. It is free of charge. Because the Account is shared, your request covers the data from both shops — siEmanko! and GlobalPass.
A copy of your data (export). At your request we will send to the Account's e-mail address a JSON file with your data from both shops: Account data, orders and the statements made before paying for them, payments and refunds, eSIMs and their status, data usage and correspondence with support. We do not send the Installation Code by e-mail — it remains available in the Account.
Deleting the Account and data. At your request we will delete the Account — in both shops at the same time, because it is one Account. First we will close any matters in progress (e.g. a refund owed to you), and the data whose retention the law requires (e.g. evidence of sales) we will keep for the period in section 3 and will not use for other purposes. After the Account is deleted you will no longer see Installation Codes or data usage; an installed eSIM works until the end of the Package. Data in backups disappears together with the backup, at the latest after 12 months; if we restore the Shop from a backup, we will delete the data of deleted Accounts again.
9. How we protect data
- The Installation Code is stored in encrypted form and displayed only to the signed-in owner of the Account; every display is recorded. We never send it by e-mail.
- We store passwords only as a cryptographic hash.
- The session cookie is not accessible to the page's scripts and is sent only over an encrypted connection.
- You enter card data and the BLIK code in the Stripe form; they do not reach us.
- After a password reset or after signing in with a code from an e-mail, an eSIM whose Code has not yet been displayed stays locked — access to the e-mail mailbox alone is not enough to open it. After a code sign-in it is unlocked by signing in with the password.
10. Children and minors
The Shop is not intended for children under 13 and we do not knowingly collect their data; if we learn that such a child has created an Account, we will delete it. Persons aged 13–17 use the Shop on the terms of § 2(1) and § 4(6) of the Terms; we process their data in the same way as the data of other Customers (section 3).
11. Cookies
The Shop uses only cookies and browser storage strictly necessary for it to work (the sign-in session) and Stripe's cookies on the payment page. We do not use analytics or advertising cookies; we count visit statistics without cookies (section 3). Details: Cookie notice.
12. Changes to the Policy
We will inform Account owners of material changes by e-mail before they come into force. The current version is always available in the Shop.