Skip to content
ecoesimecoesim
My orders

Privacy Policy

Version 2026-10-20 · effective October 20, 2026

1. Who is responsible

Halstrem Tech SRL, Str. Pitar Moș nr. 27, et. 5, Sector 1, București, Romania (CUI 47407168), is the controller of your personal data on https://ecoesim.net. Questions about privacy: support@ecoesim.net.

We collect as little as we can. You do not need an account to buy an eSIM.

2. What we collect and why

When you buy an eSIM

  • Email address: to send your eSIM, order details and important service messages (performance of the contract).
  • Country you select and order details (plan, price, VAT): to sell the plan, calculate tax and keep accounting records (contract; legal obligation).
  • Payment information: Stripe processes your card. We receive only a payment reference, the card brand and last four digits, and the result of fraud checks.
  • IP address and browser information at checkout: to prevent fraud and to prove the consents you gave at checkout (our legitimate interest in preventing fraud and defending legal claims).
  • Name and address, if we ask for them at checkout: to issue your invoice (legal obligation).
  • eSIM details (ICCID, activation code, installation status, data used, expiry): to deliver and support your eSIM and show its usage. Activation codes are stored encrypted.

When you use "My orders"

Your email address and IP address, to email you a sign-in link and to prevent abuse (contract; legitimate interest). Sign-in links are deleted after 30 days.

When you contact us

Your messages and the details you share with us, to answer you (contract or legitimate interest).

When you ask for travel insurance offers

To show offers on our travel insurance page, we send HelloSafe only your country of residence, your destination, the travel dates and the travellers' ages, never your name or email address. We keep this request and the offers shown for 2 years (statistics, commission checks with HelloSafe). To limit abuse we also keep a code derived from your network address for 7 days. If you continue to HelloSafe and buy insurance, HelloSafe processes the data you give it as a separate controller, under its own privacy policy. Legal basis: steps you ask for before a contract and our legitimate interest in offering travel insurance (art. 6(1)(b) and (f) GDPR).

When you browse

Our web server records technical logs (IP address, page, time, browser) for security. They are deleted after 14 days. We use no analytics, advertising or tracking cookies; see our cookie policy. To see how the site is used, we count page views ourselves, without cookies and without third parties: for each view we store the page, language, country (from the IP address, which is not stored), browser type and device type, and the website you came from. Visitors are told apart within one day only, by a code derived from a random value that is deleted after two days, so a visit cannot be linked to you or to your other visits. Legal basis: our legitimate interest in improving the site (art. 6(1)(f) GDPR).

3. Automated checks

Every order is screened automatically for signs of fraud (for example many orders from one address in a short time). A suspicious order is held and reviewed by a person; we do not refuse an order based on an automated decision alone.

4. Who receives your data

  • Stripe Payments Europe Ltd (Ireland): payment processing and fraud prevention.
  • Contabo GmbH (Germany): hosting of our servers in the EU.
  • Cloudflare, Inc. (USA): delivers our website and protects it against attacks; it processes your IP address and the pages you request.
  • Mailgun Technologies, Inc. (USA; EU servers): sending order emails.
  • Titan (email hosting): our support mailbox, when you write to us.
  • Our eSIM supplier MegaEsim (Soha Trading LLC-FZ, United Arab Emirates): we pass only an internal order reference to obtain your eSIM; we do not share your name or email address.
  • Keez (Romania): our invoicing software; it receives the invoice data and submits e-invoices to the Romanian tax authority where the law requires it.
  • HELLO SAFE SAS (France; insurance broker, ORIAS no. 21008038): when you ask for travel insurance offers, it receives your country of residence, destination, travel dates and the travellers' ages.
  • Our accountant and public authorities, where the law requires it.

Our service providers process data only on our instructions. Stripe, Cloudflare, Mailgun and Titan may process data outside the EU; they use the EU Standard Contractual Clauses and, for the United States, the EU–US Data Privacy Framework.

5. How long we keep it

  • Order, invoice and payment records: as long as Romanian accounting and tax law requires (up to 10 years).
  • IP address and browser information from checkout: 2 years after the order, then erased.
  • eSIM details: 2 years after the plan has ended.
  • Support messages: 3 years after the last message.
  • Records of the emails we sent you (address, delivery status): 2 years.
  • "My orders" sign-in links: 30 days.
  • Web server logs: 14 days.
  • Visit statistics (anonymous): 2 years.
  • Travel insurance offer requests: 2 years (the network code: 7 days).

6. Your rights

You can ask for access to your data, correction, erasure, restriction of processing, a portable copy, and object to processing based on our legitimate interests. Write to support@ecoesim.net; we answer within one month.

You may also complain to the Romanian data protection authority (ANSPDCP) or the authority in your country.

7. Security

Connections are encrypted (HTTPS), activation codes are encrypted at rest, access to customer data is limited to the people who need it, and we never store full card details.

8. Children

Our service is not directed at children under 16.

9. Changes

We will publish any change on this page with a new version date.