Privacy Policy
Updated: 15 October 2026
Translation notice: The German version prevails in case of discrepancies, subject to mandatory law.
This policy provides information under Articles 13 and 14 GDPR.
1. Controller
Gurbet eSIM, owner Muhammed Akbas, Bremsberg 12, 59229 Ahlen, Germany, info@gurbetesim.de.
2. Hosting and server logs
Hostinger hosts this website. Technical access data such as IP address, time, requested URL, browser, operating system and error data may be processed to provide and protect the website (Article 6(1)(f) GDPR).
3. Orders and contract performance
We process name, email, plan, order and payment status, technical identifiers and communications to process orders, provide the eSIM and provide support (Article 6(1)(b) GDPR). Statutory accounting data is processed under Article 6(1)(c) GDPR.
Providing your email address and payment data is required to conclude the contract; without them the eSIM cannot be provided. After successful payment we send the order confirmation, eSIM access data and contract-related service messages by email, for example notices when 50%, 80% or 90% of your data has been used. These messages are part of contract performance (Art. 6(1)(b) GDPR) and are not advertising. Emails are sent via the mail server of our hosting/email provider acting as our processor.
4. Stripe
Payments are processed by Stripe. Stripe processes payment data under its own responsibility. We normally receive payment status and transaction identifiers, not full card data.
Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Depending on the payment method chosen, data is also passed via Stripe to the respective payment provider acting as an independent controller: for PayPal to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg; for Klarna to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna and PayPal may carry out their own checks for fraud prevention and, for invoice or instalment payments, identity and credit checks; their privacy notices apply. For bank transfers Stripe provides individual transfer details. Legal basis: Art. 6(1)(b) GDPR; fraud prevention: Art. 6(1)(f) GDPR. Transfers outside the EEA take place only under Articles 44 et seq. GDPR.
5. eSIM fulfilment
Required order and product data is shared with our technical eSIM supplier/platform (currently eSIM Access and connected network partners) only to create, activate, troubleshoot and support the purchased eSIM.
Only data required for provisioning, activation, troubleshooting and support is transferred, in particular plan, order reference and technical eSIM identifiers (e.g. ICCID); no payment data is transferred. The supplier is ESIM ACCESS LIMITED (eSIM Access, part of the Redtea Mobile group, based in Asia). We deliberately do not transfer names, email addresses or payment data, only a randomly generated transaction ID, the plan code and, for top-ups, the ICCID of your eSIM. When the eSIM is used, eSIM Access and the mobile networks in the destination country necessarily process connection and usage data of the eSIM (e.g. ICCID, network registration, data usage) under their own responsibility. Some of these parties are located outside the European Economic Area in countries without an EU adequacy decision, where the level of data protection may be lower and authorities may be able to access data. The transfer takes place because it is necessary to perform the contract you requested for an eSIM used abroad (Art. 49(1)(b) GDPR). Without it, the eSIM cannot be provided.
6. Email and WhatsApp
Contact data is processed to answer requests (Article 6(1)(b) or (f) GDPR). WhatsApp Ireland Limited processes data when WhatsApp is used and data may be transferred outside the EEA. Email is available as an alternative.
7. Cookies, local consent management and optional services
Strictly necessary storage and access are covered by section 25(2) TDDDG; related processing is based on Article 6(1)(b) or (f) GDPR. Statistics or marketing technologies are activated only after your explicit consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.
We use a self-hosted consent solution. Your choice (necessary, statistics and marketing), the consent version and timestamp are stored only in your browser’s local storage under gurbetesim_consent_v1. This necessary record applies to every page and language section on the same domain and expires after no more than 180 days. The banner itself does not send consent data to third parties.
Necessary functions are always active; statistics and marketing are off by default. The solution prepares Google Consent Mode v2 signals locally. This alone neither loads Google tags nor sends data to Google. Before any new measurement or advertising service is activated, this notice will be updated with the provider, purpose, retention period and possible international transfers.
You can change or withdraw your choice at any time through “Cookie settings” in the footer. Withdrawal applies prospectively. You can also remove the locally stored choice in your browser settings.
Strictly necessary storage includes the session cookies “gurbet_checkout” (ordering process and protection against forged requests) and “gurbet_customer” (sign-in to the customer area). These cookies are deleted when the browser is closed at the latest. Voluntary selections made during ordering (e.g. consent choices, quantity) may be stored briefly in your browser’s local storage so that they are kept when moving from the product page to the order step.
8. Electronic withdrawal function
Name, email, order/contract details, withdrawal statement, timestamp and security data are processed to handle and document withdrawals (Article 6(1)(b) and (c) GDPR).
8a. Customer overview and data usage
For the protected customer overview, only the order email address is entered. We send a one-time access link valid for 15 minutes to that address; no order number or ICCID digits are requested. Plan, activation, status, duration, usage data and technical provider identifiers are processed for contract performance and security.
In the customer area you can also book additional data (top-ups) for existing eSIMs. Payment is processed via Stripe (section 4) and the top-up is then transmitted to our eSIM provider (section 5). Legal basis: Art. 6(1)(b) GDPR; securing access is additionally based on Art. 6(1)(f) GDPR.
8b. Review requests, loyalty bonus and promotional emails
Review and marketing emails rely on separate, optional consent. If the loyalty bonus is selected, we record the email address, name, language, order reference, consent wording/version, timestamps and hashed technical security data. We first send only a double-opt-in confirmation. Marketing and the personal one-time 10% code are activated only after confirmation. The legal basis is Art. 6(1)(a) GDPR. Consent is not required for the purchase and can be withdrawn for the future through the unsubscribe link in every promotional email or by contacting us. Unconfirmed addresses are not used for advertising; evidence is retained only as required for accountability and legal defence.
8c. Current Google Maps reviews
To display current business reviews, our server requests data from Google Places API (New). We may show the overall rating, review count and the first three reviews returned by Google Maps in relevance order, including author attribution, profile image, relative time and a direct source link. The request is made server-side; the visitor’s browser does not connect directly to Google for this purpose. Google receives our hosting server’s IP address and technical request data. We do not permanently store API responses containing review content; only the Google place ID may be stored. If the API is unavailable or not yet configured, the last publicly retrieved status is displayed. The legal basis is our legitimate interest in presenting current and traceable genuine customer feedback under Article 6(1)(f) GDPR. The Google Maps Platform Terms and Google Privacy Policy also apply.
8d. Mobile app and customer account
In the “Gurbet eSIM” app, a time-limited sign-in link or code can be sent to the email address used for the order. After sign-in we process an encrypted session token and the order, eSIM, installation, status and usage data required to perform the contract. The token is stored in the operating system’s protected key storage and is deleted or invalidated on sign-out, account deletion or after 10 minutes without use.
Payment data is entered only on Stripe’s payment page; the app does not receive any card or account data.
The QR code and activation data are shown only after sign-in and – if enabled – after unlocking with fingerprint, face recognition or device PIN. The biometric check takes place locally only; we do not receive any biometric data.
We send push notifications only with your consent (Art. 6(1)(a) GDPR). For this we store a device identifier (push token); delivery is via Expo (650 Industries, Inc., USA), Google Firebase Cloud Messaging or Apple Push Notification Service. For transfers to the USA we rely on the EU-US Data Privacy Framework and, additionally, standard contractual clauses. You can withdraw your consent at any time.
The app does not collect location, contacts, photos, advertising IDs or analytics/tracking data.
In the app, under “Profile”, you can export your data and delete your account; without the app, deletion is possible via https://www.gurbetesim.com/konto-loeschen.html or by email to info@gurbetesim.de. Data subject to statutory retention (§ 257 HGB, § 147 AO) is restricted until the retention periods expire.
Legal bases: Art. 6(1)(b) GDPR (contract and account), (c) (legal obligations), (f) (abuse prevention, error analysis) and (a) (push notifications).
8e. Refer-a-friend programme
If you take part in the referral programme, we process the email addresses of the referrer and the referred customer, names where available from the order, derived technical matching values, personal referral and reward codes, order numbers, Stripe session identifiers, order and payment status, and the times of creation and redemption. This data is used to assign referrals, issue the €2.50 benefits, prevent self-referrals, multiple use and abuse, and document transactions. Legal bases: Art. 6(1)(b) GDPR (programme), Art. 6(1)(f) GDPR (security and abuse prevention) and Art. 6(1)(c) GDPR (statutory accounting). Referral relationships are not displayed publicly. The data is deleted or anonymised once no longer required.
8f. Security and abuse prevention
To protect against attacks, automated mass requests and abuse (e.g. for sign-in, withdrawal, ordering and voucher functions) we limit the number of requests. For this purpose the IP address is processed briefly and stored only in hashed, truncated form together with time, function used and event type. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security of our systems and the protection of our customers. Entries are overwritten or deleted regularly.
9. Recipients and international transfers
Recipients may include hosting, payment, communication, eSIM and IT service providers and public authorities. Transfers outside the EEA take place only under Articles 44 et seq. GDPR.
10. Retention
Data is retained only as long as needed or required by statutory commercial and tax retention periods.
Statutory retention periods are generally six years (commercial and business letters), eight years (accounting vouchers such as invoices) or ten years (books, records, annual financial statements), in each case under section 257 HGB and section 147 AO. After that, data is deleted or anonymised unless another legal basis applies.
11. Your rights
Subject to legal requirements, you have rights under Articles 15–21 GDPR, including access, correction, erasure, restriction, portability and objection. Consent may be withdrawn for the future.
Where we process personal data for direct marketing, you have the right to object at any time to processing for such marketing; your data will then no longer be processed for these purposes (Art. 21(2) and (3) GDPR). You may also object to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Art. 21(1) GDPR).
12. Complaints
You may complain to a data protection authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
13. Security and automated decisions
Appropriate technical and organisational safeguards are used. No solely automated decision with legal or similarly significant effects is made.