Privacy Policy

Last Updated: 12/10/2026

This Privacy Policy explains how SimplySIM Solutions Ltd ("SimplySIM", "we", "us" or "our") collects, uses, shares and protects your personal data when you use simplysim.co.uk, the SimplySIM app and our eSIM services (together, the "Services"). It also explains your rights and how to use them.

1. Who we are

SimplySIM Solutions Ltd is the controller of your personal data. SimplySIM is a trading name of SimplySIM Solutions Ltd, registered in the United Kingdom with Companies House under company number 16302568. We are registered with the Information Commissioner's Office (ICO) under registration number ZB960469.

For any privacy question or request, email hello@simplysim.co.uk or use the details in section 15. We are not required to appoint a Data Protection Officer, so this address reaches the person responsible for data protection at SimplySIM.

Laws that apply. We process personal data under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Where we process the data of people in the European Economic Area, we also comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the national laws implementing the EU ePrivacy Directive.

2. Scope

This policy covers personal data we collect through the Services, including eSIM purchases, top-ups, your account, customer support, our newsletter, competitions, our referral and affiliate programmes, and business accounts.

3. Data we collect

Data you give us

• Contact and account details: name, email address, phone number, password (stored encrypted) and, if you sign in with Google, Apple or Facebook, the basic profile details that provider shares with us.
• Order details: the eSIMs you buy, travel dates and destinations you tell us about, your device model, and promo, referral or student codes you use.
• Payment details: card payments are handled by Stripe. We never see or store your full card number; we receive a payment reference, card type and last four digits.
• Support and feedback: messages you send us by email or our contact form, and reviews or competition entries you submit.

Data we collect automatically

• Technical data: IP address, browser and device type, operating system, screen resolution and approximate location derived from your IP address.
• eSIM usage data: the eSIM's identifiers (such as ICCID), activation status and data used, which we receive from our eSIM network partner so we can show your usage and support you.
• Site usage data: pages viewed, searches, clicks and referring pages. Analytics and marketing data is only collected if you allow it in Cookie settings (see section 10).

Data we receive from others

• Our eSIM network partner (eSIM Access): eSIM status and data usage.
• Sign-in providers (Google, Apple, Facebook): your name and email address, if you choose to sign in with them.
• Stripe: payment outcome and fraud-check results.
• Ad platforms: an ad click reference (such as a Google click ID), only if you allow marketing cookies.

What you must provide. We need your email address and payment to sell you an eSIM, because we cannot deliver or support it otherwise. Everything else, such as your name, phone number or travel dates, is optional.

4. How we use your data and our legal basis

Under Article 6 of the UK GDPR and the EU GDPR we rely on: contract (Article 6(1)(b)), consent (Article 6(1)(a)), legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)). Where we rely on legitimate interests we have balanced them against your rights, and you can ask us for details of that assessment.

• To provide the Services (process orders, deliver and activate eSIMs, manage your account, top-ups and refunds, provide support). Legal basis: contract.
• To keep the Services secure (prevent fraud, abuse and spam, including with Google reCAPTCHA and Stripe fraud checks). Legal basis: legitimate interests.
• To send service messages (order confirmations, installation instructions, low-data and expiry alerts). Legal basis: contract.
• To send marketing emails and offers. Legal basis: consent, or for existing customers our legitimate interests in sending similar offers (soft opt-in). You can unsubscribe at any time using the link in every email.
• To understand and improve the Services using analytics. Legal basis: consent (Cookie settings).
• To measure and improve our advertising, including telling ad platforms that a purchase happened after you clicked one of our ads. Legal basis: consent (Cookie settings).
• To meet our legal obligations (tax and accounting records, responding to lawful requests). Legal basis: legal obligation.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who we share data with

We share personal data only with the companies below, and only what each needs to do its job for us. Each acts on our instructions as a processor unless stated otherwise.

We may also share data with professional advisers, with police or regulators where the law requires it, and with a buyer or successor if our business is sold or reorganised.

6. International transfers

We are based in the UK. The EU recognises the UK as giving adequate protection, so data can flow from the EEA to us. Some of the companies above are based outside the UK and EEA. When your data goes to them, we protect it with one of these:

• an adequacy decision (UK adequacy regulations, or the European Commission's adequacy decisions), including the EU-US Data Privacy Framework and its UK Extension where the US company is certified;
• the European Commission's Standard Contractual Clauses, with the UK Addendum, or the UK International Data Transfer Agreement.

You can ask us for a copy of the safeguards that apply to a transfer.

7. How long we keep your data

• Account data: while your account is open. You can delete your account at any time from your account settings.
• Order and payment records: 6 years after the end of the financial year they relate to, as required for tax and accounting.
• Support messages: up to 2 years after the conversation ends.
• Marketing preferences: until you unsubscribe, then a suppression record so we do not email you again.
• Cookies: see the durations in section 10.

8. Your rights

Under UK data protection law you have the right to:

• Access a copy of your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, subject to legal exceptions such as tax records.
• Restriction of processing in certain circumstances.
• Data portability of data you gave us, in a common machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, including from Cookie settings. This does not affect processing that already happened.

These rights apply under both the UK GDPR and, if you are in the EEA, the EU GDPR. To use any of them, email hello@simplysim.co.uk. We may ask you to confirm your identity. We will reply within one month, which we may extend by up to two more months for complex requests, and we will tell you if we do. It is free unless a request is clearly unfounded or excessive.

9. Security

We protect your data with encryption in transit (HTTPS), encrypted password storage, access controls and by using payment and email providers with strong security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will tell you and the ICO about a breach where the law requires it.

10. Cookies and similar technologies

This section is our cookie policy under PECR in the UK and the ePrivacy rules in the EU. Cookies are small files stored on your device. We use essential cookies to make the site work. We only use analytics and marketing cookies, and only load the tools that set them, after you agree in our cookie banner. You can change your choice at any time from Cookie settings, also linked at the bottom of every page. If you withdraw consent we delete the cookies we can and stop those tools on your next page load.

We use Google Consent Mode. Until you agree, Google tags run without setting analytics or advertising cookies and send only limited, cookieless signals. Microsoft Clarity likewise runs without cookies until you agree.

Essential (always on)

Analytics (only with your consent)

Marketing (only with your consent)

Ad platforms may also use the data they collect for their own purposes under their own privacy policies: Google, Microsoft, Meta, Reddit, X, OpenAI, HubSpot and ShareThis.

11. Children

Our Services are for people aged 18 and over. We do not knowingly collect personal data from children. If you think we have, contact us and we will delete it.

12. Third-party links

Our Services link to other websites and apps. We are not responsible for their privacy practices, so please read their privacy policies.

13. The SimplySIM app

The app collects the same kinds of data described above. You can sign in with Google or Apple. It uses Google Firebase: Cloud Messaging to send notifications, Crashlytics to find and fix crashes, and Analytics to understand how the app is used. You can turn notifications off in your device settings.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, if the changes are significant, tell you by email or on the site.

15. Contact us and complaints

SimplySIM Solutions Ltd
Email: hello@simplysim.co.uk

Complaints. If you are unhappy with how we handle your data, email us with "Data protection complaint" in the subject. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to a data protection regulator:

• UK: the Information Commissioner's Office, ico.org.uk/make-a-complaint, 0303 123 1113.
• EEA: the data protection authority in the country where you live or work, or where the issue happened. You can find yours at edpb.europa.eu.