Privacy
What we collect, why we collect it, who else touches it, how long we keep it, and how to make us delete it. Written for people, not for lawyers.
Who is the controller
Fadó is the data controller for the order and contact data described on this page. Registered address: Dublin, Ireland. Company number: TODO_COMPANY_NUMBER. Privacy questions: privacy@fadoesim.com, or support@fadoesim.com if that is easier.
What we collect, and why
- Your order. Your email address, the plan you bought, the price you paid, an order reference, the date and time of the order, and whether your browser told us you were on iOS, on Android or on something else. We need this to take payment, deliver the eSIM and keep the tax record.
- The payment outcome. Stripe tells us that a payment succeeded or failed, and it passes back the billing details you gave it. We never see your card number or your bank details.
- The eSIM itself. The profile identifier and the activation code for the plan. Without these we cannot provision the eSIM, and we need them to show you your order page and to be able to help you if something goes wrong.
- Your order link. Your order page is reached through a random token in the link, not through a cookie. Anyone who has the link can see that order, so treat it like a password and do not post it publicly.
- An install record. When you tap "install" on the order page we record the time, the type of device and the version of the notice that was on screen. We keep it because it is our record of when the plan was supplied and of what you were told before it was.
- Payment and fulfilment events. The steps in your order's history: payment taken, profile requested, eSIM delivered, email sent, refund issued. This is the record of what happened to your order.
- Support correspondence. If you email us, we keep the conversation so that the next reply has the context it needs.
- A partner-programme enquiry. If you register interest in our partner programme, we keep the business name, your name, your email address, the kind of business you are, and anything you write in the message box. We use it to reply to you. We do not add you to a marketing list because of it, and we do not pass it to anyone else.
We do not collect special-category data. We do not ask for your name, your address, your date of birth or your phone number, and we do not track you across other websites. We do not sell your data, and we do not share it with advertisers.
Why we are allowed to use it
Mostly because we have a contract with you: without your email address there is no eSIM, and without the order record there is no delivery, no refund and no invoice. We also keep what we keep to run the business safely (preventing fraud, keeping the service secure, answering you) because we have a legitimate interest in doing so. And we keep financial records for as long as the law requires us to, because that is a legal obligation. Where we rely on your consent, you can withdraw it at any time, and we will tell you what effect that has.
Who processes it for us
Four companies handle your data for us, each only as much as its job needs:
- Stripe takes the payment. Your card details stay with Stripe and never reach our servers. Stripe acts on our instructions as a processor.
- Resend sends your order email, including the install link. It receives your email address and the contents of the message.
- eSIM Access (in Hong Kong) provisions the eSIM profile and hosts the network access your plan runs on. It receives the order details and the technical identifiers needed to set the profile up and to connect it to the network.
- Cloudflare hosts the site and serves its pages and API responses.
We do not add anyone else to this list without updating this page first.
Transfers outside the EEA
Some of the companies above are outside the European Economic Area. In particular, your order details go to eSIM Access in Hong Kong so that the eSIM can be provisioned and run on the network. There is no adequacy decision for Hong Kong, so that transfer is not covered by one.
What we rely on instead is the safeguard the law provides for transfers to a country without an adequacy decision: standard contractual clauses under Article 46 of the GDPR, together with the transfer risk assessment that has to sit behind them. Our other processors outside the EEA are governed by the safeguards set out in their own terms, which for the US-based ones are standard contractual clauses and, where they are certified to it, the EU–US Data Privacy Framework. If you would like a summary of the clauses we rely on, email privacy@fadoesim.com and we will send it.
How long we keep it
- 6 years for the order, the payment and fulfilment events attached to it, and the install record. This is the Irish retention requirement for company and revenue records, and it is also how long we keep the evidence that the plan was supplied and that you consented.
- 2 years for a support conversation, counted from the end of it.
When the period ends we delete the data or make it anonymous. If you ask us to erase something earlier, we will, unless the law requires us to keep it, which mostly means the financial records attached to an order.
Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have wrong or incomplete data corrected;
- have data erased, where the law allows it;
- have us restrict how we use your data while a question about it is resolved;
- object to us using your data, including for anything done on the basis of our legitimate interests;
- get your data in a portable, machine-readable form; and
- withdraw a consent you have given us.
Email privacy@fadoesim.com (or support@fadoesim.com) with your order reference if you have one, and say what you would like us to do. We answer within one month, and we do not charge for it. We may ask you to confirm the email address on the order first, so that nobody else can ask for your data.
If you are not happy with our answer, you can complain to the Data Protection Commission, the Irish data protection authority, at https://www.dataprotection.ie. Complaints are made in writing, through the Commission's online form at https://forms.dataprotection.ie/contact. You do not need a lawyer, and you do not lose anything by asking us first, but the option is there, and we would rather you knew about it.
Cookies
This site sets no cookies of its own. The only cookies you may meet are set by Stripe on its own payment pages, under Stripe's privacy policy, and they are needed to take the payment. We use no advertising cookies, no analytics cookies and no tracking pixels, which is why there is no cookie banner on this site. Your order page is reached through a link with a random token, not through a cookie.
Security
Traffic to this site is encrypted. Card details are held by Stripe, not by us. Access to order data inside Fadó is limited to the people who need it to run the order. No system is perfectly secure, but we treat the order data as personal data because that is what it is.
Automated decisions
We do not use automated decision-making or profiling that has a legal effect on you. Some orders are held briefly before the eSIM is issued, while we confirm the payment has gone through; that is the only automated hold.
Children
This service is not intended for children. If you believe a child has given us personal data, email privacy@fadoesim.com and we will delete it.
Changes and contact
If we change this notice we will update the date at the foot of the page. Questions about any of it: privacy@fadoesim.com, or write to Fadó, Dublin, Ireland.