Datenschutzerklärung
This Privacy Policy explains what personal information esimdtc collects, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to esimdtc.com and to purchases of our prepaid, data-only travel eSIM plans.
By using this website or buying a plan, you agree to the practices described in this policy. If you do not agree, please do not use the website or complete a purchase.
1. Who we are and how to contact us
esimdtc (esimdtc.com) is an online store for prepaid, data-only travel eSIMs, operated by Our Networking Canada Ltd., Barrie, Ontario, Canada.
We are responsible for the personal information under our control, in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.
- Privacy contact: Email: sales@esimdtc.com
- Subject line: Please use the subject line “Privacy request” for access, correction or deletion requests so we can route your message promptly.
Do not send payment card details or eSIM installation credentials (such as QR codes or activation codes) to us by email. We will never ask you for your full card number or your sign-in password by email.
2. Information we collect
We collect only the information we need to sell, deliver and support your eSIM, to let you view your orders, to keep the website secure, and to meet our legal and accounting obligations.
| Category | What we collect | Source |
|---|---|---|
| Order information | The plan you choose, destination, price, currency (prices are shown in USD), order reference, order timestamps and order status. | Your checkout |
| Contact information | The email address you enter at checkout. We use it to deliver your eSIM and to let you find your orders. | You / our payment processor |
| Payment information | Payment is entered on our payment processor’s hosted checkout page and processed by that processor. We never receive or store full card numbers. | Our payment processor |
| Sign-in information (optional) | If you use “My orders”, your verified email address and, if you choose Google or Apple sign-in, the account identifier and email address provided by that provider. | You / sign-in provider |
| Support communications | Messages you send us, and the order reference you provide with them. | You |
| Payment and security records | When you pay, we record the date and time, the IP address and browser details of your checkout request, the plan, price and policy versions shown to you, and the details our payment processor reports back to us: card brand, last four digits, card type and issuing country, wallet type (such as Apple Pay), the results of its security checks (3-D Secure, address and security-code checks) and its fraud risk score. We never receive or store full card numbers or security codes. | You / our payment processor |
| Installation page records | When you open your private installation link we record the date and time, a shortened IP address (its last part removed), your browser details, the order it was for, and whether the installation details were shown. We do not store the link itself or your activation codes. | Your browser / our providers |
| Technical information | Technical data needed to operate and secure the site, such as request logs kept by our hosting provider, and cookieless measurement of how the website is used, including our own first-party measurement (see Section 7). | Your browser / our providers |
We do not require you to create an account to buy an eSIM. No account is needed to purchase; “My orders” sign-in is optional.
3. How we use your information
- To fulfil your order: process your purchase and payment;
- To deliver and support your eSIM: deliver your eSIM and send transactional emails, including order confirmation, installation instructions and sign-in links;
- To provide “My orders”: let you view your orders and resend your installation email;
- To provide customer support: answer your questions and troubleshoot connection problems;
- To improve the website: understand, in aggregate, how visitors find and use the website — such as which pages are viewed, which buttons are used, where visits end, and page errors and speed — so we can fix problems and make shopping easier;
- To protect the service: detect and prevent fraud, abuse and security incidents; and
- To meet our obligations: meet legal, tax and accounting obligations and resolve disputes.
We do not sell your personal information. We do not use your personal information for advertising, and we do not use it to train artificial intelligence models.
4. Consent and your control over your information
Where PIPEDA or another applicable law requires consent, we rely on your consent for the uses described in this policy, which you give by providing your information, completing a purchase, or choosing an optional feature such as Google or Apple sign-in. You may withdraw consent for optional uses at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent for information that is essential to fulfil an order may mean we can no longer provide that order or service.
Optional features work without the alternatives described in this policy: buying an eSIM and viewing your orders by one-time email link work without Google or Apple sign-in.
5. Google sign-in and Google user data
Google sign-in is optional.
- What we access: only the OpenID Connect “openid” and “email” scopes, which give us your Google account identifier, your email address, and whether Google has verified that email address. We do not request or access your contacts, Gmail, Drive, calendar, profile photo or any other Google data, and we never see your Google password.
- How we use it: only to sign you in to “My orders” (we accept the sign-in only if Google reports the email address as verified), to show the orders bought with that email address, and to keep the orders you add to your account linked to it.
- Sharing: we do not sell or rent Google user data, we do not share it with third parties for their own purposes, and we do not use it for advertising or to train AI models. It is processed only by service providers acting on our behalf to run the features you use: Cloudflare stores it in our database and operates sign-in; if you are signed in when you check out, we pre-fill that email address in our payment processor’s checkout so it can process your payment and send your receipt; and Amazon SES sends your sign-in, order confirmation and installation emails to that address. Otherwise it is disclosed only if required by law.
- Retention and deletion: your account identifier and email address are kept while your “My orders” account exists; sign-in sessions expire after seven days and signing out ends the session. To delete your sign-in record, email sales@esimdtc.com; we delete it within 30 days, except order records we must keep for legal or accounting reasons. You can also remove esimdtc’s access at any time in your Google account permissions (myaccount.google.com/permissions).
esimdtc’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Who we share information with
We share personal information only as necessary to provide the service, with the service providers below, which process it on our behalf and under their own privacy and security terms. We may also disclose information if required by law, court order or a lawful request from a public authority, or to protect our rights, our customers or the security of the service.
| Service provider | What it does for us | What it receives |
|---|---|---|
| Our payment processor | Payment processing and the hosted checkout page where you enter your email and card details. | Email address and payment information you enter at checkout |
| Amazon Web Services — Amazon SES | Sending transactional emails. | Email address and the content of the transactional email |
| Cloudflare | Website hosting, database, security, cookieless Web Analytics, and storage of our first-party website measurement (page views, clicks, page errors and performance). | Technical data and, for sign-in, your account identifier and email address |
| Our eSIM supplier | Issuing your eSIM. | Only the plan and order details needed to issue your eSIM — not your email address |
| Google or Apple | Optional sign-in, only if you choose it. | Sign-in request information under that provider’s terms |
We do not place eSIM credentials in analytics or application logs.
7. Cookies and similar technologies
This storefront does not load advertising trackers. We use only the cookies below.
| Cookie | Purpose | Maximum duration |
|---|---|---|
| Session cookie (“My orders”) | Keeps you signed in securely so you can view your orders. | Up to 7 days |
| Sign-in protection cookie | Protects the Google or Apple sign-in flow while it is in progress. | Short-lived (during sign-in only) |
Cloudflare Web Analytics, which we use for page-view and performance measurement, is cookieless. It is not used for advertising. You can block cookies in your browser settings; if you do, sign-in and currency preference features may not work, but you can still browse plans and buy using the one-time email link.
We also measure how this website is used with our own first-party measurement. It does not use cookies or local storage and does not create a persistent identifier: a random session identifier is kept in your browser’s session storage for the current tab only and is replaced after 30 minutes of inactivity. We record the pages you view (with order numbers, tokens and search terms removed), which buttons and links you use, how far you scroll, time on page, the general source of your visit (for example a search engine or an advertising campaign), your approximate country, and page errors and speed. We do not record what you type, the text on the page, your IP address or full browser details, and we do not make session recordings.
This measurement is used only to fix problems and improve the website. It is not used for advertising, is not sold, and is not shared with third parties other than Cloudflare, which hosts it for us. We do not run it on the “My orders” or eSIM installation pages.
If your browser sends a Global Privacy Control or Do Not Track signal, we do not record your browsing activity; we still record anonymous page errors and page speed, without a session identifier, so we can keep the website working.
8. Cross-border transfers
Our service providers may store or process personal information outside Canada, including in the United States. When information is processed in another country, it may be subject to the laws of that country, including lawful access by courts, law enforcement and national security authorities there. We remain accountable under PIPEDA for information we transfer to a service provider, and we use contractual and other safeguards to require a comparable level of protection while the provider processes it on our behalf.
9. How long we keep information
| Record | Retention |
|---|---|
| One-time email sign-in links | Expire after 15 minutes |
| Records of sent sign-in and order-link emails | Deleted after 30 days |
| Sign-in sessions | Expire after 7 days; signing out ends the session |
| Google / Apple sign-in record | Kept while your “My orders” account exists; deleted within 30 days of a deletion request, subject to the order-record exception below |
| Order records, including order confirmation and installation emails | Kept with the order record for as long as needed for fulfilment, support, dispute resolution, and legal and accounting obligations |
| Payment, checkout and installation page records | Kept for 18 months after the order to answer payment disputes and chargebacks, then deleted. An account deletion request does not remove them during that period; you can ask us for a copy. |
| Support messages | Kept as needed to resolve your request and, where they relate to an order, with the order record |
| Website usage measurement | Detailed records deleted after 90 days (page-error and page-speed records after 30 days); aggregated statistics without identifiers kept for up to 13 months |
When personal information is no longer required for the purposes described in this policy or by law, we delete it or anonymize it.
10. How we protect information
We use administrative, technical and organizational safeguards appropriate to the sensitivity of the information, including: payment entry only on our payment processor’s hosted checkout (we never receive or store full card numbers); encrypted connections (HTTPS) for the website and sign-in; short-lived, one-time sign-in links; limited access to personal information to those who need it to operate the service; and keeping eSIM credentials out of analytics and application logs.
No method of transmission or storage is completely secure. If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as required by PIPEDA, and we will keep a record of the breach as required by law.
11. Your rights and choices
Subject to applicable law and to our legal and accounting obligations, you may:
- request access to the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request deletion of your personal information, including your sign-in record (see Section 5);
- withdraw consent for optional uses, as described in Section 4; and
- remove esimdtc’s access to your Google account at any time in your Google account permissions.
To make a request, email sales@esimdtc.com. We may need to verify your identity, for example by confirming control of the email address used for the order. We will respond within the time required by applicable law, and we will explain if a request cannot be fully met because we must keep a record for legal, tax, accounting or dispute-resolution reasons.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where applicable, your provincial privacy commissioner.
12. Children
Our plans are intended for purchase by adults. We do not knowingly collect personal information from children under the age of majority in their province or territory of residence without appropriate consent. If you believe a child has provided us with personal information, contact us at sales@esimdtc.com and we will delete it as required by law.
13. Links to other websites
Our website may link to third-party websites, such as our payment and sign-in providers during checkout or sign-in. Those websites are governed by their own privacy policies, which we encourage you to read.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will update this page and the “Last updated” date above when this policy changes. Material changes will apply going forward; the version in effect when your information was collected will govern that information unless you consent otherwise or the law requires otherwise.