Legal information

Privacy policy

Last updated: 22 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

RoloSim GbR
represented by the partners Maxim Tjan and Daniel Jeranko
Ehrenfeld 1A
31199 Diekholzen
Germany

Email: kontakt@rolosim.com
Phone: +49 163 0814039

2. General information

We treat your personal data confidentially and process it to provide this website, sell eSIM data plans, and handle your enquiries. This website does not use tracking cookies, web analytics, or services that track you across different websites. If you explicitly select a language, we store that preference as described in section 13. We do not send newsletters or create user profiles.

3. Website delivery and hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (Vercel). When you visit the website, Vercel processes technically necessary access and log data, such as your IP address, the date and time of access, pages requested, the volume of data transferred, and browser and operating system information. This processing supports the secure and efficient delivery of the website and helps prevent abuse.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in the reliable and secure operation of this website. Transfers to the United States rely in particular on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under that framework. The data processing agreements also provide for EU Standard Contractual Clauses.

4. Web analytics

We currently do not use web analytics.

We do not create usage profiles or analytics cookies.

If we introduce web analytics in future, we will update this privacy policy before use with the service, legal basis, and any required consent.

5. Fonts and graphics

The fonts used on this website (Open Sans and Montserrat) are stored locally and delivered through our hosting. Visiting a page does not establish a connection to Google Fonts. Country flags are served through a RoloSim address. Our server retrieves and caches the flags from FlagCDN without forwarding your IP address or cookies to FlagCDN. Your browser does not connect to FlagCDN. The logo and website icon are delivered through our hosting. The destination, trip duration and data usage icons are included directly in the website as SVG graphics; no external icon service is contacted for them. No maps or media embeds are loaded.

6. Purchase, order and eSIM delivery

When you select and purchase a data plan, we process the data needed to handle the order and provide the service. This includes the order ID, selected plan, destination, price, currency, payment and order status, your email address, and technical eSIM delivery data. We do not receive or store your full payment details.

We use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (Stripe) for payment processing. When you proceed to Stripe, Stripe processes the data needed for payment under its own data protection responsibility. We receive information from Stripe including payment status, the transaction ID, and the email address supplied during payment.

Order and delivery data is processed in our database with Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; Supabase, Inc., USA, for technical operations and support). The database is hosted in our selected project region; operational and support processing may also take place outside that region. This processing is used to fulfil orders, deliver eSIMs securely, and investigate errors or refunds.

To provide the eSIM, we send the plan and order data required to fulfil the order to our eSIM infrastructure partner Airalo (AirGSM Pte Ltd, 6 Raffles Blvd, #03-308 Marina Square, Singapore 039594). Airalo provides the eSIM and its installation information. Airalo's privacy information and terms also apply to its own processing activities.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to perform the contract with you. Where we retain data to meet statutory record-keeping requirements, the legal basis is Article 6(1)(c) GDPR. Processing for fraud prevention, IT security, and error analysis is based on Article 6(1)(f) GDPR; our legitimate interest is the safe and reliable operation of our service.

To order, you must provide the selected plan, payment details and a reachable email address. Stripe also requests billing details at checkout. We cannot process an order without the information needed for payment and delivery. For top-ups we also send Stripe the original order email address. Full card or bank account details are not disclosed to us.

We do not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR. Technical order processing is automated. Contact support if you have problems with an order. Payment providers may conduct their own security and fraud checks; their privacy information applies to those checks.

We send order confirmations and eSIM delivery information by email through Resend. The delivery link contains a time-limited, unguessable access token. On the installation page, the QR code may be loaded directly from Airalo, which receives technical connection data such as your IP address. Our referrer policy prevents transmission of your order page address. External installation and sharing links connect you to the respective provider (Airalo, eSIMs Cloud or Apple) only when clicked. Top-ups are separate orders associated with the same eSIM; we send its ICCID to Airalo when topping up. Upon request, we send a new top-up link, valid for 24 hours, only to the original order address; it does not reveal installation codes. If you enable optional service updates, we process Airalo usage and expiry notifications, your email address, and the time and version of your consent to send corresponding emails with a top-up link under Article 6(1)(a) GDPR. Consent is voluntary, can be withdrawn on the top-up page at any time for the future, and is not required for purchase. In normal operation, usage-notification contents are removed from the local delivery queue 30 days after processing; technical replay-detection records are cleaned after 90 days. Operational outages may delay cleanup. No automatic top-ups take place. Do not share delivery links, QR codes or manual installation details.

When you use online withdrawal, we process your name, receipt email, information identifying the contract or affected part, your declaration and any optional additional information or postal address. We store a receipt timestamp and reference in Supabase and send emails to you and our support team via Resend. This is necessary to receive, acknowledge and process withdrawal under Article 6(1)(b) and (c) GDPR and statutory withdrawal obligations. No reason or postal address is required for online withdrawal.

The internal administration area is access-controlled. Authorised persons can handle orders, refunds and support; administrative actions are logged. Login uses a necessary eight-hour session cookie (rolosim_admin). Processing supports contract performance and protection of personal data under Article 6(1)(b), (c) and (f) GDPR and section 25(2)(2) TDDDG for the necessary cookie.

7. Contact form

When you submit the contact form, we process your name, email address, selected topic and message to handle and respond to your enquiry.

Messages are delivered to our mailbox using Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (Resend), acting as a processor. Your message is sent by email to kontakt@rolosim.com; your email address is used as the reply-to address. We do not maintain a separate database of contact enquiries on this website.

To protect public forms, checkout, order status and admin endpoints, the server derives HMAC-SHA-256 values from IP addresses using a secret key. Withdrawal confirmations also use such a value derived from the recipient address. Supabase stores these pseudonymous values with request counters and expiry times; the rate-limit table contains no raw IP addresses. The regular worker removes expired entries after an additional hour; an operational outage may delay cleanup. The contact form also applies a temporary in-memory limit. This application does not log message contents, API keys or email-provider responses.

Your enquiry is processed on the basis of Article 6(1)(b) GDPR where it concerns entering into or performing a contract. Other enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to handle and respond to business and general enquiries. Processing the IP hash to limit abuse is also based on Article 6(1)(f) GDPR; our legitimate interest is to protect the contact form from automated or abusive requests.

The recipient is Resend. Transfers to the United States rely in particular on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under that framework. The data processing agreements also provide for EU Standard Contractual Clauses.

You are not legally or contractually required to provide data through the contact form. However, without the necessary contact details and message, we may be unable to handle or answer your enquiry.

8. Contact by email, WhatsApp and phone

Email links open your email application. Emails sent to kontakt@rolosim.com are processed by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, and stored in our mailbox.

If you contact us through WhatsApp, we process the information you provide to handle your enquiry. WhatsApp also processes personal data under its own responsibility in accordance with its privacy policy. No WhatsApp service is embedded in our website; a connection to WhatsApp is established only when you follow the relevant link.

Phone links open your device’s phone application. When you call, your phone provider processes the connection data needed for the call. We process the information you share with us to handle your enquiry.

9. Recipients

Your personal data is shared only with the providers needed to operate the website, make sales, and handle enquiries: Vercel Inc. (hosting), Supabase Pte. Ltd. / Supabase, Inc. (order database), Plus Five Five, Inc. / Resend (email delivery), Stripe Payments Europe, Limited (payment processing), Airalo (eSIM delivery), and IONOS SE (email mailbox). We enter into data processing agreements with processors under Article 28 GDPR where required.

Personal data is otherwise shared only where necessary to provide our services, where we are legally required to do so, or where another legal basis exists. Our processors may use approved subprocessors in accordance with their data processing agreements.

Vercel, Resend, Stripe, Supabase and Airalo may process data outside the European Economic Area, particularly in the United States or Singapore. Supabase describes EU Standard Contractual Clauses as safeguards for transfers to Singapore and the United States. The other providers apply their respective transfer arrangements, including Standard Contractual Clauses or an applicable adequacy decision where its conditions are met. When you access mobile networks at your destination, Airalo and the participating network operators also process technical connection, device and usage data under the applicable local rules. The provider information linked below explains transfer safeguards; you can request a copy or further information from us.

Provider privacy and transfer information:

10. Retention periods

In delivering emails, Resend processes and stores message content, email addresses and technical delivery data, among other information. According to Resend, email and log data on the standard plans we use is generally stored for 30 days.

We retain your enquiry in our email mailbox only for as long as needed to handle it and, where applicable, to meet statutory retention requirements, for example under section 147 of the German Fiscal Code (AO) or section 257 of the German Commercial Code (HGB). The data is then deleted.

We store the applicable contractual documents and express declarations with the order and provide them in the confirmation. We retain order, withdrawal and payment data for the duration of contract performance and afterwards in line with statutory commercial and tax retention requirements. We retain eSIM delivery data and secure delivery access only for as long as needed for delivery, support, and abuse prevention.

Technical hosting logs are processed in accordance with Vercel’s applicable retention and deletion periods.

To protect public endpoints, we store temporary counters under secret-keyed HMAC identifiers in Supabase. On Vercel, the identifier is derived from the IP address supplied by Vercel; the IP address itself is not stored in these counters. Withdrawal receipt emails also use a separate HMAC of the recipient address. Rate-limit windows are ten minutes, fifteen minutes or one hour depending on the operation. The regular worker removes expired counters after an additional hour. The contact handler additionally uses an in-memory ten-minute counter.

11. Your rights

Under the GDPR, you have the following rights:

Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR)

You can withdraw consent at any time for the future, including by emailing us. Withdrawal does not affect the lawfulness of processing before withdrawal. This applies in particular to optional service updates.

To exercise your rights, send a message to kontakt@rolosim.com. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). For processing data to provide telecommunications services commercially, the competent authority is Germany’s Federal Commissioner for Data Protection and Freedom of Information (BfDI), under section 29 TDDDG. For other processing subject to state supervision, the competent authority is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.

12. Data security

This website is delivered over an encrypted HTTPS connection. Contact form submissions are validated on the server and subject to size limits. Personal message content, API keys and responses from the email delivery provider are not logged.

13. Language preference

When you open an address without a language prefix, we first use a saved language choice, if available, or otherwise the language sent by your browser (Accept-Language). German is the fallback. Addresses containing /de or /en always open in the specified language. We do not determine your location to choose a language.

Only when you select DE or EN do we store the functional cookie “rolosim_language” on your device, containing “de” or “en”. It applies to this website and expires 180 days after your last explicit selection. It contains no personal identifier and is not used for advertising or analytics.

Storing and reading this preference provides the language function you expressly requested, under section 25(2)(2) of Germany’s Telecommunications Digital Services Data Protection Act (TDDDG). To the extent personal data is processed, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to provide the website in your chosen language. You can change your choice using DE / EN or delete or block the cookie in your browser settings. Language links also work without the cookie, but your choice will not be remembered for later visits.