Privacy Policy

Document control

1. Who we are

This website and the wholesale eSIM and travel SIM services described on it are operated by [Legal entity name], a company registered in Hong Kong SAR under registration number [Company registration number], with its registered address at [Registered address] ("Global eSIM", "we", "us", "our").

We are the organisation that decides how and why the personal data described in this policy is processed, except where the section on our dual role below says otherwise. If you have any question about this policy, or want to exercise any of the rights set out further down, contact us at commercialisation.ai@gmail.com. That address is monitored during Hong Kong business hours, .

Drafting note: complete the legal entity name, registration number and registered address above before publication. If a separate data protection contact or a Data Protection Officer is appointed, name that person here and give a direct address for data protection enquiries.

2. Scope of this policy, and our dual role

This policy covers two distinct things: your use of this website, and the wholesale eSIM and SIM services we provide to business partners. It applies to the personal data of the people we deal with — named contacts at partner companies, people who send us an enquiry, and, in limited circumstances, the end users of the connectivity our partners resell.

The single most important structural point in this document is that we are a business-to-business supplier, and our contracting partner is a business, not a consumer. The agreement for the service is between us and the partner company. Where an end user's data reaches us, it reaches us because the partner passed it to us.

That has one direct consequence, and it determines which role we play for which data:

• We are a data processor for end-user data that partners pass to us. The partner — an OTA, travel agency, airline, insurer, distributor or MVNO — decides what to collect from its own customers, tells them why, and answers their questions about it. It instructs us to activate and manage connectivity on its behalf. We process that data only on the partner's documented instructions, only to deliver the service, and we do not use it for our own purposes. If you are an end user and you want to know what an operator or travel brand does with your data, the right place to ask is that brand, not us.
• We are a data controller for our own partner-account and website data. Where we hold the details of a named contact at a partner company, run a partner account, issue invoices, or record how this website is used, we decide how and why that data is processed, and this policy describes what we do with it. For that data we are the organisation to contact.

Where we act as a processor, we put a data processing agreement in place with the partner, covering purpose limitation, confidentiality, security, sub-processors, assistance with end-user rights, breach notification and deletion or return of data at the end of the relationship. If your organisation needs a signed data processing agreement, ask us and we will provide one as part of onboarding.

3. What we collect

The categories of personal data we hold are deliberately narrow. In practice they fall into four groups.

Partner account data

Company name, company registration and tax details, business address, the named responsible contact for the account and for SIM registration purposes, business email address, business telephone or WhatsApp number, and billing and settlement details including bank details where payment is by transfer.

Technical and website data

IP address, browser type and version, device and operating system information, the pages you viewed on this site and the time you viewed them, and the referring page where one is sent. This is ordinary server-log information. As explained in the section on cookies and local storage below, this site loads no analytics and no third-party trackers.

Enquiry and order content

Whatever you choose to send us through the enquiry form, the order builder, email, WhatsApp or WeChat: your name, company, role, contact details, the destinations and volumes you are considering, your requirements, branding material if you are white-labelling, and the resulting correspondence and quotation history.

End-user data passed to us by a partner

Where a partner passes end-user data to us so that we can deliver the service, we limit it to what is operationally necessary:

• ICCID — the identifier of the SIM or eSIM profile, which is how an activation is tracked;
• plan and usage records — which bundle was assigned, how much data has been consumed, and when;
• activation status and activation events — whether a profile was downloaded, installed, activated, suspended or terminated;
• end-user contact details, where a partner chooses to provide them so that we can assist with a specific support case or meet a SIM-registration requirement.

4. Why we process it, and our lawful bases

Where the EU or UK GDPR, or a similar regime, applies, we rely on these lawful bases. Where Hong Kong's Personal Data (Privacy) Ordinance applies, the equivalent obligations govern our use of the data.

• Performance of a contract. To open and administer a partner account, provision eSIM and SIM profiles, deliver data, produce invoices, provide support and handle the service relationship. This covers the great majority of what we do with partner account data and with end-user data passed to us for provisioning.
• Legitimate interests. To respond to enquiries, to protect the service against fraud, misuse and abuse, to keep records of what was agreed and quoted, to secure our systems, to understand in aggregate how this website is used so that it can be improved, and to maintain and defend legal claims. We balance these interests against the rights of the individuals concerned, and we do not use them to override an individual's reasonable expectations.
• Legal obligation. To keep accounting, tax and billing records as required by law, to respond to lawful requests from regulators and law-enforcement authorities, and to comply with SIM real-name registration requirements in the jurisdictions that impose them. This is the basis on which identity information may have to be collected and passed on, and it is not optional for us or for the partner.
• Consent. Where we ask for it — for example, for a specific optional use of data that is not covered by the bases above. Where we rely on consent, you may withdraw it at any time, and withdrawal does not affect processing carried out before the withdrawal.

5. SIM registration and regulatory data

This is the area where eSIM and SIM services carry obligations that other digital products do not, and partners should understand it before they sell.

More than 155 countries operate mandatory SIM-registration regimes, under which a subscriber's identity must be verified and recorded by the operator before service is activated. The rules differ substantially from market to market, in what has to be collected, how it is verified and how long it must be held.

There is an important practical distinction for travel connectivity. Data-only travel profiles generally carry no local telephone number. Because a registration regime is normally triggered by the allocation of a local number, these data-only profiles often fall outside it. That is why most travel eSIM products can be sold and activated with no identity document at all.

That said, it is not a blanket exemption. Where registration is required — because the product includes a local number, because the destination or the operator requires it, or because the volume or use pattern triggers it — identity information such as name, document type and number, date of birth, nationality or address may have to be collected and shared with the mobile network operator or with the regulator in that jurisdiction. We confirm the position country by country and product by product during onboarding, and we tell partners which of their destinations are affected.

In Hong Kong, the relevant rules are the Telecommunications (Registration of SIM Cards) Regulation (Cap. 106AI), which requires the real-name registration of SIM cards, including the registration of users of certain prepaid services.

6. Who we share personal data with

We do not sell personal data. We share it only where it is necessary to deliver the service, to comply with the law, or to run our own business, and only with the categories of recipient below.

• Mobile network operators and carriers. The operators that actually provide the connectivity in each destination. They receive what is needed to provision, activate, monitor and support the service, and to meet their own regulatory obligations.
• SM-DP+ and eSIM provisioning providers. The remote SIM provisioning infrastructure that issues, delivers, manages and revokes eSIM profiles.
• Payment providers and banks. To process settlement, reconcile invoices and prevent fraud.
• Cloud hosting and IT service providers. The infrastructure, storage, backup, email and support tooling on which our platform and this website run.
• Professional advisers. Lawyers, auditors, insurers and accountants, where they need the information to advise us.

We may also disclose personal data where we are legally required to do so, in response to a valid request from a court, regulator, law-enforcement authority or network operator, or where disclosure is necessary to establish, exercise or defend legal claims. Where a disclosure is required by SIM-registration or similar local law, we may have no discretion to refuse it.

Cross-border transfers

International transfers are unavoidable in this business, and we say so plainly rather than burying it. Connectivity is delivered in the destination country, provisioning infrastructure is not located in a single jurisdiction, and our own suppliers are spread across several. Personal data will therefore be transferred to and processed in countries other than the one in which it was collected, including countries whose data protection laws differ from those of the country of origin.

Where a transfer requires a safeguard, we put one in place. This normally means Standard Contractual Clauses approved by the European Commission, or the UK equivalent addendum, together with a transfer risk assessment; where appropriate we may instead rely on an adequacy decision or on the necessity of the transfer for the performance of the contract. Partners can ask us which of their destinations involve a restricted transfer and what safeguard applies, and we will set that out in the data processing agreement.

7. How long we keep it

Retention is not a single fixed period. It is set by contract, by law and by regulatory obligation — an invoice has to be kept for accounting purposes long after the service has ended, whereas a website log entry serves no purpose after a few months. The table below sets out our working schedule.

These periods are the current working schedule for this draft and must be confirmed by counsel before publication, together with any longer period imposed by a destination market or by a partner agreement.

Where a partner has instructed us as a processor, end-user data is deleted or returned at the end of the arrangement in line with the data processing agreement, except where we are required by law to retain it — for example where an operator or a regulator requires activation records to be kept for a defined period.

8. Security

We protect personal data with technical and organisational measures proportionate to what it is. In practice that means encryption in transit for data moving between your systems and ours, encryption of stored backups, and encrypted remote provisioning of eSIM profiles. Access to production systems is restricted by access control and granted on a least-privilege basis: staff see partner and end-user data only where their role requires it, access is tied to named individuals rather than shared accounts, and it is reviewed and revoked when roles change. We log administrative access, keep our systems patched, and require our suppliers to meet equivalent standards under contract.

We are honest about the limits of this. No system is perfectly secure, and no method of transmission or storage is entirely free of risk. We cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, we will notify the affected partner and the relevant supervisory authority without undue delay and within the time limits that apply to us, and we will tell the partner what we know, what we have done and what it needs to do. Where we act as a processor, we notify the partner as controller and assist it in meeting its own notification duties.

9. Your rights

Depending on where you are, and on which law applies, you may have some or all of the following rights in relation to personal data about you.

• Access — to be told whether we hold personal data about you, and to receive a copy of it together with information about how it is used.
• Correction — to have inaccurate or incomplete personal data corrected.
• Deletion — to have personal data erased where there is no continuing lawful reason for us to hold it.
• Restriction — to have processing limited, for example while a dispute about accuracy is resolved.
• Objection — to object to processing carried out on the basis of legitimate interests, and to object at any time to the use of your data for direct marketing.
• Portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another organisation where technically feasible.
• Withdrawal of consent — to withdraw consent at any time where consent is the basis for processing.

To exercise any of these rights, write to commercialisation.ai@gmail.com with enough information for us to identify you and understand what you are asking for. We will respond within the period required by the applicable law — normally one month under the EU and UK GDPR, and 40 days under Hong Kong's Personal Data (Privacy) Ordinance. We do not charge a fee except where a request is manifestly unfounded or excessive, and if we cannot do what you have asked we will tell you why.

One practical point about requests that reach us as a processor. Where the data was passed to us by a partner, we act on that partner's instructions and will refer your request to the partner as the controller, telling you that we have done so. In that situation the partner is the organisation that can act.

Complaining to a supervisory authority

You have the right to complain to a data protection authority. In Hong Kong, that authority is the Privacy Commissioner for Personal Data (PCPD). If you are in the European Union or the United Kingdom and the EU or UK GDPR applies, you may complain to the supervisory authority in the country where you live, where you work, or where the alleged infringement took place — in the UK, the Information Commissioner's Office. We would of course prefer the chance to resolve a concern directly first, and you can raise it with us at the address above.

10. Cookies and local storage

This is deliberately simple, and it is worth stating plainly:

• This website uses no advertising cookies and no third-party trackers. There are no advertising pixels, no social plug-ins that track you, no cross-site tracking and no data brokers.
• No analytics are loaded. We do not run any analytics product on this site. We see only ordinary server logs, as described above.
• A language preference is stored in your browser's localStorage. When you choose a language, the site remembers it locally under the key gesim_lang so that your next visit opens in the same language. It stays on your device, it is not sent to us, and clearing your browser storage removes it. You can also override it at any time by adding ?lang=en to the address.
• Videos are loaded only when you choose to play them. Our video page embeds content published on YouTube by third parties. On page load we display only a still preview image; the YouTube player itself is not created, and no YouTube cookie is set, until you press play. When you do, the video is served from YouTube's privacy-enhanced domain (youtube-nocookie.com), and YouTube may then set cookies or receive your IP address in accordance with Google's own privacy policy. If you prefer not to have any interaction with YouTube, simply do not press play — every video also carries a direct link you can open separately, or you can avoid the page entirely.

Because no cookies are set for advertising or analytics, there is no cookie banner on this site. The only third-party content on the site is the optional video player described above, and it does not load until you actively request it. If we ever add a tool that requires consent, we will ask for that consent first and update this section before doing so.

11. Children

Our service is a business-to-business wholesale service sold to companies. This website and the platform behind it are not directed at children, and we do not knowingly collect personal data from children. Partner accounts must be opened by a business, and the named contacts we deal with are adults acting in a professional capacity. If you believe a child's personal data has reached us, contact us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in our processing, in our suppliers, or in the law. When we do, we publish the revised version on this page, update the "last updated" date below, and increment the version number in the document control block at the top.

Where a change is material — for example a new category of data, a new purpose, or a new category of recipient — we will additionally notify partner companies through their named account contact, and where the law requires it we will ask for consent before the change takes effect. Partners and others are encouraged to check this page periodically; the version and date at the top are the authoritative record of which version is current.

Last updated: [Date] — Version: 0.1 (draft for legal review)

13. Contact

Questions about this policy, requests to exercise your rights, and data protection enquiries of any kind should be sent to commercialisation.ai@gmail.com. Please include your company name and enough detail for us to route the request correctly.

For urgent or time-sensitive matters, WhatsApp is monitored during business hours: +852 9739 8018. Our business hours are , Hong Kong time (UTC+8).

Postal enquiries should be addressed to [Legal entity name], [Registered address]. Complete this before publication.