Privacy policy

Data controller: [TO COMPLETE: data controller] ([TO COMPLETE: company name], [TO COMPLETE: registered office address]). Data protection officer contact: [TO COMPLETE: DPO contact].

要追記・要確認： Determine whether a DPO is mandatory; otherwise give a contact point. Maintain the records of processing (art. 30).

• Account and sign-in: e-mail, first and last name, country, language, signed-in devices and sessions, one-time codes. Purpose: create and secure the account. Basis: contract.
• Orders and invoicing: plan, amount, taxes, status, invoices. Purpose: deliver, invoice, accounting. Basis: contract and legal obligation.
• Payment via Stripe: card data is entered with Stripe; Alizeoo receives the payment status and a transaction ID, never the card number. Basis: contract; fraud prevention: legitimate interest.
• eSIM supply by third-party providers (Airalo, Keepgo, eSIM Access, depending on the plan): order data needed to issue and track the eSIM. Basis: contract.
• Usage tracking and alerts (remaining GB, expiry), app notifications. Basis: contract; push notifications: consent.
• Transactional e-mails (sign-in code, confirmation, eSIM ready, dispute) via a sending provider: [TO COMPLETE: e-mail sending provider]. Basis: contract.
• Support and disputes: messages, evidence, history of refund decisions. Basis: contract and legitimate interest.
• Security and fraud prevention: technical logs, IP address, rate limiting, audit log. Basis: legitimate interest.
• Audience measurement: only with your consent (see cookie policy). No non-essential tracker before your choice. Basis: consent.
• Marketing: no prospecting or advertising tracker is enabled today; any change will require separate consent. Basis: consent.

要追記・要確認： Validate each legal basis, add the final e-mail provider, the exact list of processors and the data each eSIM provider actually receives.

Recipients: authorised Alizeoo staff; processors (host: Contabo GmbH; Stripe; eSIM providers; e-mail provider). Some may process data outside the European Union.

要追記・要確認： Sign processing agreements (art. 28), document transfer safeguards (SCCs / adequacy decision).

• Account: while active, then [to confirm: 3 years after last activity].
• Orders and invoices: [to confirm: 10 years, accounting obligation].
• Technical and security logs: [to confirm: 12 months maximum].
• Support and disputes: [to confirm: 5 years after closure].
• Cookie consent choice: 6 months.

要追記・要確認： Set durations with the lawyer and accountant, then align with the API purge job (phase 0 plan §4.2).

Access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time. From your account you can export your data and delete your account. For any request: [TO COMPLETE: DPO contact]. You may lodge a complaint with: [TO COMPLETE: supervisory authority].

Passwordless sign-in, revocable sessions, encrypted communications, restricted access, audit log.

要追記・要確認： Describe the measures actually in place in production after the penetration test.

要追記・要確認： Minimum age, change-notification process, last-updated date.