Pular para o conteúdo
alizeoo

Privacy policy

Este documento ainda não está disponível em português. Ele é exibido em inglês; as versões de referência são a francesa e a inglesa.

RASCUNHO a ser validado por um advogado. Este texto não é definitivo: não tem valor contratual enquanto não for redigido e validado. Os trechos marcados “A COMPLETAR” devem ser substituídos.

Draft privacy policy (GDPR). The processing list below reflects how the product works today; retention periods are proposals to be confirmed.

1. Data controller

Data controller: [TO COMPLETE: data controller] ([TO COMPLETE: company name], [TO COMPLETE: registered office address]). Data protection officer contact: [TO COMPLETE: DPO contact].

A completar / validar: Determine whether a DPO is mandatory; otherwise give a contact point. Maintain the records of processing (art. 30).

2. Processing, purposes and legal bases

  • Account and sign-in: e-mail, first and last name, country, language, signed-in devices and sessions, one-time codes. Purpose: create and secure the account. Basis: contract.
  • Orders and invoicing: plan, amount, taxes, status, invoices. Purpose: deliver, invoice, accounting. Basis: contract and legal obligation.
  • Payment via Stripe: card data is entered with Stripe; Alizeoo receives the payment status and a transaction ID, never the card number. Basis: contract; fraud prevention: legitimate interest.
  • eSIM supply by third-party providers (Airalo, Keepgo, eSIM Access, depending on the plan): order data needed to issue and track the eSIM. Basis: contract.
  • Usage tracking and alerts (remaining GB, expiry), app notifications. Basis: contract; push notifications: consent.
  • Transactional e-mails (sign-in code, confirmation, eSIM ready, dispute) via a sending provider: [TO COMPLETE: e-mail sending provider]. Basis: contract.
  • Support and disputes: messages, evidence, history of refund decisions. Basis: contract and legitimate interest.
  • Security and fraud prevention: technical logs, IP address, rate limiting, audit log. Basis: legitimate interest.
  • Audience measurement: only with your consent (see cookie policy). No non-essential tracker before your choice. Basis: consent.
  • Marketing: no prospecting or advertising tracker is enabled today; any change will require separate consent. Basis: consent.

A completar / validar: Validate each legal basis, add the final e-mail provider, the exact list of processors and the data each eSIM provider actually receives.

3. Recipients and transfers outside the EU

Recipients: authorised Alizeoo staff; processors (host: Contabo GmbH; Stripe; eSIM providers; e-mail provider). Some may process data outside the European Union.

A completar / validar: Sign processing agreements (art. 28), document transfer safeguards (SCCs / adequacy decision).

4. Retention periods (to be confirmed)

  • Account: while active, then [to confirm: 3 years after last activity].
  • Orders and invoices: [to confirm: 10 years, accounting obligation].
  • Technical and security logs: [to confirm: 12 months maximum].
  • Support and disputes: [to confirm: 5 years after closure].
  • Cookie consent choice: 6 months.

A completar / validar: Set durations with the lawyer and accountant, then align with the API purge job (phase 0 plan §4.2).

5. Your rights

Access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time. From your account you can export your data and delete your account. For any request: [TO COMPLETE: DPO contact]. You may lodge a complaint with: [TO COMPLETE: supervisory authority].

6. Security

Passwordless sign-in, revocable sessions, encrypted communications, restricted access, audit log.

A completar / validar: Describe the measures actually in place in production after the penetration test.

7. Minors and changes

A completar / validar: Minimum age, change-notification process, last-updated date.