1. Who is responsible
The controller of your personal data is AviaTravel OÜ (registry code 17586406), Tornimäe tn 5, 10145 Tallinn, Estonia. Contact: [email protected].
2. What we collect and why
Email address: to deliver your eSIM, send your receipt, let you sign in and answer your questions. Needed to perform our contract with you.
Order details (plan, price, date, order reference): to provide the service and keep accounting records. Contract and legal obligation.
eSIM details (the eSIM identifier, installation and service status, the plans on it): to deliver and support the service. Contract.
Data usage totals and the country in which the eSIM is connected: to show you your remaining data and to pay our supplier. Contract. We do not see the content of your internet traffic or which sites you visit.
Payment information: your card details go directly to our payment provider. We receive only a payment reference, the amount and whether it succeeded.
Technical logs (IP address, time, browser type): to keep the service secure and prevent fraud. Our legitimate interest.
3. Who receives it
Our connectivity provider in the Netherlands, which issues the eSIM and carries the data. It receives the eSIM details and a random reference we create for your eSIM, not your name or email address. It processes network traffic and location data under its own legal obligations.
Our payment provider, to take your payment.
Our email delivery provider, to send you emails.
Our hosting provider in Germany, where our servers run.
Authorities, where the law requires it.
We do not sell your data and do not use it for advertising.
4. Outside the EU
We store your data in the EU. Where a provider processes data outside the European Economic Area, this happens under the safeguards the law requires, such as standard contractual clauses.
5. How long we keep it
Orders and payment records: 7 years, as Estonian accounting law requires.
Account and eSIM data: while your account exists and for up to 12 months after your last plan ends, unless you ask us to delete it sooner.
Technical logs: up to 90 days.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. Some records we must keep by law even after a deletion request.
Write to [email protected]. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority in your own country.
7. Emails
We send only emails needed for the service: sign-in links, receipts, delivery and refund notices. We do not send marketing emails unless you ask for them.