隱私政策

Breezesim Limited is committed to protecting and respecting your privacy. This policy explains how we collect, use, share, store, and protect your personal data when you use our website or app, buy or use our eSIM and connectivity services, or otherwise deal with us, and it sets out your rights and how the law protects you.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Where we offer our services to people in the European Economic Area, the EU GDPR also applies, and this policy is written to satisfy both. This policy is governed by the laws of England and Wales.

1. Who we are and how to contact us

Data controller. The controller responsible for your personal data is Breezesim Limited, trading as Breeze, a company incorporated in England and Wales with company number 16221665, whose registered office is at First Floor, 18-19 South Bar Street, Banbury, Oxfordshire, OX16 9AF.

Group context. Breezesim Limited is part of the eSIM Go group of companies. Other group companies may process your personal data as controllers or processors where this is necessary for the purposes described in this policy. Where they do, they do so under appropriate intra-group arrangements and consistently with this policy.

ICO registration. Breezesim Limited is registered with the Information Commissioner's Office under registration number ZB884635. The following group companies, which may also process your personal data as controllers for the purposes described in this policy, are registered as follows:

eSIM Go Limited, ICO registration number ZB280759.
ESG UK MVNA Limited, ICO registration number ZB885387.

Data Protection Officer. Our Data Protection Officer is Craig Kingham. You can contact the DPO at dataprivacy@breezesim.com or by writing to the Data Protection Officer at our registered office above.

Representative in the European Union. Our EU representative under Article 27 EU GDPR is being appointed and will be named in this policy shortly.

Our Cookie Policy is at breezesim.com/pages/cookie-policy and forms part of this policy.

2. We are a communications provider, and what that means for your data

Breeze is a provider of a public electronic communications service in the United Kingdom. We resell airtime obtained from upstream mobile network operators and international carriers, and we are responsible to you for the service you buy from us.

Because we are a communications provider, PECR applies to us in addition to the UK GDPR. In practice this means three things that are worth knowing.

There are specific legal rules on what we may do with traffic data and location data, over and above the general data protection rules. Section 6 explains how we handle them.
We are required to keep a log of personal data breaches and to notify the Information Commissioner's Office of a personal data breach within 24 hours of becoming aware of it, which is a shorter deadline than applies to most organisations. Section 13 explains what we will tell you.
We are subject to the rules on unsolicited marketing in PECR, which sit alongside the consent rules in the UK GDPR. Section 11 explains your choices.

3. The personal data we collect

We may collect and process the following categories of personal data.

Identity and contact data: your name, billing address, email address, and telephone number.
Account data: your account credentials and settings, and records relating to your account such as dates of payments owed and received and top-up information.
Transaction and payment data: details of the products and services you have bought and the payments you have made. Card details are collected and processed by our payment providers and are not stored by us. See section 12.
eSIM and device data: the identifiers of the eSIM profile we issue to you (the ICCID, and the EID of the device it is installed on), any IMSI or MSISDN associated with it, whether the profile has been downloaded and installed, and the make and model of your device where you tell us or where we need it to check compatibility.
Connectivity data, including traffic and location data: records generated by the mobile networks your device connects to, including the identity of the network and the country you are connected to, session start and end times, and the volume of data you use. We also infer the status of your eSIM from network and usage data. We do not have access to the content of your mobile data.
Service-level data: information about the service you receive, such as network faults and other network events that may affect our services.
Technical and usage data: information collected through cookies and similar technologies when you visit our website. See section 14 and our Cookie Policy.
App and device data: device identifiers, device model, push notification tokens, app diagnostics, crash data, and in-app usage and activity data.
Correspondence and support data: records of your communications with us, including support tickets, complaints, and feedback.
Affiliate and referral data: if you arrived via an affiliate or referral link, we collect referral identifiers to attribute your visit and, where applicable, to calculate affiliate commissions.

Special category data. We do not ordinarily collect or process special category personal data, such as data revealing health, race, or ethnicity. Please do not send us such data unless we specifically ask for it and explain the lawful basis for processing it.

4. How we collect your personal data

We collect personal data in three ways. First, directly from you, when you register an account, place an order, top up, contact us, or otherwise deal with us. Second, automatically, through cookies and similar technologies and through your use of our network and services. Third, from third parties, including our upstream network partners, our resellers, distributors, and affiliates, and our payment providers, where they pass us data necessary to provide the service to you or to complete your purchase.

5. Why we use your personal data, and our lawful bases

We will only use your personal data when the law allows us to. The table below sets out, for each purpose, the data we use, the lawful basis we rely on under Article 6 UK GDPR, and how long we keep it.

Purpose	Categories of personal data	Lawful basis	Retention
Creating and managing your account, verifying your identity, and providing, activating, and managing your eSIM and connectivity service	Identity and contact data, account data, eSIM profile identifiers (ICCID, EID), device compatibility information	Art.6(1)(b) — performance of a contract with you, or steps taken at your request before entering into one	2 years from your last transaction with us
Processing payments, top-ups, refunds, and chargebacks, and maintaining billing records	Transaction and payment data, billing country, IP address at the point of purchase	Art.6(1)(b) — contract; Art.6(1)(c) — legal obligation (VAT and accounting records)	7 years from the transaction
Operating the mobile data service, including routing your traffic, applying your data allowance, and determining the status of your eSIM	ICCID, EID, IMSI, MSISDN where allocated, network and country of connection, session start/end times, data volume used	Art.6(1)(b) — contract; Art.6(1)(c) — legal obligation under PECR in relation to traffic data	Traffic data: 12 months, after which it is deleted or irreversibly anonymised
Managing our network, monitoring service quality, and diagnosing and resolving faults	Service-use and connectivity data, service-level data	Art.6(1)(f) — legitimate interests in operating a reliable and secure network	12 months
Providing customer support and handling complaints, queries, and requests	Identity and contact data, account data, correspondence and support records	Art.6(1)(b) — contract; Art.6(1)(f) — legitimate interests in keeping a record of what we were asked and what we did	24 months from closure of the support ticket
Keeping our services, network, and systems secure, and detecting, investigating, and preventing fraud, crime, and misuse	Account data, service-use data, technical data, transaction data	Art.6(1)(f) — legitimate interests in security and fraud prevention; Art.6(1)(c) where a legal obligation applies	12 months, or longer where an investigation is open
Sending you service messages and operational notices, for example about maintenance, outages, or changes to terms	Identity and contact data, account data	Art.6(1)(b) — contract; Art.6(1)(f) — legitimate interests in keeping you informed about the service	Duration of your plan
Marketing our own similar products and services to you as an existing customer, where you have not opted out	Identity and contact data, account data, marketing preferences	Art.6(1)(f) — legitimate interests in direct marketing, relying on the soft opt-in in Regulation 22 of PECR	Until you object, plus 6 months to evidence the request
Sending you marketing where you have given us your consent	Identity and contact data, marketing preferences	Art.6(1)(a) — consent, which you may withdraw at any time	Until you withdraw consent, plus 6 months to evidence the withdrawal
Managing our affiliate programme and attributing referrals	Affiliate and referral identifiers, order data	Art.6(1)(b) — contract (with affiliates); Art.6(1)(f) — legitimate interests in operating a referral programme	Duration of the affiliate relationship plus 7 years for commission records
Measuring how our website and app are used, crash reporting, and, where you allow it, advertising	Technical and usage data, device identifiers, push notification tokens, SDK and diagnostic data	Consent for non-essential cookies, SDKs, and similar technologies under Regulation 6 of PECR; Art.6(1)(f) for subsequent analysis	As set out in our Cookie Policy
Complying with our legal and regulatory obligations, including tax, accounting, telecoms regulatory obligations, and lawful requests from public authorities	Any relevant data	Art.6(1)(c) — legal obligation	As required by the obligation
Managing corporate transactions and establishing, exercising, or defending legal claims	Any relevant data	Art.6(1)(f) — legitimate interests in running and protecting our business and enforcing or defending our legal rights	6 years from resolution, or from the end of any limitation period if longer

Legitimate interests. Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests are not overridden by your interests, rights, and freedoms. You can ask us for further information about that assessment using the contact details in section 1.

Change of purpose. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for a compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the lawful basis that allows us to do so.

6. Traffic and location data

A mobile data service cannot work without generating records of where a device connected and how much data it used. The visited network knows your device is present on it. That is how roaming works, and it is not something any provider can switch off.

In practice this means we hold records showing which country and which mobile network your eSIM has been active on, and when. We use these records to apply your data allowance correctly, to reconcile what our upstream carriers charge us, to diagnose faults, and to detect misuse.

We do not use these records to build a picture of your movements for marketing purposes, and we do not sell or share them for advertising.

We do not have access to the content of your communications. We cannot see the websites you visit over an encrypted connection, the content of your messages, or the content of your calls.

We keep traffic data for 12 months, after which it is deleted or irreversibly anonymised. Anonymised statistics derived from traffic data are not personal data and are not covered by this policy.

7. Who we share your personal data with

We do not sell your personal data, and we do not share it for third party advertising. We share it only as described below, and only as far as each recipient needs it.

Upstream network partners. The mobile network operators, international carriers, and wholesale connectivity providers from whom we obtain airtime, and the visited networks in the countries you travel to. Without this the service cannot be provided.
Our eSIM platform. The platform that generates and delivers your eSIM profile and manages it over the air is operated by a company within our own group, not by an unrelated third party.
Service providers and processors. Companies that process personal data on our behalf under written contracts requiring them to keep it secure and to use it only on our instructions. This includes IT, hosting and infrastructure providers, our e-commerce platform, customer support platform, email marketing platform, and analytics providers. A full list of our sub-processors is available on request from dataprivacy@breezesim.com.
Payment providers. For website purchases, card payments are processed by Elavon and Adyen. For in-app purchases, payments are processed by Adyen, including Apple Pay, which tokenises through Adyen. These providers collect and store your card data directly. We do not store full card details.
AI service providers. Our AI assistant, SIMon, is powered by third-party providers of conversational AI and large language models, which process the queries you send to it under written data processing agreements. We minimise the personal data included in those queries and do not use them to train third-party models.
Affiliate network providers. Where you arrived via an affiliate link, we share referral and conversion data with our affiliate tracking platform to attribute your purchase correctly.
Group companies, where necessary for the purposes set out in this policy.
Travel partners, only where you have asked us to. See section 8.
Professional advisers, auditors, and insurers, where they need it.
Regulators, law enforcement, and other authorities, where we are required or permitted by law to disclose. See section 9.
Actual or prospective buyers or successors, in connection with a merger, acquisition, or other change of control, in which case the recipient may use the data in accordance with applicable law and this policy.

8. Buying through a travel partner

Some Breeze eSIMs are sold through websites carrying the brand of an airline or other travel partner. If you bought that way, you are buying from Breezesim Limited and we are the controller of your personal data for the eSIM service. The partner is not.

We do not pass your personal data back to the travel partner unless you have asked us to, for example so that they can credit loyalty points to your account. Where you give that consent, we share only what is needed for that purpose, the partner then handles your data as its own controller under its own privacy notice, and you can withdraw your consent at any time using the contact details in section 1. Withdrawing it does not affect anything already done, and it does not affect your eSIM service.

9. Law enforcement and other legal disclosures

As a communications provider we may be required by law to disclose data to law enforcement agencies, regulators, or courts. We do not disclose customer data to any authority unless we are satisfied that the request is lawful, comes from a body with jurisdiction over us, and has been properly made. We disclose only what the request requires.

Where we are legally permitted to tell you that a request has been made, we will. Often we are not.

10. Sending your data outside the UK

Your data will leave the United Kingdom in two ways.

First, because you are roaming. When you use a Breeze eSIM abroad, your connection is carried by a mobile network in the country you are in, and the records of that connection are generated there. This is inherent to the service you have asked us to provide, wherever in the world you travel.

Second, because some of our service providers are based outside the UK. A number of our technology and service providers are based in the United States. Where we transfer data to a country covered by a UK adequacy decision, we rely on that decision. Where we transfer data to the United States or other countries without a UK adequacy decision, we put an appropriate safeguard in place, such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a transfer risk assessment. You can ask us for further information about the safeguards we use by contacting us using the details in section 1.

11. Marketing and your choices

Where you have consented, or where the soft opt-in under Regulation 22 of PECR applies because you are an existing customer and we are marketing our own similar products and services, we may send you marketing communications.

You can opt out at any time, free of charge, using the unsubscribe link in any marketing message, in your account or app settings, or by contacting us using the details in section 1. We will act on it promptly and without asking you why.

Opting out of marketing does not affect service or transactional messages that we need to send you in connection with your account.

12. How long we keep your personal data

The retention column in section 5 sets out the period that applies to each purpose. Where more than one applies to the same data, we keep it for the longest applicable period and then securely delete or anonymise it.

If your account is inactive for 18 months with no login, purchase, or eSIM usage, we will notify you that your account will be closed if you take no action within 30 days. If no action is taken, we close the account and the 2-year retention period runs from the date of closure.

If you close your account, we delete or anonymise your data at the end of the applicable periods rather than immediately, because we still need to meet our tax and regulatory obligations and to be able to deal with any dispute.

13. How we keep your personal data secure, and what happens if something goes wrong

We use technical and organisational measures appropriate to the risk, including role-based access controls, encryption in transit and at rest where appropriate, logging and monitoring, supplier due diligence and written contracts, and staff training. We keep these measures under regular review. Where a processor handles your data on our behalf, we require it to apply equivalent security measures.

As a provider of a public electronic communications service we maintain a personal data breach log and we notify the Information Commissioner's Office of a personal data breach within 24 hours of becoming aware of it. Where a breach is likely to adversely affect your personal data or privacy, we will also tell you directly, without undue delay, and explain what has happened and what you can do about it.

14. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember your preferences, and understand how our website is used. Non-essential cookies are set only with your consent, which you can give, refuse, or withdraw at any time through our cookie banner and preference centre. Our Cookie Policy at breezesim.com/pages/cookie-policy lists what we set, what each one does, and how long it lasts.

In our mobile app we use software development kits and device identifiers for analytics and crash reporting. You can manage analytics preferences in the app at Profile > Notification preferences > Privacy > 'Share usage data'. This is set to off by default.

15. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. If that changes, we will update this policy and tell you about the logic involved and the significance and consequences of the processing.

16. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the following rights in relation to your personal data. Some apply only in certain circumstances, and we will always tell you which one we are relying on if we cannot do what you have asked.

Right	What it means
Right to be informed	To be told, in a clear and transparent way, how we use your personal data. That is the purpose of this notice.
Right of access (Article 15)	To obtain confirmation that we process your personal data, a copy of it, and certain supplementary information. This is often called a subject access request.
Rectification (Article 16)	To have inaccurate personal data corrected and incomplete data completed.
Erasure (Article 17)	To ask us to delete your personal data in certain circumstances. You can start an account deletion request from the Profile section of our mobile app. Your account will be deleted, but we are required to keep certain transaction and VAT records by law.
Restriction (Article 18)	To ask us to limit how we use your personal data in certain circumstances, for example while you contest its accuracy.
Portability (Article 20)	To receive the personal data you provided to us in a structured, commonly used, and machine readable format, and to have it sent to another controller where technically feasible, where the processing is based on consent or a contract and is carried out by automated means.
Objection (Article 21)	To object to processing based on our legitimate interests. If you object to direct marketing we will stop immediately, without exception and without needing a reason.
Automated decisions (Article 22)	Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make such decisions about you. See section 15.
Withdrawal of consent	Where we rely on your consent, to withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it.
Right to complain	To lodge a complaint with the Information Commissioner's Office, or with your local supervisory authority if you are in the EEA. See section 19.

17. How to exercise your rights

No fee. You will not have to pay a fee to access your personal data or to exercise any of your other rights.

Time for response. We will respond within one month of receipt. If your request is complex we may extend that period by up to a further two months, in which case we will tell you within the first month and explain why.

How to make a request. Contact us at dataprivacy@breezesim.com or write to the Data Protection Officer at our registered office in section 1.

18. Children

Our services are not directed at children. In the United Kingdom, if you are under 13 you need a parent or guardian to buy on your behalf and to provide any personal data for you. In the European Economic Area the age is between 13 and 16 depending on the country. Our mobile app is subject to the age ratings applied by the app stores, and you must not use it if you do not meet the minimum age requirement.

If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it. If you believe that has happened, please contact us.

19. Complaints

We would prefer to deal with any concern directly, so please contact us first using the details in section 1.

You also have the right to complain at any time to the Information Commissioner's Office, the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are in the European Economic Area, you may instead complain to the supervisory authority in the country where you live, where you work, or where the problem happened, and you may contact our European representative named in section 1.

20. Changes to this policy

We may update this policy from time to time. The version number and the last updated date are at the top. Where a change materially affects you, we will tell you by posting the updated policy on our website and, where appropriate, by email or through the service before it takes effect. We will not treat your continued use of the service as agreement to a change.

Annex A: Additional information for customers in the European Economic Area

Where we offer our services to you in the EEA, the EU GDPR applies to that processing in addition to the UK GDPR. This policy is written to satisfy both. Our representative under Article 27 of the EU GDPR is named in section 1, and you may raise any request or complaint with them.