Privacy Policy

1. Data controller

The data controller under the General Data Protection Regulation (GDPR) is:
Richard Benes (trading as Studisim)
Biberhaufenweg 100/68
1220 Vienna
Austria
Email: datenschutz@studisim.at

2. General information

We only process personal data where necessary to provide our website and services, relying on one of the legal bases under Art. 6(1) GDPR: performance of a contract or pre-contractual measures (b), legitimate interest (f), or, where obtained, your consent (a).

2a. eSIMs as a telecommunications service

Studisim sells eSIM data plans in its own name and for its own account – a real telecommunications service used outside our website. This privacy policy only covers personal data processing related to using our website; the actual mobile network connection is provided by the respective mobile network operator at your destination.

3. Hosting and server records

This website and our API are hosted on servers operated by Hetzner Online GmbH within the EU.

We do not keep an access log. Our web server does not record which page was requested when and from which IP address — such logs do not arise here in the first place.

What does arise are operational records: messages from our services and the system about their own operation, such as starts, errors, and rejected sign-in attempts. An IP address appears in them only where the reported event carries one itself. They serve the technical operation and security of the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR) and are deleted after 14 days at the latest. We keep longer only an extract that concerns a specific incident or security event, and only for as long as the investigation is ongoing.

4. Cookies

Browsing this website normally – home page, web shop, FAQ and help pages – sets no cookies, neither our own nor third-party ones. There are three exceptions we mention for completeness:

• Contact form, sign-in and registration: On the contact page as well as on the "My account" and "Create account" pages we embed Cloudflare Turnstile to protect against automated abuse (spam). This establishes a connection to Cloudflare, which may set technically necessary cookies in that context. See section 6 for details.
• Internal admin area: Logging into our internal management dashboard sets a session cookie (admin_session) for the studisim.at domain. This affects only us as the operator, not visitors to the website.
• Web account: When you sign in to the "My account" web area to view your eSIMs and orders, we set a technically necessary session cookie (studisim_session) for the studisim.at domain. It only keeps you signed in during your session, has no advertising or tracking function, and therefore requires no consent.

Should anything change beyond this (e.g. through new features), this policy will be updated accordingly and, if required, consent will be requested.

5. Web analytics (Umami)

We use the self-hosted, open-source analytics software Umami (at analytics.studisim.at) to obtain anonymized, aggregated usage statistics (e.g. number of page views). Umami does not use cookies, does not build personal profiles, and does not allow recognizing individual visitors across websites. Since we operate Umami ourselves, this data is not shared with any third party. Legal basis is our legitimate interest in understanding and improving how our site is used (Art. 6(1)(f) GDPR).

6. Contacting us

If you contact us by email (e.g. office@studisim.at, datenschutz@studisim.at or widerruf@studisim.at) or use our contact form, we process the information you provide (email address, message content) solely to handle your request (legal basis: Art. 6(1)(b) or (f) GDPR).

You can attach images through the contact form, for example a screenshot of your phone. They reach our mailbox together with your message, and we delete them as soon as your request has been dealt with.

Our mailboxes are operated by World4You Internet Services GmbH (Linz, Austria) as a processor, so your message is stored on servers in Austria. No transfer to a third country takes place.

The contact form is additionally protected by Cloudflare Turnstile, a service provided by Cloudflare, Inc. The same applies to the sign-in and account registration forms. Turnstile checks that a submission comes from a human rather than an automated script, replacing traditional image-puzzle captchas. In doing so, technical data (including your IP address and details about your browser and device) is transmitted to and processed by Cloudflare; this happens both directly from your browser and during the subsequent server-side verification. During this verification we do not transmit your email address. The legal basis is our legitimate interest in protecting these forms against spam and abuse (Art. 6(1)(f) GDPR). You can find more information in Cloudflare's privacy policy at cloudflare.com/privacypolicy. The check runs in the background; you do not see anything and do not need to click anything. How Cloudflare processes the data collected in the process is described in its “Turnstile Privacy Addendum” at cloudflare.com/turnstile-privacy-policy. According to Cloudflare, it also uses this data to improve Turnstile's bot detection and is itself the controller for that purpose.

7. Registration and customer account

You create an account on this website (create account); no account is needed to buy – in the web shop you buy as a guest. We store: your email address, your preferred language, and — purely informational, without any access restriction — whether your email address matched a recognized university domain. Legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can have your account deleted in full at any time – just email datenschutz@studisim.at.

Your account also holds your credit from the "Refer a friend" programme: the current balance plus a booking history (credits earned, credit spent on orders, reversals after cancellations). This history exists so money movements remain traceable. Please note: if you delete your account, any remaining credit is forfeited without compensation – it cannot be paid out. Bookings belonging to an order already paid for are retained as part of the payment documentation for the statutory retention period (see section 11), but are detached from your account so they no longer directly identify you.

8. Orders and payment processing

When you place an order, we process the order details (chosen plan, price, order status) and the email address provided by you or by our payment provider. Payment itself is processed by our payment provider Stripe. You enter payment details (e.g. card data) directly with Stripe — we never see or store it ourselves. For more information, see Stripe's own privacy policy at stripe.com/at/privacy. Legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

If you pay with PayPal, the payment window redirects you to PayPal. The recipient of your data is then PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. What data arises there and what PayPal does with it is set out in PayPal's own privacy statement at paypal.com/at/legalhub. This transfer only happens if you choose PayPal as your payment method – if you pay another way, nothing goes to PayPal. Legal basis here too is the performance of a contract (Art. 6(1)(b) GDPR).

Providing your email address is required to conclude the contract and to deliver the eSIM; without it we cannot provide the service.

We assign a top-up to the order with which the eSIM was bought, even if someone other than the buyer tops it up, for example with a gift.

8a. Gift purchases / recipient address

If you buy a data plan as a gift, we process the recipient's email address you provide in order to deliver the activation code to them. The legal basis is performance of the contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in delivery (Art. 6(1)(f) GDPR). We transmit the address to our email provider Resend (processor) for sending. It is retained like the rest of the order data (see section 11). The recipient may object to the processing and exercise their data-subject rights (Art. 15–21 GDPR); see the "Your rights" section.

The person who bought the gift can also see, in their order view and when topping up, how much data is left, how long the eSIM is still valid and whether it has been set up. This lets them top it up in time. They cannot see a usage history. Towards the gift recipient, the legal basis is our legitimate interest and that of the purchaser in keeping the gift usable (Art. 6(1)(f) GDPR).

The recipient did not give us their address themselves. They therefore receive, in the gift or delivery email – our only point of contact with them – a note explaining where we got their address, together with a link to this privacy policy (Art. 14 GDPR).

8b. Record of your consent at checkout

At checkout you confirm two things: that you request that we start providing your eSIM immediately (and that you thereby lose your right of withdrawal once we have fully provided it), and that you have read our terms and withdrawal policy and taken note of this privacy policy and of the contract summary under § 129 TKG 2021. Because we must be able to prove that consent in case of a dispute, we store for each order: the time consent was given, the version and a checksum of the withdrawal text shown to you, the version of the terms and of this privacy policy, the language used, as well as your IP address and your browser identification (user agent).

The legal basis is our statutory duty of proof under the Austrian FAGG (Art. 6(1)(c) GDPR) together with our legitimate interest in being able to provide that proof (Art. 6(1)(f) GDPR). We do not share this record, and we retain it like the rest of the order data (see section 11).

The version is the whole point of recording it: if we change one of those texts later, it remains traceable which wording was actually shown to you for your order. Older orders are not retroactively assigned a newer wording.

8c. If you withdraw from the contract

If you declare your withdrawal using the "Withdraw from contract" form or by email to widerruf@studisim.at, we store what you provide: your name, your email address, the order or receipt number, the wording of your declaration, where applicable your statement on the scope of a partial withdrawal, the time it reached us and the time of our acknowledgement, and the language used. We do not ask for a reason, nor for any evidence – a withdrawal under the Austrian FAGG requires neither.

The legal basis is our statutory duty to acknowledge receipt and to be able to prove it (§ 13a FAGG, Art. 6(1)(c) GDPR), together with the reversal of the contract itself (Art. 6(1)(b) GDPR). We send the acknowledgement via our email service provider Resend (see section 10); beyond that we do not share this information.

The form is reachable without signing in. If what you provide matches no order, we still store the declaration – we must be able to prove that it reached us, even where it cannot be matched to an order at first. A shorter retention applies in that case, see section 11.

9. eSIM delivery

To provision your eSIM, we use your order and contact details. The eSIM profile is obtained from a technical eSIM wholesale partner in an automated process; delivery to you is by email from us (see section 10).

We transmit nothing that directly identifies you to such a partner — no name, no email address, no postal address. Only our own order number and the package code of the plan you booked leave our systems. The order number is a pseudonym: on its own it says nothing about you, but it stays linked to your order on our side and therefore remains personal data. That is not a statement of intent: it is enforced in our code and covered by an automated test (data minimisation, Art. 5(1)(c) GDPR).

9a. Data usage and validity of your eSIM

In your account, in the view of your order and on the gift page, we show for each eSIM how much data is left, how long it is still valid and whether it has been set up. We request these figures from our eSIM wholesale partner without passing on your email address, and we do not store them permanently. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

10. Transactional emails

We send confirmation, delivery, and account-related emails (e.g. registration confirmation, sign-in link, order confirmation, eSIM delivery) via the email service provider Resend. Legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

10a. Reminders about your eSIM

We remind you by email when 80 % of your eSIM's data volume has been used or it is almost used up, and shortly before its validity ends. These emails contain a link to purchase the same plan again. For this purpose we use the email address from your order, the plan details, and the usage and validity data we retrieve from our eSIM wholesale partner, without passing your email address to that partner. The legal basis is our legitimate interest in informing you in good time and in offering you our own, similar products (Art. 6(1)(f) GDPR, § 174(4) of the Austrian Telecommunications Act 2021). You may object to these emails at the time of purchase and at any time afterwards, via the unsubscribe link in every reminder or informally at datenschutz@studisim.at (Art. 21(2) GDPR). You will continue to receive delivery, confirmation and receipt emails.

After a top-up, the reminders start again for the new data and the new term. If you have objected to the reminders, that remains the case.

11. Retention periods

• Account data (including credit balance): until your account is deleted.
• Order and invoice data: at least 7 years under Austrian tax and commercial retention obligations (incl. § 132 BAO) — even after account deletion, since this data is no longer linked to your account but remains subject to a legal retention duty.
• Credit bookings: where they belong to an order, they count as part of the payment documentation and are retained like order data.
• A gift recipient's email address (see section 8a): part of the order data, and retained like it.
• The consent record described in section 8b: part of the order data, and retained like it.
• Objections to reminders (see section 10a): a box ticked at purchase forms part of the order data and is retained like it; an unsubscribe via the link is kept as evidence of the objection, so that we send you no further reminders.
• Withdrawal declarations (see section 8c): 7 years where the declaration can be matched to an order – it then forms part of the payment documentation; 3 years where no match is possible.
• Operational records of the server: 14 days at the latest. No access log is kept (see section 3).

12. International data transfers

Where service providers we use (e.g. payment or email providers) process data outside the EU/EEA, this is based on EU Standard Contractual Clauses or an adequacy decision by the European Commission.

Today this concerns three services, each transferring data to the USA:

• Stripe – payment processing (see section 8).
• Resend – delivery of our emails, such as the order confirmation and the sign-in link (see section 10, and 8a for gift purchases).
• Cloudflare – protection of our forms against automated abuse (see section 6).

For all three, the basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by EU Standard Contractual Clauses (Art. 46 GDPR).

13. Your rights

Subject to applicable law, you have the right to free information about your stored personal data at any time (Art. 15 GDPR), and, where applicable, rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Contact datenschutz@studisim.at for any of these. You also have the right to lodge a complaint with the Austrian data protection authority (dsb.gv.at).

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Changes to this policy

We update this privacy policy whenever our services, the providers we use, or the legal situation change. The version current at the time of your visit applies.