Política de privacidad

1. Overview

This Privacy Policy explains how BAXPAY collects, uses, shares, and protects personal data when you use BaxSim, our travel eSIM service, including our website, apps, dashboard, and related offerings (the "Service"). BaxSim is the commercial brand name of the Service.

BAXPAY SARL, Société immatriculée au R.C.S. Lille Métropole sous le numéro: 979498706, with registered office at 679 Avenue de la République, 59800 Lille, France, acts as the data controller for personal data processed in connection with the Service, except where we process data solely on behalf of another party. In this Policy, "we", "us", and "our" refer to BAXPAY.

2. Data we collect

You may choose not to provide certain information, but some data is required to create an account, deliver eSIMs, or process payments.

• Account data: name, email address, password hash, profile photo (optional), language, currency, and country preferences.
• Order and billing data: purchase history, plan selections, promo codes used, invoices, and payment status. Payment card details are processed by Stripe; we receive limited tokens and billing metadata, not full card numbers.
• Device and technical data: device model, operating system, app version, IP address, browser type, log files, and diagnostic events needed to deliver and secure the Service.
• eSIM and usage data: ICCID/eSIM identifiers, activation status, data consumption, and carrier routing metadata required to provision connectivity.
• Support communications: messages you send to us, including attachments and troubleshooting information.
• Referral and marketing data: invite codes, referral attribution, cookie/consent choices, and campaign interactions where permitted.

3. How we use personal data

Our legal bases under the GDPR, where applicable, include contract performance, legitimate interests (such as fraud prevention and product improvement), legal obligation, and consent for optional marketing or non-essential cookies.

• Provide, activate, and support eSIM plans and subscriptions.
• Process payments, prevent fraud, and manage account credits or refunds.
• Authenticate users and secure accounts.
• Send service messages such as receipts, installation instructions, usage alerts, and security notices.
• Improve the Service, troubleshoot errors, and perform analytics in aggregated or pseudonymised form.
• Comply with legal obligations and enforce our Terms of Use.
• Send marketing communications where you have opted in or where permitted by law; you may opt out at any time.

4. How we share data

We share personal data only as needed to operate the Service:

We do not sell your personal data.

• Payment processors (e.g. Stripe) to handle transactions.
• Mobile connectivity and eSIM provisioning partners to deliver network access.
• Cloud hosting, email, analytics, customer-support, and security vendors bound by confidentiality and data-processing terms.
• Authorities, regulators, or law enforcement when required by law or to protect rights, safety, and security.
• Successors in the event of a merger, acquisition, or asset sale, subject to this Policy.

5. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure site performance, and understand how the Service is used.

Essential cookies are required for core functionality. Analytics and marketing cookies, where used, are deployed in line with your consent choices where required by law.

You can control cookies through your browser settings; disabling essential cookies may limit functionality.

6. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, including to provide the Service, meet legal/accounting requirements, resolve disputes, and enforce agreements.

Typical retention periods: account data for the life of the account plus a limited period after closure; billing records as required by tax law; support tickets for up to 24 months unless longer retention is required.

7. Security

We implement administrative, technical, and organisational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure; please use a strong password and protect your devices.

8. International transfers

BAXPAY may process data in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms for transfers outside the UK/EEA.

9. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, or port your personal data, and to object to certain processing or withdraw consent.

You may also lodge a complaint with your local data protection authority. We will respond to verified requests within applicable legal timeframes.

You can delete your account and associated personal data yourself at any time — see "Account deletion" below.

To exercise your rights, contact [email protected]. We may need to verify your identity before fulfilling a request.

10. Account deletion

You can permanently delete your account at any time, directly and without contacting us. In the BaxSim mobile app, go to Account and tap "Delete account"; on the web dashboard, open Account and select "Delete account". After a confirmation step, the deletion is processed immediately.

When you delete your account, we permanently remove your personal profile data (such as your name, email, phone number, profile photo, and login credentials) and personal content you created (such as travel journal notes and photos), and we disable all further access to the account. Deletion is irreversible and cannot be undone.

Certain records may be retained after deletion where we are legally required to keep them or have another lawful basis — for example, order, invoice, payment, and credit records needed for tax, accounting, fraud-prevention, and dispute-resolution purposes. These retained records are anonymised or disassociated from your identity where feasible and are deleted once the applicable retention period ends.

11. Children

The Service is not directed to children under 16 (or the minimum digital-consent age in your jurisdiction). We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated date. Where required, we will provide additional notice or seek consent.

13. Contact

Privacy questions or requests: [email protected]

BAXPAY SARL, Société immatriculée au R.C.S. Lille Métropole sous le numéro: 979498706

679 Avenue de la République, 59800 Lille, France