The controller of personal data is Lukáš Hruška, Company ID: 23500026, registered at Kratonohy 23, 503 24 Kratonohy, sole trader registered in the Czech trade register, not a VAT payer. Contact: info@sbaldata.cz.
Order and eSIM delivery (e-mail, order contents, payment identifiers, date and time, currency, country and package, and campaign tag from a link where applicable). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Accounting and tax records: legal obligation (point c). Customer account and login (e-mail, one-time code, login token): performance of a contract. Support and complaints (our communication with you): contract / legitimate interest. Fraud and abuse prevention, establishing and defending legal claims (technical data such as IP address, order records): legitimate interest (point f). We do not process payment card data; it is handled solely by Stripe. Contact form and Google sign-in (your name if provided, e-mail, message text, the page you write from; with Google sign-in, your e-mail and Google account identifier): handling your enquiry and performing the contract / legitimate interest. Newsletter (e-mail, language, date of sign-up and confirmation): sending news and offers based on your consent (point a); we keep the data until you unsubscribe, which you can do at any time via the link in every e-mail or at info@sbaldata.cz. Analytics and marketing cookies: only with your consent (point a), see section 5.
Order data and accounting records are kept for the period required by law (generally 10 years). Customer account data is kept until the account is deleted, or as needed to protect legal claims. Verification codes are valid for 10 minutes and login sessions for 30 days. Support communication is kept for up to 3 years.
We share data only with necessary processors: the payment gateway provider, the hosting and database provider, e-mail service providers, a third-party sign-in provider (only if you use it), the eSIM supplier (receives only the technical data needed to create and manage the eSIM) and, as needed, accounting and legal advisers. Some processors are based outside the EU; transfers rely on an adequacy decision or standard contractual clauses. After payment, Google may offer you a short survey to rate your purchase (Google Customer Reviews programme). If you agree, we share your e-mail address, order number and country with Google so it can send you the survey; Google then processes them under its privacy policy. Taking part is voluntary. We will provide the list of specific processors on request at info@sbaldata.cz.
Reviews. After a purchase we send you one e-mail asking for a review (about 3 days after you start using the eSIM), based on our legitimate interest in feedback on our own service. You can opt out of further requests at any time with one click on the link in the e-mail. If you write a review, we publish on the website the name you enter, the stars, the text, the destination and the month of purchase. We never publish your e-mail or order number. We keep the review while the website operates or until you ask us to delete it at info@sbaldata.cz.
The website uses essential browser storage (selected language and currency, sign-in token and your cookie choice), which does not require consent. We use analytics cookies (e.g. Google Analytics – measuring visits) and marketing cookies (e.g. Meta Pixel – measuring ad performance) only if you consent in the cookie banner; without consent these tools are not loaded at all. You can change or withdraw your consent at any time via “Cookie settings” in the website footer (shown when we use these tools). We remember your choice for 12 months. Providers of these tools may process data outside the EU on the basis of an adequacy decision or standard contractual clauses.
Communication with the Website is encrypted (HTTPS/TLS). Order and account data are stored in a secured database with access limited to the operator. Sign-in codes and login tokens are not stored in readable form (only their hash); IP addresses used for fraud prevention are stored only in a shortened, unreadable form. Sign-in uses a one-time code or Google and we do not store passwords.
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. You may withdraw consent at any time where given. Send requests to info@sbaldata.cz. You may also lodge a complaint with a supervisory authority: the Czech Office for Personal Data Protection (www.uoou.gov.cz) or the authority in your country of residence. Providing the data needed for an order is a contractual requirement; without it we cannot deliver the eSIM. There is no automated decision-making or profiling with legal effects.
We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR. We may update this policy; the current version is always published on this page and we notify customers of material changes in advance by e-mail. This policy is effective from 15 October 2026.