The controller of personal data is Lukáš Hruška, Company ID: 23500026, registered at Labská louka 668/15, 500 11 Hradec Králové, sole trader registered in the Czech trade register, not a VAT payer. Contact: info@sbaldata.cz.
Order and eSIM delivery (e-mail, order contents, payment identifiers, date and time, currency, country and package, and campaign tag from a link where applicable). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Accounting and tax records: legal obligation (point c). Customer account and login (e-mail, one-time code, login token): performance of a contract. Support and complaints (our communication with you): contract / legitimate interest. Fraud and abuse prevention, establishing and defending legal claims (technical data such as IP address, order records): legitimate interest (point f). We do not process payment card data; it is handled solely by Stripe. Contact form and Google sign-in (your name if provided, e-mail, message text, the page you write from; with Google sign-in, your e-mail and Google account identifier): handling your enquiry and performing the contract / legitimate interest.
Order data and accounting records are kept for the period required by law (generally 10 years). Customer account data is kept until the account is deleted, or as needed to protect legal claims. Verification codes are valid for 10 minutes and login sessions for 30 days. Support communication is kept for up to 3 years.
We share data only with necessary processors: the payment gateway provider, the hosting and database provider, e-mail service providers, a third-party sign-in provider (only if you use it), the eSIM supplier (receives only the technical data needed to create and manage the eSIM) and, as needed, accounting and legal advisers. Some processors are based outside the EU; transfers rely on an adequacy decision or standard contractual clauses. We will provide the list of specific processors on request at info@sbaldata.cz.
The Website only uses essential browser storage (selected language and currency, login token), which does not require consent. If we add analytics or advertising tools in future, we will ask for your consent first.
Communication with the Website is encrypted (HTTPS/TLS). Order and account data are stored in a secured database with access limited to the operator. Sign-in codes and login tokens are not stored in readable form (only their hash); IP addresses used for fraud prevention are stored only in a shortened, unreadable form. Sign-in uses a one-time code or Google and we do not store passwords.
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. You may withdraw consent at any time where given. Send requests to info@sbaldata.cz. You may also lodge a complaint with a supervisory authority: the Czech Office for Personal Data Protection (www.uoou.gov.cz) or the authority in your country of residence. Providing the data needed for an order is a contractual requirement; without it we cannot deliver the eSIM. There is no automated decision-making or profiling with legal effects.