Privacy Policy

Who this policy covers

This policy explains what LOKUM TECH LLC ("Esimbit", "we") does with personal data on esimbit.com: the marketing site, and the reseller panel you sign in to. For everything described here, we are the controller — we decide why the data is held and what happens to it.

If you bought an eSIM from a store built on Esimbit, this is not your policy. Each store publishes its own privacy notice, and the reseller who runs that store is the controller for your order. Read the notice on the store you bought from.

We still hold that shopper data, because the store runs on our software. We hold it on the reseller’s instructions, as their processor, and what we may do with it is set by the Data Processing Addendum rather than by this policy.

What we collect, and where it comes from

Most of this you type in yourself. The rest arrives because you used the service, or because Stripe told us your subscription changed.

We never see your card number. Subscribing sends you to Stripe’s own hosted checkout page, and the card details you type there go to Stripe, not to us. What comes back is a status and a reference.

Separately from personal data, your workspace holds the provider and payment-gateway keys you connect. Those are your secrets, not your identity: they are encrypted at rest, used only to call those services on your behalf, and never returned in full — the panel is sent only the last four characters of a stored key, so that you can tell two connections apart. The Data Processing Addendum and the Security page describe how they are handled.

Why we process it, and on what legal basis

Where we rely on a legitimate interest, you can object, and we will stop unless we can show grounds that override yours. Where we rely on consent, withdrawing it is one email and costs you nothing else — the account carries on as before.

Things we do not do: we do not sell personal data, we do not share it for anyone else’s advertising, we do not build profiles of you, and we make no automated decision that produces a legal effect for you or similarly significantly affects you.

Cookies, local storage, and the tracking we do not do

Your browser loads nothing on esimbit.com from anyone else. There is no analytics, no tag manager, no advertising pixel, no session replay, no social widget and no third-party script or font. Fonts and icons are served from our own servers. Stripe is reached by sending your whole browser to Stripe, not by embedding Stripe’s code in our page. The site is delivered through a proxy and security network, which is listed as a supplier below.

So there is no analytics or advertising storage on this site to consent to, and no toggle offering one. What we store on your device is a short list: your language, your panel theme, your sign-in token, the cookie choice you made, and — only if you allow it — which notices you have already dismissed. The proxy may set a cookie of its own to tell people from automated traffic, which is a security function rather than a tracking one. Every item, what it is for and how long it lasts is set out on the Cookies and local storage page.

This section describes esimbit.com. A reseller’s storefront is a different site with its own register and its own consent choice, described in that store’s own pages.

Who else sees it

We use a small number of suppliers to run the service. They process data on our instructions, under contract, and for nothing of their own.

The authoritative list, with each supplier’s role and location, is Annex 2 of the Data Processing Addendum. That list is maintained; this table is a summary of it.

Stripe is in this table and not in that annex, which is correct: it bills our own subscriptions, where we are the controller and you are the customer. It is not a sub-processor of your shoppers’ data and never receives any.

Beyond those: we disclose data to professional advisers where we need advice, to an acquirer if the business is ever sold, and to a court or a regulator where we are legally required to. We tell you before a disclosure of that last kind unless we are forbidden from telling you.

Where the data lives

The production database and its backups are in Frankfurt, Germany (eu-central-1).

Some suppliers in the list above operate outside that region, so data reaches them there. Where a transfer leaves the EEA or the UK to a country without an adequacy decision, we rely on the European Commission’s standard contractual clauses, with the UK addendum where the UK is involved, plus whatever additional measures the transfer needs. Transfers out of Turkey are covered separately below.

You can ask us for a copy of the safeguards that apply to a specific transfer by writing to [email protected].

How long we keep it

Nothing in the platform deletes itself: there is no automatic expiry, no scheduled cleanup and no background job that removes old records. Every period below is a decision the operator makes and then has to carry out.

Pending team invitations are an exception: each one carries its own expiry date, set when it is sent, and it stops being usable then. You can revoke one earlier from the panel.

Where a record has to be kept for tax or accounting reasons, we keep it for that reason alone and do not go on using it for anything else.

Security

Passwords are stored as hashes. Provider and gateway credentials are encrypted at rest. Traffic to the site and to our API is encrypted in transit. Access to production is limited to the people who need it to do their jobs.

The Security page describes the controls in more detail and gives the address for reporting a vulnerability. We would rather hear about a problem from you than not hear about it.

Your rights under the GDPR

If the GDPR applies to you, you can ask us to do any of the following.

• Confirm whether we hold data about you, and give you a copy of it.
• Correct anything inaccurate, or complete anything that is missing.
• Erase data where we no longer have a good reason to hold it.
• Restrict what we do with it while a dispute about it is being sorted out.
• Give you the data you provided in a portable, machine-readable form, or send it to someone else where that is technically feasible.
• Stop processing you object to, where we relied on a legitimate interest.
• Withdraw a consent you gave. That does not undo what we did while the consent stood.

Some of this is faster to do yourself: your name, email and language are editable in the panel, and you can change your password there. For everything else, write to [email protected]. We may have to check who you are before we act, which for an account holder normally means writing from the address on the account.

The GDPR gives us one month to answer. We can extend that by two further months if the request is complex, and if we do, we will tell you within the first month and say why. Requests are free unless one is manifestly unfounded or excessive.

Turkey: your rights under the KVKK

This section is the aydınlatma — the notice Article 10 of Law No. 6698 requires us to give you when we collect your data. The data controller (veri sorumlusu) is LOKUM TECH LLC, at 8 The Green, Suite A Dover, DE 19901. Our representative in Turkey is [email protected]. What we collect, why, and who we share it with are the same as the sections above.

Article 11 gives you a list of rights that is not the same list as the GDPR’s, so it is set out here in its own terms rather than folded into the section above. You may:

• learn whether we process your personal data at all;
• request information about it if we do;
• learn the purpose we process it for, and whether it is used in line with that purpose;
• learn who we transfer it to, in Turkey or abroad;
• have it corrected if it is incomplete or wrong;
• have it erased or destroyed where the conditions in Article 7 are met;
• require that a correction, erasure or destruction is notified to the third parties we transferred the data to;
• object to a result reached against you purely by automated analysis of your data;
• claim compensation if unlawful processing has caused you damage.

The eighth right has nothing to bite on here: we run no automated analysis that produces a decision about you. We list it because Article 11 lists it, not because we do it.

Turkey: how to apply, and transfers abroad

Article 13 sets how to ask. Apply to us in writing, or by any other method the Personal Data Protection Board has approved, at [email protected] or at the address above. Say what you want and give us enough to identify you. We will answer within thirty days at the latest, and free of charge — unless answering has a cost of its own, in which case we may charge the fee in the Board’s tariff.

If we refuse, if our answer does not satisfy you, or if we do not answer in time, you can complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within thirty days of learning our answer, and in any case within sixty days of the date you applied to us.

Your data may be transferred abroad, because some of the suppliers listed above operate outside Turkey. Since the amendments made by Law No. 7499, such transfers rest on an adequacy decision by the Board, on an appropriate safeguard such as a standard contract notified to the Board within five business days of signature, or on one of the case-by-case exceptions in Article 9, including your explicit consent. The route we rely on is a standard contract under KVKK Article 9(5), notified to the Personal Data Protection Authority within five business days of signature.

This policy is published in English only, including this section. That is a deliberate choice: one authoritative text avoids the situation where a translation and an original quietly say different things. If you would rather correspond in Turkish, write to us in Turkish.

Children

Esimbit is a business tool sold to companies that resell eSIMs. It is not designed for children, not marketed to them, and not something a child would have a reason to sign up for. We do not knowingly collect data from children.

If you believe a child has given us personal data, write to [email protected] and we will delete it. As elsewhere on this platform, deletion is done by hand rather than by a scheduled job.

Changes to this policy

When this text changes, we publish the new version with a new date at the top. The date is the honest signal: if it has not moved, nothing has changed.

If a change materially affects what we do with your data, we will email account holders before it takes effect, so that anyone who disagrees has the chance to close their account first.

Contacting us, and complaining about us

Please come to us first. Most of what goes wrong is something we can fix faster than a regulator can ask us to.

You do not have to, though. If the GDPR applies to you, you can complain to the supervisory authority where you live, where you work, or where you think the problem happened. Our lead supervisory authority is Esimbit has no establishment in the EU, so no single lead supervisory authority applies; you may complain to the authority where you live, where you work, or where the problem happened.. In Turkey, the authority is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).