This policy explains what personal data we collect when you visit baobabsim.com or buy an eSIM, how we use and protect it, which cookies are used and what you can ask of us. We are a Hong Kong company, so we handle personal data under the Personal Data (Privacy) Ordinance (Cap. 486). If you are in the European Economic Area, the GDPR also applies to you. Section 9 sets out your rights under the Ordinance, the GDPR and the data protection laws of Morocco, Egypt and South Africa.
1. Who we are
baobabsim.com is operated by Roamworks Limited, Unit 1603, 16th Floor, The L. Plaza, 367 - 375 Queen’s Road Central, Sheung Wan, Hong Kong, Hong Kong Business Registration number 81414783 (“BaobabSIM”, “we”, “us”). We are the controller of the personal data described here, which the Ordinance calls the data user.
For every question, request or complaint about personal data, write to contact@baobabsim.com.
2. What we collect
When you visit baobabsim.com
- Your browser sends technical data with every request: IP address, browser and device type, the page requested and the referring page. Our content delivery network, Cloudflare, uses it to deliver pages and to protect the site from attacks. Our own web server does not keep access logs.
How we measure
- We count visits with our own analytics (Umami), which runs on our own server and sets no cookies: the pages you view, the referring site and campaign parameters, the plans you select and when you start a checkout, your browser and device type, and an approximate location derived from your IP address. No analytics company receives this, we keep no visitor id, and nothing is stored on your device for it.
When you buy an eSIM
- The details you enter on the Stripe payment page: email address, name on the card, billing country and, for some cards, postal code. Card numbers are handled by Stripe and never reach us.
- Order data: the plan, price, currency, language, time of purchase, the version of the Terms of sale you accepted, and the eSIM delivered to you (its ICCID and activation code, which we store encrypted).
- Where the order came from: the campaign parameters of the link that brought you (for example utm_source), the referring site and the pages you visited before buying. We keep these with the order to know which channels bring customers.
- When your order page is opened, we record the time and a one-way hash of the IP address, to protect your eSIM code against misuse.
- When you start a checkout, your IP address is used in memory to limit repeated attempts. It is not stored.
When you write to us
- Your email address, name and the content of your message.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR for buyers in the EEA) |
|---|---|
| Selling and delivering the eSIM, support and refunds | Performance of the contract with you (Article 6(1)(b)) |
| Accounting and tax records | Our legal obligations (Article 6(1)(c)) |
| Preventing fraud, securing payments and eSIM codes, protecting the site | Our legitimate interest in a secure shop (Article 6(1)(f)) |
| Answering your questions and partnership enquiries | Our legitimate interest in answering you, or steps before a contract you ask for (Article 6(1)(f) or (b)) |
| Measuring how the website is used, which pages and channels bring visitors and customers | Our legitimate interest in understanding how the site is used (Article 6(1)(f)) |
We use personal data only for these purposes. We do not sell personal data. The checkout reminders are described below.
4. Automated decisions
Stripe screens payments for fraud with automated risk scoring. A payment judged high risk may be blocked or may need extra verification such as 3D Secure. If you think a payment was blocked by mistake, write to us and a person will review it.
5. Who receives your data
- Stripe processes payments and screens them for fraud, under its privacy policy at stripe.com/privacy.
- Cloudflare, Inc. delivers and protects the website.
- Our server hosting provider runs the virtual server in the European Union that hosts the website and the order database.
- Our eSIM distributor receives no personal data from us. We buy eSIM profiles without sending your details.
- Our accountants and legal advisers, and public authorities where the law requires it.
6. Transfers outside the European Economic Area
The website and the order database are hosted in the European Union, and Stripe and Cloudflare may process data in the United States and other countries. When personal data leaves the European Economic Area, we rely on the safeguards the GDPR provides: the European Commission’s standard contractual clauses, or its adequacy decision for companies certified under the EU-US Data Privacy Framework. We transfer personal data outside the European Union only to recipients that are bound, by law or by contract, to protect it to a standard comparable to the GDPR. For every buyer, we transfer personal data outside Hong Kong only to recipients that are bound, by law or by contract, to protect it to a standard comparable to the Ordinance. You can ask us for a copy of the safeguards that apply.
7. How long we keep it
We keep personal data only as long as we need it for the purposes above or as the law requires:
- Order and payment records, including the encrypted eSIM details: as long as accounting and tax law requires, normally 5 years from the end of the year of purchase.
- Order page access records (hashed IP address): 12 months.
- Email correspondence: as long as needed to handle the matter and related claims, and no longer than 3 years after it is closed.
- Analytics data: no longer than 14 months.
8. Cookies
The site sets no analytics or advertising cookies. Our analytics is cookieless and needs no consent, and we run no advertising pixels. Cloudflare may set strictly necessary security cookies to tell people from automated traffic. The Stripe payment page, which is served by Stripe, uses its own cookies for payment processing and fraud prevention; see stripe.com/legal/cookies-policy.
For the duration of a browser tab we keep, in that tab’s session storage, the campaign parameters and referring site of the visit (baobabsim:attribution), so an order can record which channel brought the buyer; closing the tab clears it. It is not shared and is not used to follow you around. Your choice of light or dark theme (baobabsim:theme) and about the language hint (baobabsim:language-hint) is kept in your browser’s local storage and never leaves it.
Your cart. The plans you add to your cart are kept in a strictly necessary cookie (baobabsim_cart) for up to 30 days. It holds only each plan’s id, how many you want and the currency you saw, nothing about you, and it is never used to follow you around. Removing the plans, or clearing this site’s cookies in your browser, deletes it.
You can delete or block cookies in your browser settings; blocking Stripe’s cookies may prevent payment.
9. Your rights
Under the Ordinance you can ask us:
- for access to the personal data we hold about you and a copy of it;
- to correct data that is wrong or incomplete.
If you are in the European Economic Area, the GDPR also lets you ask us:
- to delete data we no longer need or have no basis to keep;
- to restrict how we use your data while a question about it is settled;
- for the data you gave us in a portable format;
- to stop using data we process on the basis of our legitimate interests (you can object);
- to withdraw consent at any time, without affecting processing already carried out.
Write to contact@baobabsim.com. We reply within one month, or tell you within that time why we need longer.
You can complain to the Privacy Commissioner for Personal Data, Hong Kong (PCPD, pcpd.org.hk). If you are in the EEA, you can also complain to the data protection authority of the country where you live or work.
If you are in Morocco, you also have the rights that Law No. 09-08 on the protection of individuals with regard to the processing of personal data gives you, and you can contact the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP, cndp.ma).
If you are in Egypt, you also have the rights that Law No. 151 of 2020 on the Protection of Personal Data gives you, and you can contact the Personal Data Protection Center (pdpc.gov.eg).
If you are in South Africa, you also have the rights that the Protection of Personal Information Act 4 of 2013 (POPIA) gives you, and you can complain to the Information Regulator (inforegulator.org.za).
You can use all of these rights the same way, by writing to us.
10. Security
Card data stays with Stripe. eSIM activation codes are encrypted at rest with AES-256-GCM. Access to the order system is restricted, and every time an eSIM code is shown to an administrator it is logged. The site is served only over HTTPS. If a data breach is likely to put your rights at risk, we notify the Privacy Commissioner for Personal Data and, where the risk is high, you, without undue delay. Where the GDPR applies, we also notify the competent supervisory authority within 72 hours.
11. Children
baobabsim.com is not aimed at children under 16, and we do not knowingly collect their data.
12. Changes
When our processing changes, we update this policy and the date at the top of this page.
Checkout reminders
If you give your email address at checkout and do not finish the order, we may send one reminder about that order and, a day later, one email with a 10% single-use code. We rely on our legitimate interest in helping you complete the purchase you started; you can unsubscribe from either email at any time. This section replaces any earlier statement that we do not send marketing messages.