Privacy policy

This policy explains what personal data we collect when you visit vietsim.com or buy an eSIM, how we use and protect it, which cookies are used and what you can ask of us. We handle personal data in line with the EU General Data Protection Regulation (GDPR) and Polish data protection law. The website and the order database run on servers in the European Union.

1. Who we are

vietsim.com is operated by Roamworks Limited 漫行有限公司, Unit 1603, 16th Floor, The L. Plaza, 367 - 375 Queen’s Road Central, Sheung Wan, Hong Kong, Hong Kong Business Registration number 81414783 (“VietSIM”, “we”, “us”). We are the controller of the personal data described here, which the Ordinance calls the data user.

Our data protection team handles every question, request and complaint about personal data: contact@vietsim.com.

2. What we collect

When you visit vietsim.com

• Your browser sends technical data with every request: IP address, browser and device type, the page requested and the referring page. Our content delivery network, Cloudflare, uses it to deliver pages and to protect the site from attacks. Our own web server does not keep access logs.

When you accept analytics cookies

• The pages you view, the referring site and campaign parameters, the plans you select and when you start a checkout, your browser and device type, an approximate location derived from your IP address, and a random visitor id kept in a cookie. Nothing is collected for this purpose if you switch analytics off, and your browser’s Global Privacy Control signal is treated as a refusal.

When you accept marketing cookies

• The Meta Pixel loads in your browser and, together with our server (Meta’s Conversions API), tells Meta Platforms Ireland Limited which pages you view, which plans you select, what you search for on the site and when you start a checkout, with your IP address, your browser and device type, the Meta cookies listed in section 8, and the ad click id when you arrived from a Facebook or Instagram ad.
• When you buy, our server reports the purchase to Meta: the plan, price, currency and order number, with your email address, billing country, the name on your card and your billing postal code (when your card asks for one) sent only as one-way hashes (SHA-256), and the Meta cookies, IP address and browser captured when you started the checkout.
• Meta uses this to measure and improve our ads on Facebook and Instagram, and may link it to your Meta account if you have one. Nothing is sent to Meta if you switch marketing off, and your browser’s Global Privacy Control signal is treated as a refusal. Order pages, which show your eSIM, never load the pixel.

When you buy an eSIM

• The details you enter on the Stripe payment page: email address, name on the card, billing country and, for some cards, postal code. Card numbers are handled by Stripe and never reach us.
• Order data: the plan, price, currency, language, time of purchase, the version of the Terms of sale you accepted, and the eSIM delivered to you (its ICCID and activation code, which we store encrypted).
• Where the order came from: the campaign parameters of the link that brought you (for example utm_source), the referring site and the pages you visited before buying. We keep these with the order to know which channels bring customers.
• When your order page is opened, we record the time and a one-way hash of the IP address, to protect your eSIM code against misuse.
• When you start a checkout, your IP address is used in memory to limit repeated attempts. It is not stored.

When you apply for a Vietnam e-visa or an airport fast track service

• What you type into the application: your name and email address as the contact, and for each traveller their telephone number, permanent address, address in Vietnam and an emergency contact’s name, relationship and telephone number. With them the trip itself: nationality, purpose, entry and exit dates, the border gates, the processing speed and any note you add.
• No passport number and no passport image is collected on this site. If you choose a portrait photograph or a picture of the passport data page, the browser checks the file and keeps it on your device; the desk asks for it separately over its own secure link once your application is open.
• Card details go to Stripe. We receive the amount, the currency and a payment reference, not the card number.
• Your application is sent to our visa desk by email and, once it is paid, summarised in a private Discord channel (name, email, route, dates, gate and amount only). The desk prepares it and files it with Vietnam’s Immigration Department through the official e-visa portal, and the approved e-visa is emailed to you. This website keeps no copy of the application.
• If you enter details about other travellers or about an emergency contact, you confirm that you may pass them to us for this purpose.

When you write to us

• Your email address, name and the content of your message.

Contact form. A message sent through the contact form on this site (your name, email address, phone model, order link and the message itself) is passed to a private team channel on Discord (Discord Inc., United States) and answered by email. The site itself stores nothing from the form.

3. Why we use it and on what basis

We use personal data only for these purposes, or for new purposes we tell you about and, where needed, ask your consent for. We do not send marketing messages and we do not sell personal data.

4. Automated decisions

Stripe screens payments for fraud with automated risk scoring. A payment judged high risk may be blocked or may need extra verification such as 3D Secure. If you think a payment was blocked by mistake, write to us and a person will review it.

5. Who receives your data

• Stripe processes payments and screens them for fraud, under its privacy policy at stripe.com/privacy.
• Cloudflare, Inc. delivers and protects the website.
• Meta Platforms Ireland Limited (Meta Pixel and Conversions API) receives the marketing data described in section 2, only if you accept marketing cookies. We and Meta are jointly responsible for collecting that data and passing it to Meta; what Meta then does with it is governed by Meta’s Privacy Policy at facebook.com/privacy/policy, where you can also exercise your rights with Meta.
• Our server hosting provider runs the servers in the European Union that host the website and the order database.
• Our visa desk partner prepares and files the application on our behalf, under a data processing agreement.
• Vietnam’s Immigration Department receives the application through its official e-visa portal, because an e-visa is issued by it.
• Discord Inc. receives the summary of a paid application (name, email, route, dates, gate and amount) in a private team channel.
• Our eSIM distributor receives no personal data from us. We buy eSIM profiles without sending your details.
• Our accountants and legal advisers, and public authorities where the law requires it.

6. Transfers outside the EEA

Stripe, Cloudflare, Meta and Discord may process data in the United States and other countries, and an application you ask us to file is processed in Vietnam. We transfer personal data outside the European Economic Area only to recipients that ensure an adequate level of protection under the law or a contract, in particular the standard contractual clauses.

7. How long we keep it

We keep personal data only as long as we need it for the purposes above or as the law requires:

• Order and payment records, including the encrypted eSIM details: as long as accounting and tax law requires, normally 5 years from the end of the year of purchase.
• Order page access records (hashed IP address): 12 months.
• Email correspondence: as long as needed to handle the matter and related claims, and no longer than 3 years after it is closed.
• Visa and fast track applications: this site keeps no copy; the desk holds the email under the correspondence rule above.
• Analytics data: no longer than 14 months.
• Analytics and Meta ids stored with an order (the visitor id, the Meta cookies, IP address and browser captured at checkout): 90 days.
• Data received by Meta: as set out in Meta’s Privacy Policy.

8. Cookies

vietsim.com asks for your consent before it sets any analytics or marketing cookie. Marketing cookies are set on our domain by the Meta Pixel and let Meta recognise your browser on other websites that use Meta’s tools.

You can change your choice at any time with Cookie settings at the bottom of every page; switching a category off deletes its cookies.

For the duration of a browser tab we keep, in that tab’s session storage, the campaign parameters and referring site of the visit, so an order can record which channel brought the buyer; closing the tab clears it. It is not shared and is not used to follow you around.

• Cloudflare may set strictly necessary security cookies to tell people from automated traffic.
• The Stripe payment page, which is served by Stripe, uses its own cookies for payment processing and fraud prevention; see stripe.com/legal/cookies-policy.

If we add other cookies, we will update this section and ask for your consent where required. You can delete or block cookies in your browser settings; blocking Stripe’s cookies may prevent payment.

9. Your rights

You can:

• ask what personal data we hold about you and how it is used and who it is disclosed to;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data or restrict its processing, and receive the data you gave us in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, after which we stop using the data for that purpose unless the law allows us to continue. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Write to contact@vietsim.com. We reply within 30 days, or tell you within that time when we will be able to reply.

You can complain to the Privacy Commissioner for Personal Data, Hong Kong (PCPD, pcpd.org.hk).

If you are in Vietnam, you also have rights under the Law on Personal Data Protection (Law No. 91/2025/QH15), including the rights to be informed, to access, correct and delete your data and to withdraw consent. You can use them in the same way.

10. Security

Card data stays with Stripe. eSIM activation codes are encrypted at rest with AES-256-GCM. Access to the order system is restricted, and every time an eSIM code is shown to an administrator it is logged. The site is served only over HTTPS. If a data breach is likely to put your rights or freedoms at risk, we notify you and the President of the Personal Data Protection Office (UODO) as the GDPR requires.

11. Children

vietsim.com is not aimed at children under 16, and we do not knowingly collect their data. A parent or guardian files a visa application for a child, and the child’s details are used only to prepare and file that application.

12. Changes

When our processing changes, we update this policy and the date at the top of this page.