This policy explains what personal data we collect when you visit vietsim.com or buy an eSIM, how we use and protect it, which cookies are used and what you can ask of us. We handle personal data in line with Singapore’s Personal Data Protection Act 2012 (PDPA). The website and the order database are hosted in Singapore.
1. Who we are
vietsim.com is operated by LuKas Holdings sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warsaw, Poland, KRS 0001233010, NIP 7011306806 (“VietSim”, “we”, “us”).
Our Data Protection Officer handles every question, request and complaint about personal data: [email protected].
2. What we collect
When you visit vietsim.com
- Your browser sends technical data with every request: IP address, browser and device type, the page requested and the referring page. Our content delivery network, Cloudflare, uses it to deliver pages and to protect the site from attacks. Our own web server does not keep access logs.
When you buy an eSIM
- The details you enter on the Stripe payment page: email address, name on the card, billing country and, for some cards, postal code. Card numbers are handled by Stripe and never reach us.
- Order data: the plan, price, currency, language, time of purchase, the version of the Terms of sale you accepted, and the eSIM delivered to you (its ICCID and activation code, which we store encrypted).
- When your order page is opened, we record the time and a one-way hash of the IP address, to protect your eSIM code against misuse.
- When you start a checkout, your IP address is used in memory to limit repeated attempts. It is not stored.
When you write to us
- Your email address, name and the content of your message.
3. Why we use it and on what basis
| Purpose | Basis under the PDPA |
|---|---|
| Selling and delivering the eSIM, support and refunds | Your consent, given when you provide your details to complete the purchase |
| Accounting and tax records | Required or authorised by law |
| Preventing fraud, securing payments and eSIM codes, protecting the site | Legitimate interests exception |
| Answering your questions and partnership enquiries | Your consent, given when you write to us |
We use personal data only for these purposes, or for new purposes we tell you about and, where needed, ask your consent for. We do not send marketing messages and we do not sell personal data.
4. Automated decisions
Stripe screens payments for fraud with automated risk scoring. A payment judged high risk may be blocked or may need extra verification such as 3D Secure. If you think a payment was blocked by mistake, write to us and a person will review it.
5. Who receives your data
- Stripe processes payments and screens them for fraud, under its privacy policy at stripe.com/privacy.
- Cloudflare, Inc. delivers and protects the website.
- Our server hosting provider runs the virtual server in Singapore that hosts the website and the order database.
- Our eSIM distributor receives no personal data from us. We buy eSIM profiles without sending your details.
- Our accountants and legal advisers, and public authorities where the law requires it.
6. Transfers outside Singapore
Stripe and Cloudflare may process data in the United States and other countries, and our team works from Poland. We transfer personal data outside Singapore only to recipients that are bound, by law or by contract, to protect it to a standard comparable to the PDPA.
7. How long we keep it
We keep personal data only as long as we need it for the purposes above or as the law requires:
- Order and payment records, including the encrypted eSIM details: as long as accounting and tax law requires, normally 5 years from the end of the year of purchase.
- Order page access records (hashed IP address): 12 months.
- Email correspondence: as long as needed to handle the matter and related claims, and no longer than 3 years after it is closed.
8. Cookies
vietsim.com itself does not set cookies. We do not use analytics or advertising cookies, and we do not track you across other websites.
- Cloudflare may set strictly necessary security cookies to tell people from automated traffic.
- The Stripe payment page, which is served by Stripe, uses its own cookies for payment processing and fraud prevention; see stripe.com/legal/cookies-policy.
If we add other cookies, we will update this section and ask for your consent where required. You can delete or block cookies in your browser settings; blocking Stripe’s cookies may prevent payment.
9. Your rights
You can:
- ask what personal data we hold about you and how it has been used and disclosed in the past year;
- ask us to correct data that is wrong or incomplete;
- withdraw your consent at any time, after which we stop using the data for that purpose unless the law allows us to continue. Withdrawing consent before delivery means we cannot complete an order.
Write to [email protected]. We reply within 30 days, or tell you within that time when we will be able to reply.
If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.
If you are in Vietnam, you also have rights under the Law on Personal Data Protection (Law No. 91/2025/QH15), including the rights to be informed, to access, correct and delete your data and to withdraw consent. You can use them in the same way.
10. Security
Card data stays with Stripe. eSIM activation codes are encrypted at rest with AES-256-GCM. Access to the order system is restricted, and every time an eSIM code is shown to an administrator it is logged. The site is served only over HTTPS. If a data breach is likely to cause you significant harm, we notify you and the Personal Data Protection Commission as the PDPA requires.
11. Children
vietsim.com is not aimed at children under 16, and we do not knowingly collect their data.
12. Changes
When our processing changes, we update this policy and the date at the top of this page.