Privacy policy (GDPR)

Last updated: 2026-10-19

This policy explains what personal data we process on simy.ro, for which purposes, on which legal bases (EU Regulation 2016/679 — GDPR and Romanian Law 190/2018) and what rights you have. It complements the terms and conditions and the cookie policy.

1. Data controller

The controller is Web Vibes S.R.L (CUI RO41018641, Trade Register J21/356/2019), registered office: Str. Artelor nr. 42, Tândărei, jud. Ialomița, 925200.

We have not appointed a DPO. For GDPR requests, write to the address above with the subject “GDPR”.

2. Data we process

  • Customer account: email, password (hashed), optional name, OAuth identifiers (Google/Facebook) if you sign in socially.
  • Order: email, phone (optional), order reference, eSIM plan, amount, currency, payment and eSIM status, internal support notes.
  • Billing: for individuals — minimal data on a simplified invoice (no national ID number). For companies — CUI, name, address, trade register, if you provide them.
  • eSIM delivery: ICCID, profile status, LPA/SM-DP+ instructions needed for installation.
  • Contact: name, email, phone, message, order number (if you send it).
  • Technical: IP address, error logs, session and preference cookies (language, cookie consent). Details in the cookie policy.
  • Payment: we do not store card numbers. Payment is processed by NETOPIA Payments; we only receive transaction confirmation (status, reference).

We do not collect national ID numbers, health data or other special categories of data under GDPR Article 9.

3. Purposes and legal bases

Purpose Legal basis (GDPR Art. 6)
Account, order, eSIM delivery, support Performance of a contract — Art. 6(1)(b)
Invoicing, accounting, e-Factura (ANAF), tax duties Legal obligation — Art. 6(1)(c)
Analytics / marketing cookies (GTM etc.) Consent — Art. 6(1)(a)
Fraud prevention, site security, defending legal claims Legitimate interest — Art. 6(1)(f)
Contact form Legitimate interest (replying) and, where applicable, contract — Art. 6(1)(f)/(b)

We do not use your data for direct email marketing without a separate consent. We do not sell personal data.

4. Who we share data with

We disclose data only to processors or authorities as needed:

  • NETOPIA Payments — card payment processing.
  • Wholesale eSIM provider — issuing the eSIM profile (technical order data, not the card).
  • ANAF / SPV — e-Invoicing where reporting is legally required.
  • Hosting / email — the hosting provider and, if configured, SMTP for order emails.
  • Google / Meta — only if you sign in with OAuth or, with consent, via analytics/marketing cookies (Google Tag Manager).
  • Authorities — where legally required (data protection authority, tax authorities, courts).

Some partners may process data outside the EEA. In that case we rely on standard contractual clauses or other GDPR-approved safeguards.

5. How long we keep data

  • Orders and invoices: 10 years, in line with accounting / tax archiving rules.
  • Customer account: until you delete the account or request erasure, to the extent the law allows (invoices remain archived).
  • Contact messages: up to 24 months after the last reply, then deletion or anonymisation.
  • Technical logs: generally up to 12 months.
  • Cookies: as described in the cookie policy.

6. Your rights

You may request, under GDPR:

  • access;
  • rectification;
  • erasure (“right to be forgotten”), where no legal retention ground remains;
  • restriction of processing;
  • portability of data you provided;
  • objection to processing based on legitimate interest;
  • withdrawal of consent for optional cookies at any time (without affecting prior processing).

Send your request via contact or office@simy.ro. We reply within 30 days. We may need to verify your identity (e.g. confirmation from the account email).

You may lodge a complaint with ANSPDCP — the Romanian Data Protection Authority: www.dataprotection.ro.

7. Security

We use HTTPS, hashed passwords, CRM access limited to administrators, and payment data handled by the authorised processor. No internet transmission is 100% secure; we take reasonable protection measures.

8. Minors

The service is intended for people aged 16 or older (or the age of majority in your country, if higher). We do not knowingly collect data from children. If we learn that we have, we delete it.

9. Changes

We may update this policy. The current version is published on this page with the last-updated date. For orders, the policy at the time of purchase applies, together with any later legal obligations.

Web Vibes S.R.L — RO41018641

Questions about terms or orders?

Contact