Privacy policy

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phoenix Immobilien Invest GmbH
(operator of the online shop “easysimy”, www.easysimy.com)
Schützenstraße 8b
32584 Löhne
Germany

Represented by: Aydin Akkaya (Managing Director)
Commercial register: Local Court (Amtsgericht) Bad Oeynhausen, HRB 20708
Email: support@easysimy.com

2. Data Protection Officer

No data protection officer has been appointed, as the legal requirements for this (Art. 37 GDPR, § 38 German Federal Data Protection Act, BDSG) are currently not met. If you have any questions about data protection, please contact the address given above.

3. Hosting and Provision of the Website by Shopify

Our online shop is operated on the technical infrastructure of Shopify International Limited, Ireland, and Shopify Inc., Canada (“Shopify”). In doing so, Shopify processes on our behalf, among other things, IP addresses, order and payment data as well as server log files. The legal basis is Art. 6 (1) lit. b and lit. f GDPR; a data processing agreement pursuant to Art. 28 GDPR is in place with Shopify. Further information can be found in Shopify’s privacy policy.

4. Collection and Storage When Visiting the Website

When you visit our website, our hosting provider automatically collects information in so-called server log files that your browser transmits automatically (IP address, date and time of the request, browser type, operating system, referrer URL). This data is used exclusively to ensure trouble-free operation, to secure our systems and to improve our offering. The legal basis is Art. 6 (1) lit. f GDPR; our legitimate interest lies in the secure and stable operation of the website.

5. Orders and Contract Processing

When you purchase an eSIM in our shop, we collect and process the data required for contract processing (name, email address, billing address, payment data and, where applicable, device and eSIM-related technical details). The legal basis is Art. 6 (1) lit. b GDPR (performance of the contract) and Art. 6 (1) lit. c GDPR (retention obligations under commercial and tax law). To provide the eSIM, we pass on the data required for this purpose to the respective network or eSIM provider; this is also based on Art. 6 (1) lit. b GDPR.

6. Payment Processing

Payment is made via the payment methods offered in the ordering process. These include Shopify Payments and Shop Pay (Shopify International Limited, Ireland) for card payments as well as iDEAL, EPS and Sofortüberweisung, and also PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). The data required for payment (payment data, billing address, transaction amount) is transmitted to the respective payment service provider. The legal basis is Art. 6 (1) lit. b GDPR. The payment service providers partly process the data under their own responsibility; in this respect, their privacy policies apply in addition.

7. Contact Form and Newsletter Sign-up

If you use our contact form, we process the data you provide (name, email address, content of the message) in order to answer your enquiry. The legal basis is Art. 6 (1) lit. b GDPR insofar as the enquiry serves the initiation or performance of a contract, otherwise Art. 6 (1) lit. f GDPR (legitimate interest in answering enquiries).

If you sign up for our newsletter, we process your email address in order to send you information about offers, destinations and new products. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. You can revoke your consent at any time with effect for the future via the unsubscribe link in every email or by sending a message to support@easysimy.com. The lawfulness of the processing carried out until revocation remains unaffected.

8. Cookies and Consent Management

Our website uses cookies and similar technologies. We use technically necessary cookies, which are required for the operation of the shop and the shopping cart, on the basis of § 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR.

All other cookies and technologies – in particular for analysis and marketing, i.e. the services described in sections 9 to 13 below – are only set after your prior, express consent via our cookie consent tool. The legal basis is Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG. As long as you have not given your consent, the processing described in sections 9 to 13 does not take place. You can revoke or adjust your consent at any time with effect for the future via the cookie settings in the page footer.

9. Web Analytics – Google Analytics

Insofar as you have consented, we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies that enable an analysis of the use of our website (e.g. truncated IP address, page views, time spent). The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. A transfer to servers in the USA cannot be ruled out; see section 14 in this regard.

10. Online Marketing – Google Ads

Insofar as you have consented, we use Google Ads of Google Ireland Limited to advertise our offers outside our website and to measure success (conversion tracking). Cookies are set that enable an analysis of the use of our ads. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR.

11. Meta Pixel (Facebook/Instagram)

Insofar as you have consented, we use the Meta Pixel of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This enables tracking of user behaviour after you have seen or clicked on a Facebook or Instagram ad (conversion measurement) as well as the creation of target audiences for advertising purposes. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR.

12. TikTok Pixel

Insofar as you have consented, we use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland, to measure the effectiveness of our ads on TikTok and to create target audiences. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR.

13. Email Marketing – Klaviyo

Insofar as you have consented, we use the Klaviyo platform (Klaviyo, Inc., Boston, Massachusetts, USA) to send newsletters and marketing emails. Your email address and, where applicable, your name and purchasing behaviour are processed in order to send you personalised advertising emails. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. For transfers to the USA, see section 14.

14. Transfers to Third Countries

As a rule, we process your data within the European Union or the European Economic Area. A transfer to a third country may occur in the following cases:

  • Canada (Shopify Inc.): An adequacy decision of the European Commission exists for Canada for organisations subject to PIPEDA (Art. 45 GDPR).
  • USA (including Klaviyo as well as group companies of Google, Meta and TikTok): The transfer is based on an adequacy decision under the EU-US Data Privacy Framework insofar as the respective company is certified, otherwise on the basis of the European Commission’s standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR.

We would like to point out that third countries may not offer a level of data protection comparable to that of the EU and that authorities there may have more extensive access rights. You can request a copy of the respective safeguards via the contact address given above.

15. Storage Period

We store personal data only for as long as necessary for the respective purposes. Data from contract processing is generally retained for 6 or 10 years due to retention obligations under commercial and tax law (§ 257 German Commercial Code (HGB), § 147 German Fiscal Code (AO)). Data processed on the basis of consent is deleted after revocation, unless a further statutory retention obligation exists.

16. Your Rights as a Data Subject

You have the following rights vis-à-vis us:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise any of these rights, please contact: support@easysimy.com

17. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Düsseldorf.

18. Data Security

During your visit to the website, we use the widespread SSL/TLS procedure (Transport Layer Security) in conjunction with the highest level of encryption supported by your browser.

19. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The current version then applies to your next visit.

Last updated: August 2026