Privacy Policy

Last updated: 3 November 2026

This privacy policy explains which personal data we process when you visit www.buddysim.com or www.buddysim.ch, use our BuddySIM app for iOS and Android, receive an eSIM via one of our partner pages (for example from tour operators or hotels), place an order with us or contact us, including via WhatsApp. Our Cookie Policy explains in detail which cookies and similar technologies we use on the website, how long they are stored and how you can change your choice. It forms part of this privacy policy.

1. Controller

7 Marketplace GmbH (BuddySIM is a brand of 7 Marketplace GmbH)
Vorgebirgsstraße 11
53913 Swisttal
Germany

Managing Director: Rafael Gomez
Phone: +49 2234 219 0667
Email for data protection requests: datenschutz@buddysim.com
Further details: Imprint

2. Overview and legal bases

We only process personal data where there is a legal basis. These are mainly:

• Contract (Art. 6(1)(b) GDPR): your order, providing your eSIM, customer service, payment processing.
• Legal obligation (Art. 6(1)(c) GDPR): for example retention under commercial and tax law, proof of consent.
• Legitimate interest (Art. 6(1)(f) GDPR): for example a secure and stable shop, fraud prevention, settlement with partners, answering enquiries.
• Consent (Art. 6(1)(a) GDPR): for example newsletter, statistics and marketing services.

Storing and reading information on your device (cookies, browser storage, pixels) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We set strictly necessary cookies without consent under Section 25(2) no. 2 TDDDG. All other cookies in the functional, performance and targeting categories are only set with your consent (Section 25(1) TDDDG). Details for each service can be found in the Cookie Policy.

Section 25 TDDDG also applies to our app. Section 6 explains what the app stores on your device.

We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR).

3. Hosting, servers and security

Shopify

Our shop runs on the Shopify platform. The provider for customers in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores the shop content and, when you visit a page, processes technical data (IP address, browser data, page visited, time) as well as your order and customer data. Data may be transferred to Shopify Inc. in Canada and the USA. There is an EU Commission adequacy decision for Canada, and Shopify Inc. is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) and (f) GDPR. Shopify privacy information: www.shopify.com/legal/privacy.

Cloudflare

Shopify uses the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to deliver and protect the shop. We also use Cloudflare ourselves to protect, deliver and run our own services, including our partner pages (section 7). Cloudflare processes connection data such as your IP address to detect attacks and bots, and the data you enter on these pages. Legal basis: Art. 6(1)(b) GDPR where this concerns providing your eSIM, otherwise Art. 6(1)(f) GDPR (legitimate interest in secure and stable services). Cloudflare is certified under the EU-US Data Privacy Framework.

Our own servers

The servers for our app, our customer service and our internal administration are operated for us by a hosting provider in Germany. The data named in sections 6, 8 and 14 is stored there. Legal basis: Art. 6(1)(b) and (f) GDPR.

Server log data

When you visit our pages or use the app, data such as IP address, date and time, page visited, referrer URL, browser type and operating system are processed for technical reasons. This is necessary to deliver the page and ensure security (Art. 6(1)(f) GDPR).

Encryption

Our pages and the app transmit data in encrypted form (TLS). On the website you can recognise this by “https://” and the padlock icon in your browser's address bar.

4. Cookies and consent tool

To obtain your consent on the website we use the Pandectes tool of Pandectes OÜ, Pudisoo küla, Männimäe/1, 74626 Kuusalu vald, Estonia. It stores your choice for 12 months in the cookie _pandectes_gdpr and sends it to Pandectes together with a random consent ID and the time, so that we can prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can withdraw or change your consent at any time with effect for the future: via the “Cookie Settings” link in the footer of every page or via the cookie icon at the bottom left. The Cookie Policy explains which services belong to which category, which cookies they set and how long these are stored.

5. Orders, eSIM provision and payment

Orders and contract performance

When you place an order, we process your order data (for example name, email address, billing address, selected plan, payment method, order number) and communication data in order to perform the contract, provide your eSIM, send you order and service emails and answer queries (Art. 6(1)(b) GDPR). For your eSIM we also store the eSIM number (ICCID), the activation code, validity, data allowance and usage. If you create a customer account in the shop, we store your data for future orders until you have the account deleted. We retain documents relevant under commercial and tax law for up to 10 years (Art. 6(1)(c) GDPR in conjunction with Section 257 HGB, Section 147 AO).

eSIM provision via eSIM Go

The eSIM profiles and data packages are sourced and managed by our supplier eSIM Go Limited, First Floor, 18–19 South Bar Street, Banbury, Oxfordshire, OX16 9AF, United Kingdom. For this we transmit the order reference, the selected package and, for top-ups, the ICCID. We also use eSIM Go to retrieve the status and usage of your eSIM, for example for display in the app, in customer service and for top-ups. The legal basis is Art. 6(1)(b) GDPR. There is an EU Commission adequacy decision for the United Kingdom.

Order and service emails

We send order confirmations, eSIM emails with QR code, top-up confirmations and emails about refunds from the app and from our partner pages via SendGrid, a service of Twilio Inc., USA. SendGrid receives your email address, your name and the content of the email. The legal basis is Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework where the recipient is certified under it, otherwise on the EU Commission's Standard Contractual Clauses. Order and service emails from the shop are sent by Shopify (section 3).

Payment services

Payments are processed by the following providers. They receive the payment data they need for the payment (for example name, amount, card details or bank details). We do not store full card details. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for fraud prevention. The terms and privacy information of the respective provider also apply to the payment.

• Shopify Payments (in the shop: credit card, Apple Pay, Google Pay, BLIK, EPS and others) and Shop Pay: Shopify International Limited (as above). Payments are processed by Shopify Payments and its payment service providers. For Apple Pay and Google Pay, the privacy information of Apple or Google also applies.
• Klarna (in the shop via Shopify Payments): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose Klarna, we transmit your order and contact data to Klarna. Klarna may carry out an identity and credit check and is itself responsible for this. Privacy information: www.klarna.com/international/privacy-policy.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy information: www.paypal.com/de/legalhub/privacy-full.
• Payments in the app and on our partner pages (including Apple Pay and Google Pay): Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Data may be transferred to Stripe, Inc. in the USA (EU-US Data Privacy Framework). Privacy information: stripe.com/privacy.

Refunds

If you request a refund, for example in the app, via WhatsApp or by email, we check on the basis of the order and the eSIM status (installed, used, age of the order) whether the conditions are met, and pay out via the original payment service or as credit. The legal basis is Art. 6(1)(b) and (c) GDPR.

Accounting and tax

We pass order and invoice data to our tax adviser and our accounting service providers in order to meet our statutory accounting and tax obligations (Art. 6(1)(c) GDPR).

6. BuddySIM app

The following information also applies to our “BuddySIM” app for iOS and Android.

Download

You download the app from Apple's App Store or Google Play. Apple or Google process data such as your account, your device identifier and the time of the download under their own responsibility. We have no influence on this.

Account and login

In the app you can buy as a guest or create an account. For the account we process your email address, your password (only as an encrypted hash) and, if you wish, name, phone number and billing address. For guest purchases we create an account with your email address, which you can take over later. You can add an eSIM you received in the shop or from a partner to the app using your email address and ICCID. To reset your password we send you a time-limited code. The legal basis is Art. 6(1)(b) GDPR.

Purchases, top-ups and eSIM management

In the app you can see your eSIMs, orders, remaining data and validity, and buy and top up packages. For this we process the order and eSIM data named in section 5. Payments are made via the payment services named in section 5. If you abandon a purchase, we store the open transaction with its payment status. The legal basis is Art. 6(1)(b) GDPR.

Push notifications

You only receive push notifications if you have allowed them in your device's prompt (Art. 6(1)(a) GDPR). For this we process a device-specific push identifier (token) and send notices, for example about your order, installation and data usage. We only send offers and reminders by push (marketing push) if you have consented to marketing (section 9). Notifications are delivered via Apple Push Notification Service or Google's Firebase Cloud Messaging. We control sending via Klaviyo (section 9) and, for in-app notices, via the push service of Expo (650 Industries, Inc., USA). Transfers to the USA are based on the EU-US Data Privacy Framework where the recipient is certified under it, otherwise on the EU Commission's Standard Contractual Clauses. You can switch off push notifications at any time in your device settings.

App analytics with Google Analytics for Firebase

To improve the app we use Google Analytics for Firebase of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records screens viewed and events such as starting and completing a purchase, top-up, eSIM installation and refund request, partly with product, price and ICCID, as well as device and app information. After login we link the events to a pseudonymous user ID (our internal account number, not your email address). The app does not collect advertising IDs (IDFA, Android advertising ID) and does not track you across other companies' apps or websites. In the current app version, analytics is active from app start; the legal basis is then our legitimate interest in a working and improved app (Art. 6(1)(f) GDPR). With one of the next app versions we will ask for your consent; from then on, analytics only runs if you agree (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), and you can withdraw your consent in the app. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).

Device storage, camera and photos

The app stores on your device what it needs to work: your login (in the protected device storage), language setting and a referral code through which you came to the app (Section 25(2) no. 2 TDDDG). The app only accesses the camera and photos if you allow it, for example to scan or save a QR code. This happens on your device. We only receive a screenshot if you attach it to a support request yourself.

DataMiles, referrals and leaderboard

For our DataMiles loyalty programme we process points balance, point transactions, loyalty tier and countries visited. If someone uses your referral code, we assign the referral to both accounts. In the leaderboard, your display name, number of countries visited and, if you enter it voluntarily, your Instagram name may be visible to other users. You can hide yourself there and delete the Instagram name at any time. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the leaderboard.

Travel groups

In a travel group you can add fellow travellers with name and email address in order to provide them with an eSIM. Please only enter other people's data if you are entitled to do so. We only use this data to provide the eSIM and for the related service emails. Within the group, members can see the display name, email address and eSIM status of the other members. The legal basis is Art. 6(1)(b) and (f) GDPR.

Links into the app and partner icon

Links to www.buddysim.com, for example to a country, an eSIM or a referral code, can open the app directly. If you have a partner code from a travel partner, the app can switch its icon to that partner's icon. This only happens on your device.

Deleting your account

You can delete your account in the app under “Account” or request deletion at datenschutz@buddysim.com. Data that we are required to retain is blocked until the retention period expires.

7. Partner offers

Pages for cooperation partners

For cooperation partners (for example tour operators, travel agencies or hotels) through which customers receive eSIMs, we run dedicated pages through which their customers can redeem an eSIM voucher, buy an eSIM or top it up. We are responsible for these pages. There we process first name, last name, email address, the voucher or booking code, the destination, the selected package and, for top-ups, the ICCID. To provide the eSIM, send the eSIM email, process payments and store the data, we use the service providers named in sections 3 and 5. The legal basis is Art. 6(1)(b) GDPR.

In its partner area, the respective partner can see for the vouchers it has issued whether and when they were redeemed and the email address provided. This serves settlement with and proof towards the partner (Art. 6(1)(f) GDPR). The partner is responsible for your travel booking itself; its privacy information applies.

Purchases via marketplaces and comparison portals

If you buy a BuddySIM eSIM via a marketplace or comparison portal, the respective operator is responsible for the purchase. It transmits to us the data we need to provide the eSIM and customer service, usually order number, product and email address. The legal basis is Art. 6(1)(b) and (f) GDPR.

Business customers

For business customers and resellers we process the contact data of the contact persons and the data from the business relationship, including in our portals for business customers (Art. 6(1)(b) and (f) GDPR).

8. Contact, customer service and WhatsApp

Email and phone

If you contact us by email or phone, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Our email mailboxes are run on Google Workspace of Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). We delete the data once your request has been dealt with and no retention obligation applies.

Support in the app

We store requests you make in the app, with your messages, attached screenshots and the data of your account and eSIM, on our servers (section 3) in order to handle your request (Art. 6(1)(b) GDPR).

WhatsApp

We use WhatsApp Business to communicate with customers. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Messages are transmitted in encrypted form. Because we use Meta's WhatsApp Business Platform, they are decrypted on Meta's servers and forwarded to us. WhatsApp also receives metadata (for example sender, recipient, time) and, according to its own information, shares data with Meta Platforms, Inc. in the USA (EU-US Data Privacy Framework). We process your phone number, your WhatsApp profile name, the messages and files you send, and the data on your order and eSIM that you ask about. The legal basis is Art. 6(1)(b) GDPR if it concerns your order, otherwise Art. 6(1)(f) GDPR (fast communication via the channel you have chosen). We only send you messages via WhatsApp that are not part of customer service, for example offers, with your consent (Art. 6(1)(a) GDPR). Privacy information: www.whatsapp.com/legal/privacy-policy-eea.

ManyChat chatbot

On WhatsApp we answer some requests automatically with ManyChat (ManyChat, Inc., 535 Everett Ave, Palo Alto, CA 94301, USA), for example for topping up an eSIM, installation questions or a refund request. ManyChat processes your messages, your profile name, your phone number, the email address, order number or ICCID you provide and the chat histories. The legal basis is Art. 6(1)(b) GDPR insofar as it concerns your order, otherwise Art. 6(1)(f) GDPR (efficient customer communication). According to ManyChat, transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Privacy information: manychat.com/legal/privacy.

AI support in customer service

We analyse messages to our customer service via WhatsApp and email with the help of AI in order to recognise the request, match the relevant order or eSIM and prepare a reply. Simple requests may be answered automatically; our team reviews and answers all others. For this we transmit the content of your message, your name, your contact details and the necessary order and eSIM data to Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. The transfer is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR insofar as it concerns your order, otherwise Art. 6(1)(f) GDPR (fast and consistently good answers). No decisions with legal effect within the meaning of Art. 22 GDPR are made.

9. Newsletter, email and push marketing (Klaviyo)

For our newsletter and for notifications in the app we use Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA. If you subscribe to the newsletter, we process your email address and any other voluntary information, the time of subscription and opens and clicks in the emails in order to send you the newsletter and improve it. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by emailing us.

In the app, after login we transmit your email address, name, phone number, our internal account number and, if you have allowed push notifications, the push identifier to Klaviyo, as well as events such as an abandoned purchase. Klaviyo uses this to send service notifications about your eSIMs (Art. 6(1)(b) GDPR) and, if you have consented, offers and reminders by email or push (Art. 6(1)(a) GDPR). For these marketing messages, Klaviyo records whether and when you open them so that we can evaluate and improve our marketing. This is also based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can unsubscribe from marketing push at any time in your device settings or by emailing us.

Klaviyo's sign-up forms are loaded when the page is called up. Klaviyo only sets the identifier __kla_id, which it uses to recognise subscribed users on the website (for example for an abandoned cart reminder), after you have consented to targeting cookies. Klaviyo is certified under the EU-US Data Privacy Framework. Privacy information: www.klaviyo.com/legal/privacy.

10. Statistics and advertising (only with consent)

The following services only load after you have consented to the relevant category in the cookie banner. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The providers may link the data to an account you have with them and in some cases also use it for their own purposes. Cookies and storage periods for each service are listed in the Cookie Policy.

Google Analytics 4 (performance)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses a pseudonymous identifier to analyse how our shop is used, for example page views, time on site, origin, device and orders. Google Analytics is integrated via the Shopify app “Google & YouTube” with Google Consent Mode v2: without consent, no data is sent to Google. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). Privacy information: policies.google.com/privacy.

Shopify Analytics (performance) and Shopify Marketing (targeting)

Shopify creates statistics for us about visits, origin and orders and attributes orders to marketing campaigns. Provider as in section 3.

Google Ads and Google Merchant Center (targeting)

Provider: Google Ireland Limited (as above). We measure whether a purchase followed a click on a Google ad or free product listing, and we use remarketing. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).

Meta Pixel and Conversions API (targeting)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We measure the success of ads on Facebook and Instagram, build audiences (Custom Audiences) and optimise advertising. In addition to the pixel in the browser, we also send events such as a purchase to Meta server-side (Conversions API). This includes encrypted (hashed) contact details such as email address or phone number so that Meta can match the event to a user account (“Advanced Matching”). Meta may link the data to your account and use it for its own advertising purposes. Data may be transferred to Meta Platforms, Inc. in the USA (EU-US Data Privacy Framework).

We and Meta are joint controllers for collecting data with the Meta Pixel and transmitting it to Meta (Art. 26 GDPR). Further processing at Meta is the sole responsibility of Meta. The agreement is available at www.facebook.com/legal/controller_addendum. You can exercise your rights with us and with Meta. Meta privacy information: www.facebook.com/privacy/policy.

TikTok Pixel (targeting)

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. We measure the success of ads on TikTok and build audiences. Data may be transferred to the USA and Singapore, among others; according to TikTok, this is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Privacy information: www.tiktok.com/legal/privacy-policy-eea.

Pinterest Tag (targeting)

Provider: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. We measure the success of ads on Pinterest and build audiences. Data may be transferred to Pinterest, Inc. in the USA (EU-US Data Privacy Framework).

OpenAI Ads Pixel and Conversions API (targeting)

Provider: OpenAI OpCo, LLC, 1455 Third Street, San Francisco, CA 94158, USA. We measure the success of our ads in ChatGPT and other OpenAI services. The pixel only loads after you have consented to targeting cookies. Only then do we also send server-side events (for example start of checkout, purchase) to OpenAI, where applicable with a click identifier and a hashed email address for matching. The data is transferred to the USA. OpenAI is not listed as certified under the EU-US Data Privacy Framework; according to OpenAI, the transfer is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Privacy information: openai.com/policies/privacy-policy.

11. Affiliate programmes

Awin

Provider: Awin AG, Eichhornstraße 3, 10785 Berlin, Germany. Through Awin we work with partner websites that link to us. Awin attributes orders to the relevant partner so that we can calculate commissions. Awin cookies belong to the targeting category and are only set with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Privacy information: www.awin.com/gb/privacy.

UpPromote

We use UpPromote (Affiliate by Secomapp) of UpPromote Technology Joint Stock Company, Vietnam, for our affiliate and referral programme. It allows us to attribute orders to the partners whose link brought you to us and to calculate their commissions. For this purpose a click identifier (cookie _up_clid, 1 year, and entries in browser storage), the referring partner ID and order data such as order number and order value are processed. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in correctly calculating partner commissions). The data is processed in Vietnam and stored with cloud providers, including in the USA. There is no EU Commission adequacy decision for Vietnam. Details can be found in the Cookie Policy.

12. Other content on our pages

We load the following content when a page is visited. The respective provider technically receives your IP address and browser data. The legal basis is our legitimate interest in a functional and attractively designed shop (Art. 6(1)(f) GDPR).

• Trustpilot (review widgets): Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark.
• Judge.me (product reviews): Judge.me Ltd, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom (EU Commission adequacy decision). After an order you may receive an email via Judge.me asking for a review (Art. 6(1)(f) GDPR, legitimate interest in customer reviews). You can object to this at any time.
• flagcdn.com (country flags): Flagpedia.net, David Krmela, Czech Republic.
• Webflow CDN (individual images from our former shop): Webflow, Inc., San Francisco, USA.

13. Social networks

On our pages we link to our profiles on social networks. We do not embed any plugins for this. Data is only transmitted when you click a link and visit the network. The privacy information of the respective network then applies.

14. Internal administration and background tools

We bring together orders, top-ups and refunds from the shop, app, WhatsApp and our partners in our internal administration (stored with our hosting provider in Germany, section 3). In doing so we process name, contact data, order, payment and eSIM data and the history of your requests in order to process orders, help you in customer service, review refunds and analyse our business. The legal basis is Art. 6(1)(b), (c) and (f) GDPR.

To automate processes between our tools we also use Zapier (Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA). Zapier is not embedded on our website. Depending on the process, personal data may also be processed. The legal basis is Art. 6(1)(b) and (f) GDPR (efficient internal processes). According to Zapier, transfers to the USA are based on the EU Commission's Standard Contractual Clauses.

15. Transfers to third countries

Some providers also process data outside the EU and EEA, in particular in the USA. For the USA, the EU Commission adopted an adequacy decision on 10 July 2023 (EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795). Transfers to companies certified under it are based on Art. 45 GDPR. You can check whether a company is certified at www.dataprivacyframework.gov/list. Where a provider is not certified, the transfer is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR); we state this above for the respective provider. Even with certified companies, US authorities may access data under certain conditions. Adequacy decisions exist for Canada and the United Kingdom, but not for Vietnam.

16. Storage period

We store personal data for as long as necessary for the respective purpose. We then delete it unless a statutory retention obligation applies (up to 10 years for documents relevant under commercial and tax law). In detail:

• Customer account in the shop and in the app: until you delete the account.
• Order, invoice and payment data: up to 10 years (Section 257 HGB, Section 147 AO).
• Customer service requests (email, WhatsApp, app): until the request has been dealt with, then for as long as we need them for possible queries and claims arising from the order.
• Push identifier: until you switch off push notifications, delete the app or delete your account.
• Data based on your consent: until you withdraw it.

The storage period of the individual cookies can be found in the Cookie Policy.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR): on the website via the cookie settings, in the app via your device settings, or by emailing us. This does not affect the lawfulness of processing before the withdrawal.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to the processing of your data for direct marketing at any time without giving reasons.

Please write to datenschutz@buddysim.com.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence or place of work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

18. Information for users from Switzerland

The Swiss Federal Act on Data Protection (FADP) also applies to you. We transfer personal data to the countries named in this privacy policy, in particular to EU and EEA states, the United Kingdom, Canada, the USA and, as part of UpPromote, Vietnam. Transfers to certified companies in the USA are covered by the Swiss-US Data Privacy Framework; otherwise we rely on the EU Commission's Standard Contractual Clauses recognised by the FDPIC (Art. 16(2)(d) FADP), insofar as the provider relies on them. The Federal Council has not found an adequate level of data protection for Vietnam. You have the rights under Art. 25 et seq. FADP, in particular access, rectification and erasure. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

19. Changes

We update this privacy policy when we change services or app features or the legal situation changes. The version published here applies.