Privacy policy

Last updated: 25 October 2026

The short version: browsing this site only leaves your IP address in our host's server logs for a short time. If you buy an eSIM, we need your email address and the details of your order, and nothing more. We don't sell your data, we don't send newsletters and we have no advertising trackers.

When you browse

Our host Netlify keeps server logs with your IP address and browser details for a short time, to keep the site secure and working. This is our legitimate interest. Our fonts and images come from our own server, so no other company sees your visit.

Who is responsible

Rebels eSIM, a trade name of a Dutch sole proprietorship registered with the Chamber of Commerce under KvK 42009740 (full contact details in our terms of sale), is the controller for the personal data described here. Questions about your data: info@rebelsesim.com.

If you buy an eSIM

What we collect:

• your email address, to send you your eSIM and your order confirmation;
• your order details: the plan, the price, the date, a partner code if you used one, and the payment reference and status from our payment provider. We never see your card or bank details;
• the technical details of your eSIM: the eSIM number (ICCID), the installation code with its QR code, whether it has been activated and, when we need it to help you, how much data it has used;
• the messages you send us for help, a refund or a withdrawal.

You have to give us an email address; without it we can't deliver your eSIM.

Why, and on what basis:

• to deliver your eSIM, help you when it doesn't work and refund you when needed: this is necessary to perform our contract with you;
• to keep our accounts: this is a legal obligation under Dutch tax law;
• to prevent fraud and keep our systems secure: this is our legitimate interest. Our payment provider Stripe checks each payment automatically for signs of fraud, based on things like the card, the device and the payment pattern, and can block a payment. If that happens, you can ask us to look at it ourselves.

Who we share it with

• Stripe (payments). You pay on Stripe's payment page. Stripe processes your payment details and checks for fraud under its own privacy policy, and acts as a separate controller for that.
• Our eSIM wholesale partner, an eSIM wholesaler in Hong Kong, which creates your eSIM. It only receives the plan and our order number, not your name or email address. Like with any SIM card, it and the mobile networks you connect to can see when your eSIM connects and how much data it uses.
• Netlify, which hosts this website and runs our order system.
• Resend, which sends your order email. It receives your email address and the content of that email.
• QuotaGuard, which passes our encrypted connection to our wholesale partner through a fixed internet address. It can't read the content.
• WhatsApp (Meta), only if you choose to message us there. Meta processes those messages under its own privacy policy.
• Our accountant and, if the law requires it, government authorities.

We don't sell your data and we don't share it for advertising.

Data outside the European Union

Stripe, Netlify and Resend are based in the United States and certified under the EU-US Data Privacy Framework. QuotaGuard is also based in the United States; we use the European Commission's Standard Contractual Clauses with it. Our wholesale partner is in Hong Kong, for which the European Commission has no adequacy decision. We use the Standard Contractual Clauses there too, and the transfer is necessary to deliver the eSIM you ordered. Email us if you'd like a copy of these safeguards.

How long we keep it

• The installation code and QR code of your eSIM: until 120 days after your order, when the eSIM can no longer be activated and used.
• Your order number, plan, amount, payment reference and email address: seven years, because Dutch tax law requires this for our accounts.
• Help, refund and withdrawal messages: two years after your last message, unless we need them longer for a dispute.

Cookies

This site uses no cookies of its own: no advertising, no analytics and no referral cookie. If you arrive through a partner link, we pass the partner's code on to your order during that visit, without storing anything on your device. On Stripe's payment page, Stripe's own cookies apply.

Reviews

After your trip we email you one review request, plus at most one reminder. We do this based on our legitimate interest in improving our service and showing honest customer feedback. You can opt out at checkout or with the link in every email. If you write a review on our site, we publish it with your first name, country and date only, with your consent, which you can withdraw at any time via info@rebelsesim.com. If we also invite you to review us on Trustpilot, we share your name, email address and order number with Trustpilot A/S in Denmark for that invitation; reviews posted there fall under Trustpilot's privacy policy.

If you join our partner programme

We collect your name, email address, website or channel and audience size to assess your application, and, once you're accepted, your payout and tax details to pay your commission. We do this to enter into and carry out our partner agreement, and for the tax details because the law requires it. If we turn down your application, we delete your details after six months. If you're a private individual in the Netherlands, Dutch law requires us to report payments to the tax authority, including your citizen service number (BSN) and date of birth. We keep payout records for seven years. Partners never receive personal data about the people who buy through them.

Partners log in to their dashboard with a one-time link we email them; their browser then keeps a login key for 30 days (in local storage, not a cookie), until they log out.

If you arrive through a partner's link

When you open our site through a link with a partner code in it (?ref=), your browser remembers that code for the rest of your visit (in session storage, not a cookie; it's gone when you close the tab). We use it to fill in the partner's discount code at checkout and to credit the partner if you order during that visit. We also count the visit for the partner, without your IP address or anything else that identifies you. If you order, we store the partner code with your order to pay their commission. The partner only sees the date, plan and amount, never who you are.

Your rights

You can ask us which data we hold about you, and have it corrected, deleted, restricted or sent to you in a readable file. You can object to processing based on our legitimate interest. Data we must keep for our accounts can only be deleted once that retention period has ended. We answer within a month. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Children, security and changes

Our eSIMs aren't meant for children under 16 buying on their own. The site only works over a secure connection, and your QR code is only sent to the email address you entered. If we change this policy, we update the date at the top.