Data Processing Addendum

Last updated: 1 November 2026

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Reseller Terms of Service between eSimGenie Limited (trading as eSimDistributor) and you. It applies when we process personal data of your customers for you. For that data you are the controller and we are the processor. Words such as “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR.

Data about you and your team is covered by our Privacy Policy, not by this DPA.

2. Details of the processing

• Subject matter and purpose: provisioning and delivering eSIMs you order, sending delivery emails in your brand, showing eSIM status and usage, and support.
• Duration: for as long as you use the Service, and afterwards only as set out in section 10.
• Data subjects: your customers and end users of the eSIMs you buy.
• Types of data: email address, name (if you send it), your order reference, eSIM identifiers (ICCID, activation code), data usage and status.
• Special category data: none. Do not send us any.

3. Instructions

We process your customers' data only on your documented instructions. Your use of the Service (for example placing an order with a customer email) and these terms are your instructions. If we are legally required to process the data otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

You confirm that you have a lawful basis to share the data with us and that you have told your customers how it will be used.

4. Confidentiality of staff

Only staff who need access to provide the Service can access the data, and they are bound by confidentiality obligations.

5. Security

We keep appropriate technical and organisational measures in place, including:

• encryption in transit (TLS) and at rest;
• role-based access, separation of each reseller's data, and logging of access;
• hashed passwords and API keys, and signed webhooks;
• backups, monitoring and an incident response process.

6. Sub-processors

You authorise us to use the sub-processors listed in our Privacy Policy (hosting, network security, email delivery and eSIM network suppliers). We bind each one by written terms that protect the data at least as well as this DPA, and we remain responsible for them. We will give you at least 30 days' notice of a new sub-processor by updating that list and emailing you. If you object on reasonable data protection grounds and we cannot address it, you may close your account.

7. Helping you meet your obligations

Taking into account the nature of the processing, we will help you respond to requests from your customers to exercise their rights, and with security, data protection impact assessments and consultations with supervisory authorities. If a customer contacts us directly, we will pass the request to you.

8. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your customers' data. We will give you the information we have so you can meet your own reporting obligations, and update you as we learn more.

9. International transfers

Where data is transferred outside the European Economic Area, we make sure it is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses, which are incorporated into this DPA by reference where they are needed.

10. Deletion at the end of the service

When your account closes, we delete your customers' personal data within 90 days, except records we must keep by law (such as order and transaction records needed for tax purposes). Before you close the account you can view your orders and eSIMs in the console, or ask us for an export.

11. Information and audits

On request we will provide the information reasonably needed to show that we meet this DPA, such as a description of our security measures. If that is not enough, or a supervisory authority requires it, you may audit our compliance once a year, at your cost, with 30 days' notice and subject to confidentiality.

12. General

If this DPA and the Reseller Terms conflict on data protection, this DPA applies. The limitation of liability in the Reseller Terms applies to this DPA. Questions: support@esimdistributor.com.