In short
- We ask you for one thing: an email address, so that we can send you your eSIM.
- Card details go to our payment provider's secure page. We never see or store them.
- This website sets no cookies and runs no advertising or analytics trackers.
- We do not sell your data, and we do not send marketing email — only messages about your order.
- To get a copy of your data, or to have it deleted, write to support@buyesimturkey.com.
Who is responsible for your data
Bosphorus Mobile, based in Istanbul, Türkiye (“Bosphorus Mobile”, “we”), decides how and why your personal data is handled when you use buyesimturkey.com, buy from us or write to us. In the language of data-protection law, we are the controller. You can reach us about anything in this policy at support@buyesimturkey.com.
What we handle, and why
We have no customer accounts, and we do not ask for your name, postal address, phone number or identity documents. This is everything we handle:
| Data | Why we need it | Legal basis |
|---|---|---|
| Email address | To deliver your eSIM, confirm your order and answer you. | Performing our contract with you |
| Order detailsPlan, quantity, price, currency, date and order number. | To fulfil the order, handle refunds and keep the accounts the law requires. | Contract; legal obligation |
| Payment resultA payment reference and whether the payment succeeded — never your card number. | To match your payment to your order, make refunds and prevent fraud. | Contract; our legitimate interest in preventing fraud |
| eSIM technical dataThe eSIM's serial number (ICCID), whether it has been installed and activated, data used and remaining, validity dates. | To provide the service, apply the fair-use rule, sell you a top-up and help you when something does not work. | Contract |
| Support messagesWhat you write to us, and screenshots you choose to send. | To solve your problem and to keep a record of what was agreed. | Contract; our legitimate interest in handling complaints |
| Server logsIP address, browser type, pages requested and time. | To keep the website secure and to find faults. | Our legitimate interest in running a secure website |
We do not see the websites you visit or the content of your connection. The mobile networks that carry your data process technical traffic data, as telecommunications law requires of them.
You are not obliged to give us any of this, but without an email address we cannot deliver an eSIM.
Where the data comes from
Most of it comes from you, at checkout or when you write to us. The payment provider tells us the result of your payment. Our connectivity partner tells us the technical status of your eSIM: whether it is installed and how much data is left.
Who receives it
We share personal data only with those who help us provide the service, and only what each of them needs:
- our connectivity partner, which issues the eSIM and runs it on the mobile network;
- our payment provider, which takes your payment on its own secure page;
- the companies that host this website and deliver our email;
- our accountants and advisers, and public authorities, where the law requires it.
We do not sell personal data, and we do not share it with advertising networks or data brokers.
Where your data is handled
We are based in Türkiye, so your data is handled in Türkiye. Some of the providers listed above process it in other countries, including countries of the European Economic Area.
If you live in the EEA, the United Kingdom or Switzerland: Türkiye has not been recognised by the European Commission or the UK government as offering an equivalent level of data protection. We handle your order here because the transfer is necessary to perform the contract you ask us for — we cannot deliver an eSIM for Turkey without it. Where the law requires further safeguards for a provider acting on our behalf, such as standard contractual clauses, we put them in place.
Transfers out of Türkiye are made in line with article 9 of the Turkish Personal Data Protection Law (No. 6698, “KVKK”).
How long we keep it
- Orders, invoices and payment references: 10 years, because Turkish commercial and tax law requires it.
- eSIM technical data: while the plan is running and for up to twelve months afterwards, to deal with refunds, disputes and support.
- Support messages: 2 years after the conversation ends.
- Server logs: normally no longer than thirty days.
When a period ends we delete the data or make it anonymous.
Your rights
Depending on where you live, data-protection law — the GDPR in the EEA, the UK GDPR in the United Kingdom, the KVKK in Türkiye — gives you the right to:
- know whether we handle data about you, and receive a copy of it;
- have inaccurate data corrected;
- have data deleted when we no longer need it or have no legal ground to keep it;
- restrict or object to handling that is based on our legitimate interests;
- receive the data you gave us in a portable format;
- be told who your data has been shared with, and have corrections and deletions passed on to them;
- object to a result that is produced only by automated analysis, and claim compensation if you suffer damage because your data was handled unlawfully.
To use any of these rights, write to support@buyesimturkey.com from the address you ordered with. It costs nothing, and we answer within 30 days. Because we know you only by your email address, we reply to that address to make sure we are talking to the right person.
You can also complain to a data-protection authority: the Personal Data Protection Board (KVKK) in Türkiye, the Information Commissioner's Office in the United Kingdom, or the authority of the EEA country where you live. We would appreciate the chance to put things right first.
Security
The website is served over an encrypted connection, payment takes place on the payment provider's page rather than ours, and only the people who need order data to do their job can see it. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
Automated decisions and marketing
We make no decisions about you by automated means that have a legal or similarly significant effect. Our payment provider runs automated fraud checks when you pay.
We do not send marketing messages. If that ever changes, it will be because you asked for them, and every message will carry a way to stop them.
Children
This shop is for adults. We do not knowingly handle data about anyone under 18. If you believe a child has placed an order, write to us and we will delete the data.
Changes to this policy
When what we do with personal data changes, this policy changes first. The date at the top shows the latest version.
Something unclear?
Ask us. A person in Istanbul will answer.