Privacy policy

1. Controller

The controller within the meaning of Art. 4 no. 7 of the General Data Protection Regulation (DSGVO) is:

WERBUNGMACHER.DE UG (haftungsbeschränkt) Bahnhofstraße 13A 77767 Appenweier Germany

Represented by the Managing Director Zeynep Özcelik. Email: merhaba@gurbetcicard.com Telephone: +49 151 1097 3162

GurbetciCard is a brand of WERBUNGMACHER.DE UG (haftungsbeschränkt). Further information about the company can be found in the legal notice.

We have not appointed a data protection officer. We are not obliged to do so because we do not reach the thresholds of § 38 Bundesdatenschutzgesetz. Please address your data protection concerns to the address given above.

2. Overview of our processing activities

So that you do not have to read the entire statement in order to get your bearings:

3. Legal bases

We process personal data on one of these bases:

• Consent (Art. 6 para. 1 lit. a DSGVO). You may at any time, with effect for the future, revoke it. For the storage of information on your terminal equipment and access to it, § 25 para. 1 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) additionally applies.
• Performance of the contract (Art. 6 para. 1 lit. b DSGVO), including the steps prior to the conclusion of the contract.
• Legal obligation (Art. 6 para. 1 lit. c DSGVO), above all commercial and tax retention obligations.
• Legitimate interest (Art. 6 para. 1 lit. f DSGVO). Where we rely on it, we name the interest expressly.

An automated decision in an individual case with legal effect for you within the meaning of Art. 22 DSGVO does not take place. For the prevention of fraud we assess orders, without an automated decision on the contract following from this; further details in section 10.

4. Access to our pages and operation of the shop

Our shop is operated by Shopify International Limited, 2nd Floor Victoria Buildings, 1 Haddington Road, Dublin 4, Ireland. When a page is accessed, Shopify processes on our behalf the data that your browser transmits: IP address, date and time, the address accessed, the volume of data transferred, browser and operating system as well as the page visited previously. The purpose is the delivery of the pages, the stability of operations and the defence against attacks. The legal basis is our legitimate interest in a secure and functioning offering (Art. 6 para. 1 lit. f DSGVO), and during the ordering process additionally the performance of the contract.

A data processing agreement pursuant to Art. 28 DSGVO is in place with Shopify. Shopify uses sub-processors, among other things for hosting, error logging, load balancing, delivery of content and for AI-supported on-board tools. These sub-processors also include providers based in the United States. Shopify maintains the current list at https://help.shopify.com/en/manual/privacy-and-security/privacy/subprocessors. Shopify bases transfers to third countries on binding corporate rules and on standard contractual clauses of the European Commission; the details are set out in the data processing addendum at https://www.shopify.com/legal/dpa.

Our domain and our mailboxes are held with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. The server on which our own middleware and our back office run is likewise located at IONOS in Germany.

5. Ordering and performance of the contract

When you place an order, we process: first and last name, billing address, email address, where applicable telephone number and company name, the data package purchased, the price, the travel destination and the travel period as well as the designation you assign to each eSIM. If you have provided a VAT identification number, we also process this.

The purpose is the performance of the purchase contract, the provision of your eSIM, the issuing of the invoice and customer service. The legal basis is Art. 6 para. 1 lit. b DSGVO, and for the invoice additionally Art. 6 para. 1 lit. c DSGVO.

The provision of this data is necessary for the conclusion of the contract. Without it we can neither provide you with an eSIM nor issue an invoice.

6. Customer account

For your customer account at my.gurbetcicard.com we use the passwordless login from Shopify. You receive a one-time code to your email address. We do not store a password. Your email address, your orders and the status of your eSIMs are processed. The legal basis is Art. 6 para. 1 lit. b DSGVO. An account is not required for a purchase.

7. Payment

Payment processing takes place via Shopify Payments. The contracting party is Shopify International Limited; the technical processing is carried out by Stripe Payments Europe Ltd., Ireland. You enter your card and account details directly there. We do not see or store them; we only learn whether a payment was successful.

Depending on which payment method you choose, your payment data is additionally transmitted to the respective provider. These providers are independently responsible for their processing:

You can find the privacy policies of these providers here:

• PayPal: www.paypal.com/de/legalhub/privacy-full
• Klarna: www.klarna.com/de/datenschutz
• Riverty: documents.riverty.com/privacy_statement/checkout/de_de/default
• Apple Pay: www.apple.com/legal/privacy/data/de/apple-pay
• Google Pay: payments.google.com/legaldocument?family=0.privacynotice
• Shop Pay: www.shopify.com/legal/privacy

In the case of purchase on account and payment by instalments, Klarna and Riverty check your ability to pay and query credit agencies for this purpose. The providers are themselves responsible for this check; we only learn whether the payment method has been approved. The legal basis for the transmission to the provider you have chosen is Art. 6 para. 1 lit. b DSGVO.

The PayPal button is already loaded when our pages are accessed. In doing so your browser establishes a connection to PayPal, and PayPal receives your IP address.

8. Provision of your eSIM

So that you receive your eSIM, we place an order with our upstream supplier. This is ESIM ACCESS LIMITED, Flat/Room 8, 15/F, Witty Commercial Building, 1A-1L Tung Choi Street, Kowloon, Hong Kong.

Only an internal transaction identifier, the code of the package purchased and the amount are transmitted. We do not transmit your name, your email address or your postal address. The transaction identifier contains our order number and is therefore a pseudonym, not an anonymous value. In return we receive the technical details of your eSIM: the card identifier ICCID, the address of the provisioning server, the installation code and the status of the profile.

The legal basis is Art. 6 para. 1 lit. b DSGVO.

Hong Kong is a third country for which no adequacy decision of the European Commission exists. An agreement on appropriate safeguards pursuant to Art. 46 DSGVO, for example standard contractual clauses, does not currently exist with this company. We therefore base the transfer on Art. 49 para. 1 sentence 1 lit. b DSGVO: it is necessary for the performance of the contract that you have concluded with us, because without this order you receive no eSIM. In doing so we limit the transfer to what is technically necessary and transmit no contact details.

When you use your eSIM, technical data traffic additionally arises which we do not control and the contents of which we do not see. According to our measurement of 28.08.2026, the following are involved:

In normal operation your data traffic therefore leaves the European Union. That is how an international eSIM works and is not a separate disclosure by us. For the United States as the place of the network transition there is no adequacy decision that covers this technical process; here too the transfer is necessary for the performance of your contract (Art. 49 para. 1 sentence 1 lit. b DSGVO), because without such a transition an eSIM establishes no connection to the internet.

9. Our own middleware

Between the shop and our upstream supplier, software operated by ourselves runs on our own server in Germany, accessible at install.gurbetcicard.com. It provides your eSIM, generates your installation link and shows you the status of your eSIM.

The following are processed there:

• the reference to your order as well as travel destination, travel period and package,
• the identifiers of your eSIM, including the ICCID; the installation code is stored in encrypted form,
• your installation link, its expiry date and the number of times it has been accessed,
• an irreversible check value derived from your email address for the detection of multiple orders,
• an irreversible check value of the device identifier of your eSIM, as soon as you have set it up,
• the daily aggregated data consumption of your eSIM, in each case as a daily total,
• your VAT identification number, provided that you have given one,
• if you designate an eSIM for another person: their name and email address, stored in encrypted form.

The following are not stored there: your payment data, your billing address, your IP address as a purchaser, identity document data, location data and traffic data in the sense of who communicated with whom and when. The daily consumption gives rise to no movement or usage profile.

The legal basis is Art. 6 para. 1 lit. b DSGVO, and for the two check values our legitimate interest in warding off abusive orders and in attributing a device in the event of a complaint (Art. 6 para. 1 lit. f DSGVO).

If you designate an eSIM for another person (information pursuant to Art. 14 DSGVO for that person): We then process the name and the email address that you provide for that person. This information comes from you, not from the person themselves. We use it exclusively in order to deliver their eSIM to that person and to send them the associated messages. The legal basis is our legitimate interest, and yours, in getting the purchased service to the person for whom it is intended (Art. 6 para. 1 lit. f DSGVO). The recipients are the systems named in this statement; this information is not sent to our upstream supplier. It is deleted 90 days after the eSIM expires; in the text of the message sent it is retained for as long as the order. The person can exercise all the rights named in section 22 and object to the processing pursuant to Art. 21 DSGVO. They additionally receive this information with our first message to them.

10. Check for abusive orders

Every order goes through a check that assesses anomalies. Included are the country of your billing address, the currency, the language of your browser, the quantity, the risk assessment of the Shopify platform, whether you are ordering from us for the first time, and the number of orders with the same check value within 24 hours. The result is a score with a reason code; we store both with the order.

The purpose is the prevention of payment defaults and misuse. The legal basis is Art. 6 para. 1 lit. f DSGVO. In the case of a conspicuous order, the transaction is halted and looked at by us manually. No decision based solely on automated processing within the meaning of Art. 22 DSGVO is connected with this. You can object to this processing pursuant to Art. 21 DSGVO.

11. Invoicing and accounting

We additionally process your order and invoice data in our back office system Odoo. It runs on the same own server in Germany as our middleware. Your invoice and the accounting records are created there. The legal basis is Art. 6 para. 1 lit. b as well as lit. c DSGVO in conjunction with the commercial and tax retention obligations.

If you have designated an eSIM for another person, their name and email address are stored in no data field of this system. For the dispatch of the message to that person, however, we pass the information on to the system that sends our emails; it is then contained in the text of the message sent and is retained there for as long as the associated order.

12. Emails to you

We send the order confirmation, the installation link and the invoice via a mail server that we operate at IONOS SE. The sender is merhaba@gurbetcicard.com, replies go to support@gurbetcicard.com. In addition, individual messages relating to your order are sent by Shopify International Limited from within the shop. The legal basis is Art. 6 para. 1 lit. b DSGVO. We send you advertising only with your consent and from a separate sender address.

13. Live chat

A chat window is available on our pages, operated with Shopify Inbox from Shopify International Limited. It opens only when you click on it. If you write to us there, we process your message and the details that you provide voluntarily in order to reply to you. The legal basis is Art. 6 para. 1 lit. b DSGVO for questions about an order, otherwise our legitimate interest in answering your enquiry (Art. 6 para. 1 lit. f DSGVO). We delete chat histories once your enquiry has been dealt with conclusively and no retention obligation stands in the way.

14. Shopping via the Shop app and via AI assistants

Our range can additionally be found via the Shop sales channel of Shopify International Limited, among other places in the Shop app. If you log in with a Shop account or pay with Shop Pay, Shopify also processes your data for its own purposes and is itself responsible for this.

Our shop also makes catalogue and context data available in such a way that AI assistants can access it. For this purpose the shop temporarily stores details of the pages you have accessed in the session storage of your browser. These details are deleted as soon as you close the browser. The legal basis is our legitimate interest in making our range findable where customers search for it (Art. 6 para. 1 lit. f DSGVO). You can object to this processing pursuant to Art. 21 DSGVO. If data leaves the shop in the direction of an AI provider, that provider's data protection provisions apply.

15. Cookies and storage on your terminal equipment

Our shop stores information on your terminal equipment and reads it out again. For everything that is not strictly necessary for this, we obtain your consent beforehand (§ 25 para. 1 TDDDG). For this you will see a notice on your first visit in which you can decide item by item.

Strictly necessary and therefore without consent are those forms of storage without which the shop does not function: your shopping basket, your session, your language and country selection as well as the storage of your consent decision itself. Without the latter we would have to ask you again on every page.

Requiring consent are all other forms of storage, including the list of recently viewed products, the reach measurement and all the services described in sections 17 to 19. Without your consent they are neither loaded nor executed.

In addition, the “Sign in with Shop” login function of Shopify International Limited places its own values on your terminal equipment as soon as a page is loaded. This function belongs to the platform and cannot be switched off individually by us; it is subject to the privacy policy of Shopify at https://www.shopify.com/legal/privacy.

You can change your decision at any time. You can call up the notice again via the link “Your privacy settings” in the footer of every page. A withdrawal takes effect for the future.

16. Reach measurement in the shop

Shopify International Limited measures for us how our shop is used: page views, sessions, completed purchases and turnover. For this purpose an identifier is assigned to your visit which is stored on the terminal equipment. Events such as a page view, the viewing of a product or a change to the shopping basket are recorded in the process.

The purpose is the evaluation and improvement of our offering. The legal basis is your consent (Art. 6 para. 1 lit. a DSGVO, § 25 para. 1 TDDDG). Without your consent this measurement does not take place. The recipient is Shopify; for processing on our behalf and for third countries, section 4 applies.

17. Google

We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland may pass data on to Google LLC in the United States and to affiliated companies.

The legal basis for all the services named in this section is your consent (Art. 6 para. 1 lit. a DSGVO, § 25 para. 1 TDDDG). Without your consent no Google service is loaded and no data is transmitted to Google. You declare your withdrawal via the cookie settings; it takes effect for the future.

Google Analytics evaluates how our offering is used: pages accessed, events triggered, completed purchases, approximate location on the basis of the IP address, device and browser. Your IP address is not logged by Google in the process. Data linked at user level is deleted after 14 months; the period begins anew with every new visit. Aggregated evaluations remain unaffected by this.

Google Ads is what we use to measure whether an advertisement has led to a purchase, and to address visitors to our shop again on other pages. For this purpose identifiers are stored on your terminal equipment; Google retains the identifier of an advertisement click for 90 days, the identifier for renewed addressing for up to 13 months. In order to be able to attribute purchases more precisely, an encrypted checksum of your email address may be transmitted in the process. This happens only if you have consented to the use for advertising purposes.

Google Merchant Center and the connection to Google and YouTube. We transmit our product data to the Google Merchant Center so that our eSIM packages can appear in Google search, in the Shopping area and in advertisements. What is transmitted in the process is information about the product itself — designation, description, price, availability, image and item number —, no customer data. Part of this connection is an identifier in our shop with which Google can attribute whether a purchase goes back to an advertisement or to an entry in the Shopping area. This attribution takes place, like the other Google services, only with your consent; without it the identifier is not triggered. The matching of the mere product data takes place independently of this, because it does not concern you as a person.

Google Signals. In Google Analytics the “Google Signals” function is switched on. It supplements our measurement with information from users who are signed in to a Google account and have consented there to personalised advertising. Google can thereby merge their visits to us across devices and supplement them with information from the Google account, for example on age, gender and interests. Of this we see only aggregated evaluations, never individual persons.

Whether this affects you, you decide yourself in two places: via your consent in our shop and via the setting “Personalised advertising” in your Google account at https://myadcenter.google.com. If you deactivate it there, the merging across devices does not take place. The legal basis here, too, is your consent (Art. 6 para. 1 lit. a DSGVO, § 25 para. 1 TDDDG).

Google Tag Manager is what we use to manage these services. Part of it runs on a server that we operate ourselves at the address gtm.gurbetcicard.com. We are responsible for this server; Google receives data only once a service is addressed from there. The Tag Manager, too, is loaded only after your consent.

We pass your consent decision to Google as a signal so that Google services align themselves with it. The default setting is: no consent.

Third country. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision. The continued existence of this decision is currently being challenged in court. In addition, the standard contractual clauses of the European Commission apply.

Objection and further information. Privacy policy of Google: https://policies.google.com/privacy. Advertising settings: https://adssettings.google.com. Browser extension for deactivating Google Analytics: https://tools.google.com/dlpage/gaoptout.

18. Meta: Facebook and Instagram

We use advertising services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Meta Pixel and Conversions API. Both measure which actions you carry out in our shop and whether an advertisement has led to a purchase, and they form target groups for advertising. Your IP address, details of browser and device, the pages accessed, events such as the viewing of a product or a purchase as well as identifiers on your terminal equipment are processed. The Conversions API additionally transmits the same events from our server. Contact details such as your email address are transmitted in the process only as an encrypted checksum. Such a checksum remains personal data, because Meta uses it precisely for matching against its own records.

Joint responsibility. For the collection of this data in our shop and its transmission to Meta, we and Meta Ireland are jointly responsible within the meaning of Art. 26 DSGVO. The allocation follows from the controller addendum that Meta makes available at https://www.facebook.com/legal/controller_addendum. The essential points from it:

• We are responsible for ensuring that the collection takes place lawfully, in particular for obtaining your consent, and for informing you about it.
• Meta is responsible for the further processing from receipt of the data onwards, likewise for the security of this processing and for the fulfilment of your rights.
• You can assert your rights directly against Meta. If you turn to us with this, we forward your request to Meta without undue delay, at the latest within seven calendar days.

Legal basis is your consent (Art. 6 para. 1 lit. a DSGVO, § 25 para. 1 TDDDG). Without your consent nothing is loaded and nothing is transmitted.

Storage period. Meta names no fixed period for this data, but stores it for as long as it is necessary for the purposes named. Identifiers on your terminal equipment have a lifetime of up to two years.

Third country. Meta Platforms Ireland may transmit data to Meta Platforms, Inc. in the United States. The company is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply. The continued existence of the adequacy decision is being challenged in court.

Objection. Your advertising settings at Meta: https://www.facebook.com/adpreferences. Privacy policy of Meta: https://www.facebook.com/privacy/policy.

Our presences on Facebook and Instagram. If you visit our pages in these networks, Meta collects usage data and provides us with aggregated statistics from it. We have no influence on the collection itself. For these statistics we and Meta Ireland are jointly responsible; the allocation is set out in the page controller addendum at https://www.facebook.com/legal/terms/page_controller_addendum. The legal basis is our legitimate interest in a presentation of our brand on social networks (Art. 6 para. 1 lit. f DSGVO). These networks are not embedded in our shop; we only link to them.

19. TikTok

We use advertising services of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. The TikTok pixel and the Events API measure which actions you carry out in our shop and whether an advertisement has led to a purchase, and they form target groups for advertising. Your IP address, details of browser and device, the pages accessed and events as well as identifiers on your terminal equipment and the identifier of an advertisement click are processed. Contact details are transmitted only as an encrypted checksum.

Legal basis is your consent (Art. 6 para. 1 lit. a DSGVO, § 25 para. 1 TDDDG). Without your consent nothing is loaded and nothing is transmitted. TikTok subsequently processes the transmitted data for its own purposes and is itself responsible for this.

Storage period. TikTok names no fixed period, but stores the data for as long as it is necessary for the purposes named, and deletes or anonymises it thereafter.

Third country. TikTok stores data of users from the European Economic Area, according to its own statements, primarily in European data centres in Ireland and Norway. Access from third countries, among others from the United States, is possible in individual cases and is safeguarded by means of standard contractual clauses of the European Commission.

Objection. Settings for advertising at TikTok: https://www.tiktok.com/privacy/ads-and-your-data/de. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de.

20. How long we store data

We delete personal data as soon as the purpose has ceased to apply and no statutory retention obligation any longer exists. In detail:

The periods of 90 and 180 days have been set by us. They result from the period within which, in our experience, queries and complaints about a trip still arrive.

21. Transfers to third countries at a glance

22. Your rights

You have the following rights vis-à-vis us:

• Access to the data stored about you (Art. 15 DSGVO),
• Rectification of inaccurate data (Art. 16 DSGVO),
• Erasure (Art. 17 DSGVO),
• Restriction of processing (Art. 18 DSGVO),
• Data portability (Art. 20 DSGVO),
• Objection to processing that we base on a legitimate interest (Art. 21 DSGVO). If you object, we no longer process your data unless we can demonstrate compelling legitimate grounds. You can object to direct advertising at any time and without giving reasons,
• Withdrawal of a consent with effect for the future (Art. 7 para. 3 DSGVO). The lawfulness of the processing up to the withdrawal remains unaffected by this.

For all these matters a message to merhaba@gurbetcicard.com suffices. We reply without undue delay, at the latest within one month.

23. Right of complaint

Irrespective of other legal remedies, you can lodge a complaint with a data protection supervisory authority if you take the view that we do not process your data lawfully (Art. 77 DSGVO). The competent authority is in particular that of your habitual residence, of your place of work or of the place of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

24. Security

We protect your data by means of technical and organisational measures pursuant to Art. 32 DSGVO. The connection to our pages is encrypted throughout. Particularly sensitive details, for example the installation code of your eSIM and the contact details of a person for whom you have designated an eSIM, are additionally held in encrypted form in our database. Access to your data is available only to persons who need it for their task.

25. Changes to this statement

We adapt this statement if our processing or the legal situation changes. The version published here applies in each case.