Data Processing Policy
Version 1.0. Effective 2 November 2026.
This policy explains how Luxxe eSims handles personal data from the moment it reaches us to the day it is deleted. It is the public summary of our internal record of processing, written so customers, partners and business clients can see our practices without sending us a questionnaire. Read it with our Privacy Policy and Cookie Policy.
Our principles
We collect only what an eSIM order needs. We tell you why before we collect it. We keep it in as few places as possible, share it narrowly and delete it on a schedule. We never store card numbers. Optional cookies and advertising measurement stay off until you agree.
Roles
Luxxe Global Limited (Hong Kong) is the controller of the personal data described here. Our eSIM network supplier, payment provider, hosting provider and software tools act as processors on our instructions, or as independent controllers where they provide their own service to you (for example Airwallex for payments, or Google and Meta for advertising measurement once you have agreed to it).
How data is collected
- Through our website checkout, which runs on our own server.
- Card and wallet payments are entered on Airwallex’s secure payment fields. Our staff never type, see or store a full card number.
- Through email to support@luxxesims.com, our contact form and WhatsApp, when you contact us.
- Through cookies, only in line with your choices in our cookie banner.
How data is stored
- Order records are stored in our website database on a private server hosted by Hostinger, protected by encrypted (HTTPS) connections, with administrator access limited to named people.
- Business email is held in Google Workspace with two-step verification switched on.
- Payment records are held by Airwallex. eSIM issue and activation records are held by our eSIM network supplier (TGT).
- Customer personal data is never entered into AI tools.
How data is shared
Only with the providers listed in our Privacy Policy, and only what each needs. We do not sell, rent or trade personal data. Google and Meta receive data for advertising measurement only after you choose Accept in our cookie banner, and then only in scrambled (hashed) form where it identifies you.
International transfers
Our providers store data in several countries, including the United States and the European Union. Each is bound by its data processing terms. Where personal data from the United Kingdom, European Economic Area or Switzerland is transferred elsewhere, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision.
Automated processing and AI
We do not make decisions about you by automated means. Google’s and Meta’s advertising systems use measurement data, where you have agreed, to report and optimise our adverts. If we add an AI chat assistant to this site, it will tell you at the start that it is an AI and how to reach a person.
Retention and deletion
| Data | Kept for | Then |
|---|---|---|
| Orders, invoices and payment records (no card numbers) | 7 years, as Hong Kong law requires | Deleted |
| Support emails and messages not linked to an order | 12 months after last contact | Deleted |
| Marketing contacts | Until you unsubscribe | Removed within 7 days |
| Cookie consent records | 12 months after your last choice | Deleted |
| Analytics data | Up to 14 months | Deleted by Google Analytics |
Security incidents
If personal data is lost or exposed, we act to contain it within the hour, assess who is affected within 24 hours and tell affected customers without undue delay, together with any authority the law requires, within 72 hours where that applies. We keep a written record of every incident and the decision made.
Your requests
Any request to see, correct, delete or export your data is answered within 14 days, free of charge. Email support@luxxesims.com. Where we must keep a record by law, we will tell you what and why.
Oversight
We review this policy and the controls behind it every quarter, and check the live site’s cookies against our Cookie Policy at the same time. A copy of our record of processing is available to business clients and partners on request under a confidentiality agreement.