Personal Data Processing Policy

Revision date: September 11, 2026.

This Personal Data Processing Policy describes how personal data is processed when the kupiesim.ru website is used. This English version is provided for convenience. The official version is in Russian and prevails to the extent permitted by applicable law.

1. PERSONAL DATA OPERATOR

The personal data operator is Individual Entrepreneur Sergey Vladimirovich Tokarev (ИП Токарев Сергей Владимирович), hereinafter referred to as the Operator or Kupi eSIM.

  • Primary State Registration Number, OGRNIP: 322169000127293;
  • Taxpayer Identification Number, INN: 165714613179;
  • registration authority: Interdistrict Inspectorate of the Federal Tax Service No. 18 for the Republic of Tatarstan;
  • registration address: 48 Oktyabrskaya Street, Kazan, Russian Federation;
  • email for personal data requests: support@kupiesim.ru.

This Policy applies to website visitors, registered users, guest customers, persons contacting customer support, and affiliate programme participants.

2. PROCESSING PRINCIPLES

The Operator processes only data necessary for predetermined and lawful purposes, avoids excessive processing, maintains accuracy, and does not retain data longer than required by the processing purposes or applicable law.

Processing is based on the laws of the Russian Federation, entering into and performing an agreement with the user, compliance with legal obligations, the exercise of lawful rights and interests, or separate user consent where consent is required.

The Operator does not intentionally collect special categories of personal data concerning health, racial or ethnic origin, political opinions, religious beliefs, or intimate life, and does not intentionally collect biometric personal data.

3. CATEGORIES OF DATA PROCESSED

3.1. Data provided by the user

  • name and email address;
  • password in protected hashed form, email verification tokens, and access recovery tokens;
  • information contained in customer support requests;
  • other information voluntarily provided to fulfil an order or resolve a technical issue.

3.2. Order, payment, and eSIM data

  • user identifier, order UUID, and order date;
  • selected Plan, country or region, price, and currency;
  • payment status and transaction identifier;
  • ICCID, QR code, activation information, assigned Plans, validity periods, remaining data allowance, and technical eSIM status;
  • affiliate identifier where an order is placed through an affiliate link.

Full bank card details, including the full card number, expiry date, and security code, are entered in the CloudPayments interface and are not received or stored by the Operator.

3.3. Technical data

  • IP address, date and time of access, requested page address, and referrer;
  • browser type and version, operating system, device type, and interface language;
  • cookie identifiers, session information, and activity on the website;
  • technical logs relating to errors, security, and fraud prevention;
  • technical information about the network and country where an eSIM connects, without intentionally collecting precise GPS coordinates.

4. PURPOSES AND LEGAL BASES

  • Website operation and security: serving pages, maintaining sessions, authentication, prevention of attacks, errors, and fraud. The legal bases are performance of the agreement, compliance with obligations, and lawful interests of the Operator, provided user rights are respected.
  • Registration and account: account creation, email verification, access recovery, and display of purchased eSIMs. The legal basis is entering into and performing the agreement.
  • Order placement and fulfilment: creating an order, processing payment, obtaining an eSIM from the provider, displaying and sending the QR code, and monitoring status and remaining data. The legal basis is entering into and performing the agreement.
  • Mandatory records: issuing receipts, accounting and tax records, refunds, and payment disputes. The legal basis is compliance with applicable law.
  • Customer support: handling requests, diagnosing connectivity, and restoring service. The legal bases are performance of the agreement and handling user claims.
  • Service notices: order, eSIM, security, and remaining data notifications. The legal basis is performance of the agreement. These notices are not advertising.
  • Analytics and advertising measurement: measuring website visits and advertising performance using optional cookies. The legal basis is separate consent given through the cookie preference panel.
  • Marketing email and SMS: sending offers and news only with separate prior consent and until that consent is withdrawn.

5. PROCESSING OPERATIONS

The Operator may collect, record, organise, accumulate, store, update, retrieve, use, compare, transfer in the cases described in this Policy, anonymise, restrict, erase, and destroy personal data by automated or non-automated means.

The Operator does not make decisions producing legal effects for a user solely through automated personal data processing, except where permitted by law or separately agreed with the user.

6. DATA DISCLOSURE AND RECIPIENTS

To achieve the purposes stated above, necessary data may be disclosed to:

  • CloudPayments — payment and refund processing, fraud prevention, and delivery of transaction results;
  • eSIM Go — eSIM provisioning, Plan assignment, retrieval of technical status and remaining data, and refunds of unused Plans;
  • hosting, email, and technical infrastructure providers — website hosting, data storage, and delivery of eSIMs, receipts, and service notices;
  • Yandex LLC — website analytics through Yandex Metrica only after consent to analytics cookies;
  • Google and its service providers — measurement of advertising performance through Google Ads only after consent to analytics cookies;
  • government authorities — only where and in the manner required by law.

Recipients process data either on behalf of the Operator or as independent operators under their own terms and policies. The Operator discloses only data necessary for the specific purpose and applies the safeguards required by law.

7. DATA LOCALISATION AND INTERNATIONAL TRANSFERS

When personal data of citizens of the Russian Federation is collected, recording, organisation, accumulation, storage, updating, and retrieval are performed using databases located in the Russian Federation, except where otherwise permitted by law.

When foreign eSIM, advertising, or infrastructure providers are used, certain identifiers and technical information may be transferred outside the Russian Federation. Before such a transfer begins, the Operator complies with legal requirements governing international personal data transfers, including assessment of the recipient and submission of required notices to Roskomnadzor. A user may request information about the countries and recipients involved in actual international transfers.

8. COOKIES AND ANALYTICS SERVICES

The website uses the following categories of cookies:

  • necessary cookies: session, form protection, authentication, selected language, temporary association of a payment result with an order, and storage of user preferences. These cookies are required for website operation;
  • affiliate cookies: the kupiesim_pp cookie stores an affiliate link identifier for up to 12 hours;
  • analytics cookies: Yandex Metrica and Google Ads cookies are used only after user consent.

The cookie storing privacy preferences is retained for up to 12 months. Temporary payment cookies are retained until the browser session ends. Analytics cookie periods are determined by the settings of the relevant service, but their use on this website stops after consent is withdrawn.

A user may accept or reject analytics cookies in the preference panel, change the selection by deleting the kupiesim_cookie_consent cookie, and restrict cookies in the browser settings. Disabling necessary cookies may prevent authentication, payment, and other website functions from working.

Yandex processing terms are available in the Yandex Privacy Policy, and Google terms are available in the Google Privacy Policy.

9. RETENTION AND DELETION

  • account data is retained until the account is deleted or the agreement terminates; information that must be retained by law or for a dispute is separated and restricted from other use;
  • order, payment, and issued eSIM information is retained for five years after order fulfilment unless a longer period is required by law or an ongoing dispute;
  • customer support requests are retained for three years after closure;
  • security and error logs are retained for no more than 12 months unless required for an incident investigation;
  • marketing data is processed until consent is withdrawn;
  • cookie periods are described in Section 8.

After the purpose is achieved, the retention period expires, or consent is withdrawn, data is destroyed or anonymised within the period required by law unless another lawful basis requires retention. Withdrawal of consent does not stop processing required to perform an existing agreement or comply with mandatory law.

10. USER RIGHTS

A user has the right to:

  • obtain confirmation of processing and information about personal data;
  • request correction, restriction, or deletion of incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary data;
  • withdraw consent and separately opt out of marketing messages;
  • receive information about recipients and international transfers;
  • complain to Roskomnadzor or a court.

A request may be sent to support@kupiesim.ru. To protect personal data, the Operator may request information sufficient to verify identity and connection with the relevant account or order. A response is provided within 10 business days after receipt of a valid request. Where permitted by law, this period may be extended by no more than 5 business days with an explanation.

11. SECURITY AND INCIDENTS

The Operator applies necessary legal, organisational, and technical safeguards, including access controls, protected connections, backups, event logging, software updates, credential protection, and control over persons with access to personal data.

If unlawful disclosure or access is detected, the Operator takes measures to stop the violation, mitigate its consequences, and conduct an internal investigation, and notifies Roskomnadzor within the periods required by law: an initial notice within 24 hours and investigation results within 72 hours. The affected user is notified where required by law or necessary to protect user rights and interests.

12. MARKETING COMMUNICATIONS

Marketing email or SMS is sent only with separate prior consent. A user may opt out at any time using the link in a message or by contacting support@kupiesim.ru. Opting out of marketing does not stop necessary service notices relating to payments, orders, security, and purchased eSIM operation.

13. POLICY CHANGES

The Operator may update this Policy following changes in law, services, or processing methods. A new version applies from its publication date and does not introduce new processing purposes retroactively. For material changes, the Operator posts a notice on the website and requests fresh consent where required by law.

14. CONTACTS

Questions, requests, and complaints concerning personal data processing may be sent to support@kupiesim.ru. Other contact methods are available on the Contact page. This Policy does not establish a mandatory pre-trial procedure before a complaint to Roskomnadzor or a court.