Privacy Policy
Last updated: 25 October 2026
Introduction
Halo eSIM Ltd (“Halo”, “we”, “us”) is the data controller for the personal data we collect through haloesim.com. We are registered in England and Wales (company number 15176432) at 86-90 Paul Street, London, EC2A 4NE, United Kingdom, and registered with the UK Information Commissioner’s Office (ICO registration reference ZC112616).
This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have. We have written it in plain English. If anything is unclear, email legal@haloesim.com and we will explain.
In this policy, “you” and “your” refer to any person who visits our website or buys an eSIM from us.
What data we collect
We collect as little personal data as possible to run the service. The categories are:
Account and order data. Email address, name (if you provide it), and billing country. You give us this at checkout so we can deliver your eSIM and send order-related messages.
Transaction data. Payment confirmation token from Stripe, order history, plan purchased, destination, and order total. Halo never sees your full card number, CVV, or expiry date. Stripe processes your card details directly.
Device and usage data. IP address, browser type, device type, pages visited, timestamps, and referrer. Our analytics run cookieless by default. On the pages where a cookie banner is shown, accepting analytics cookies additionally stores an identifier on your device and enables session recording. See our Cookie Policy for the detail.
Analytics identifier on your order. If you accepted analytics cookies before you bought, we store the anonymous analytics identifier from your browser on your order record. It lets us see which visits led to a purchase without having to match you by name or email. It is a random identifier for a browser, not a name, an address or anything you typed, and we store it only where you have accepted analytics cookies.
Partner referral. If you reach haloesim.com through a link on one of our partner sites, such as a comparison site, and then buy, we record which partner referred you on your order, so we can pay that partner a commission. We learn this from the link itself, and from a cookie that remembers the partner for up to 30 days. That cookie is strictly necessary for crediting the partner, so it is set whether or not you accept marketing cookies, and your cookie choices do not change it. See our Cookie Policy.
Customer referral. If you follow a friend’s Halo referral link, we set a cookie that holds their referral code for 30 days, so the discount can reach your checkout. It holds nothing about you, and it is strictly necessary for the referral you followed the link to claim, so it is set whether or not you accept marketing cookies. If you use a referral code on your first order, we record the code’s use against your order and your email address, so the discount is given once and the friend who referred you can be credited. The friend who referred you sees only how many of their referrals have been used and the credit they have earned. They never see your name, your email address or your order. To prevent referral fraud, we compare the IP address and payment card fingerprint used on a referred order with those on the referrer’s own orders; a match is flagged for us to review and never blocks the order. See our Cookie Policy.
Session recordings. Only where you have accepted analytics cookies. A recording is a replay of your visit: the pages you opened, where you clicked, what you scrolled past. Every form field is masked before the recording leaves your browser, so anything you type – your email address, your name – is not captured. Recording is switched off entirely on our checkout pages and on every page of your order portal, whether or not you have accepted analytics cookies. If you have not accepted analytics cookies, no recording is made at all.
eSIM activation metadata. Activation status and the destination country of first network attach. This is operational data returned by our wholesale provider. Halo does not see what you do on the network – we have no access to your browsing activity, messages, or any content data.
Marketing preferences. Your consent status, the timestamp of your consent, and how you gave it (for example, a checkbox at checkout).
Bot-protection signals. When you use a form on our website, such as checkout, the order portal sign-in or the support chat, a bot-protection service checks that the request comes from a real browser rather than an automated one. The check runs in the background and does not ask you to solve a puzzle or tick a box, so you will usually not notice it. It reads technical signals about your browser and device, including your IP address, and it does not read what you type into the form. The service is provided by our hosting and edge network provider, and the data it processes is described in its Turnstile Privacy Addendum.
Communications. Any emails you send to legal@haloesim.com and our responses, and the messages you exchange with the support chat assistant on our website, including any email address you give it when you open a chat. That includes anything you tell the chat assistant about where you are, such as the country or city you are in, which we use to help with your request.
Screenshots and files you send to support. If you attach a screenshot, photo or PDF to an email you send us about a support request, we keep it with that request so the Halo team can read it when they reply. These files are stored on our hosting and edge network provider’s storage service and are deleted with the rest of your support correspondence (see How long we keep your data).
Why we process your data (purposes and legal bases)
| Purpose | Data categories | Legal basis |
|---|---|---|
| Fulfilling your order and delivering your eSIM | Account/order data, transaction data, eSIM activation metadata | Performance of a contract (Article 6(1)(b)) |
| Sending transactional emails about your eSIM (delivery, activation, expiry, and a single post-trip invitation to review Halo eSIM) | Account/order data | Performance of a contract (Article 6(1)(b)) |
| Customer support | Account/order data, communications | Performance of a contract (Article 6(1)(b)) |
| Fraud prevention and security, including checking whether a referral was used by the person who shared it (by comparing the IP address and payment card fingerprint of the two orders) | Transaction data, device and usage data, customer referral | Legitimate interests (Article 6(1)(f)) |
| Checking that form submissions come from a person rather than an automated script | Bot-protection signals | Legitimate interests (Article 6(1)(f)) |
| Service analytics and product improvement | Device and usage data | Legitimate interests (Article 6(1)(f)) |
| Paying partners a commission on sales they refer | Partner referral, transaction data | Legitimate interests (Article 6(1)(f)); the referral cookie itself is strictly necessary, so it is set without consent (PECR Regulation 6(4)(b)) |
| Giving a referred friend their first-order discount and crediting the customer who referred them | Customer referral, transaction data | Performance of a contract (Article 6(1)(b)); the referral link cookie itself is strictly necessary, so it is set without consent (PECR Regulation 6(4)(b)) |
| Marketing communications | Account/order data, marketing preferences | Consent (Article 6(1)(a)), or UK soft opt-in under PECR Regulation 22(3) for existing customers of similar products |
| Legal compliance including tax and accounting records | Account/order data, transaction data | Legal obligation (Article 6(1)(c)) |
Marketing and consent
We treat marketing consent differently depending on where you are, because the rules differ.
UK customers. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we may rely on the “soft opt-in”: if you have bought a similar product from us, we may send you marketing about similar products provided we gave you a clear opportunity to opt out at the point of purchase and we offer that opt-out in every subsequent message.
Australian customers. The Spam Act 2003 (Cth) requires express opt-in consent for all commercial electronic messages. If you are in Australia, we will only send you marketing emails if you have actively opted in. There is no soft opt-in for Australian customers.
How to withdraw consent. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by emailing legal@haloesim.com. Unsubscribing from marketing does not affect transactional emails about your order (for example, your QR code delivery email, activation confirmation, or post-trip review invitation).
Who we share data with
We use a small number of carefully selected processors to run the business. Each is bound by a data processing agreement.
- Stripe (payment processing and card tokenisation; also receives your email address, IP address, browser user agent, and the consent record captured at checkout) – US and Ireland. Safeguards: Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Our transactional email delivery provider (via mail.haloesim.com; receives your email address and the content of the messages we send you, including your QR code and activation code, and the emails you send to our support address, including any files attached to them) – US. Safeguards: Standard Contractual Clauses.
- Our product analytics provider (EU-hosted) – cookieless by default; stores an identifier on your device and records your session only where you have accepted analytics cookies.
- Our wholesale eSIM provisioning partner (receives your order reference, the plan you bought, and the ICCID of the eSIM issued to you – not your email address, name, or billing country) – Hong Kong/China region. Safeguards: Standard Contractual Clauses with transfer impact assessment.
- Anthropic, PBC (United States): provides the AI model behind Hal, our support assistant. It processes the messages you send to Hal and the order details Hal uses to answer, to generate Hal’s replies, under our data processing agreement with Anthropic. Anthropic retains this chat content for up to 30 days for safety and security. Transfers outside the UK rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses in that agreement.
- Our push-notification provider (delivers operational alerts to Halo’s own staff. Where an alert concerns a request to our website, such as a request for a monitoring link that appears only in data we supply to partners, it can include the visitor’s network with the last part of the IP address removed, the country, and the host name of the referring website. It never receives a full IP address, your email address, your name or your order records). Based in the United States.
- Our hosting and edge network provider (CDN and DDoS protection; also runs the databases that hold your order records, support chat transcripts and contact details, the storage that holds files you send to support, processing for our support chat assistant, and the bot-protection check on our forms) – global edge network, with UK and EU data residency where available.
Referring partners receive a monthly commission statement listing the order references, dates and amounts of the sales they referred. It never includes your name, email address or any contact details.
We do not sell your personal data to anyone. We do not share your data for third-party marketing purposes. We may disclose data if required by law, court order, or to protect our legal rights.
International transfers
Halo is a UK company. Our primary processing occurs in the UK and EEA.
Where personal data is transferred to the United States (Stripe, our transactional email delivery provider), we rely on Standard Contractual Clauses approved under UK GDPR and, where applicable, the EU-US Data Privacy Framework.
Analytics data is sent to our product analytics provider’s EU cloud region, hosted in the European Union.
Support chat messages are sent to our support chat assistant’s AI model provider, in the United States. This transfer is covered by that provider’s Data Processing Addendum, incorporated into its commercial terms, which applies the EU Standard Contractual Clauses as adapted for the UK by the International Data Transfer Addendum.
Where personal data is transferred to Hong Kong (our wholesale eSIM provisioning partner), we have assessed the transfer under Standard Contractual Clauses with a transfer impact assessment.
You can ask us for more details about any specific transfer by emailing legal@haloesim.com.
How long we keep your data
| Data category | Retention period | Reason |
|---|---|---|
| Order records | 7 years after last order | UK tax and accounting obligations |
| Financial records | 7 years | Statutory retention |
| Email marketing list | Until consent is withdrawn | Ongoing consent |
| Analytics data | 24 months rolling | Product improvement |
| Support correspondence, including files you attach | 3 years after last contact | Resolve follow-up queries and demonstrate service quality |
| Fraud-prevention records (records of chargebacks and similar payment misuse, and any resulting block on future purchases) | Up to 6 years after the event | Preventing fraud and repeat misuse |
When data is no longer needed, we delete or irreversibly anonymise it.
Your rights (UK GDPR)
Under UK GDPR, you have the following rights:
- Access. You can ask us for a copy of the personal data we hold about you. We may withhold fraud-prevention records from an access request while disclosing them would undermine the prevention of fraud.
- Rectification. You can ask us to correct inaccurate or incomplete data.
- Erasure. You can ask us to delete your data where it is no longer needed for the purpose it was collected (“right to be forgotten”). We may keep fraud-prevention records after an erasure request where we need them to prevent fraud, for up to 6 years after the event.
- Restriction. You can ask us to restrict processing in certain circumstances, for example while we verify the accuracy of your data.
- Portability. You can ask us to provide your data in a structured, machine-readable format so you can transfer it to another service.
- Objection. You can object to processing based on legitimate interests. We will stop unless we have compelling grounds that override your interests.
- Withdrawal of consent. Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
- Automated decision-making. You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Halo does not currently make such decisions.
How to exercise your rights. Email legal@haloesim.com with your request. We will respond within one month. If your request is complex, we may extend this by up to two further months, but we will tell you within the first month.
Right to complain. If you are unhappy with how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to address your concern first.
Australian customer rights (Privacy Act 1988)
If you are in Australia, you also have rights under the Privacy Act 1988 (Cth):
- Access (APP 12). You can request access to the personal information we hold about you.
- Correction (APP 13). You can ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
To exercise these rights, email legal@haloesim.com.
If you are not satisfied with our response, you have the right to complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
We take the security of your personal data seriously:
- All data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest.
- Our website is served through a global edge network with DDoS protection.
- Card payment data is handled entirely by Stripe, which is PCI-DSS Level 1 certified. Halo never sees or stores your card number.
- We use access controls and audit logs to limit and monitor access to personal data.
- We maintain an incident response process to detect, investigate, and report data breaches.
Children
Halo’s service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided personal data to us, please contact legal@haloesim.com and we will delete it.
Changes to this policy
We may update this policy from time to time. Material changes will be notified by email (to opted-in subscribers) or by a notice on our website. The current version and effective date are always shown at the bottom of this page.
Contact
If you have any questions about this policy or your personal data, contact us at:
Halo eSIM Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom