OFRILI LEGAL
Privacy Policy
How personal information is collected, used, shared, retained and deleted.
1. Controller
The data controller is [YOUR LEGAL COMPANY NAME] (company number [COMPANY NUMBER]), registered office [REGISTERED OFFICE ADDRESS]. Contact: [email protected]. Product support and privacy requests: [email protected].
2. Data we collect
Account data (email, name if provided, authentication records); order and wallet transaction data; eSIM identifiers such as ICCID and usage summaries needed to deliver the service; device and security signals (app version, platform, integrity checks, approximate network metadata); support messages; and payment status from our processor (Stripe). We do not store full card numbers or CVC codes.
3. Purposes and legal bases (UK GDPR)
We process personal data to provide the contract (account, purchase and eSIM delivery); comply with law (tax, accounting and fraud-prevention obligations); pursue legitimate interests (security, abuse prevention, service improvement and chargeback defence); and, where required, based on consent (optional marketing or certain device permissions).
4. Service providers and sharing
We use carefully selected service providers to operate Ofrili, including Stripe for payment processing, email delivery, hosting, and mobile connectivity services required to provision eSIM plans. Support is provided by email and in-app tickets. Providers process personal data only for the service and under appropriate contracts. We do not sell personal data.
5. International transfers
Some providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as the UK IDTA, Standard Contractual Clauses, adequacy decisions or another lawful transfer mechanism.
6. Retention
We keep account and order records while your account is active and afterwards only as required for legal, tax, dispute and security purposes. Purchase and transaction records may be retained in anonymised form for UK accounting, tax, fraud-prevention and legal compliance, typically for up to six years. Security and deletion audit logs are kept under documented retention schedules. Support tickets are retained as needed to resolve your request and improve service quality.
7. Account deletion
You can permanently delete your account in the Ofrili app under Account settings. You can also request deletion without the app at https://ofrili.com/delete-account or by emailing [email protected]. Account access ends when deletion is completed; personal profile and authentication data are removed or irreversibly anonymised. Installed eSIMs are not removed from your device. We retain only records required for accounting, tax, fraud prevention, legal claims and proof that the erasure request was completed.
8. Your rights
Subject to UK GDPR, you may request access, rectification, erasure, restriction, portability, or object to certain processing. You may complain to the UK Information Commissioner’s Office (ICO). To exercise rights, email [email protected] or [email protected].
9. Security
We apply technical and organisational measures including encryption in transit, access controls, session security and device integrity checks. No method of transmission is 100% secure.
10. Children
Ofrili is not directed at children under 16. We do not knowingly create accounts for children.
11. Changes
We may update this Privacy Policy by publishing a new version in the app and on https://ofrili.com. The effective date is shown at the top of the document.