Privacy Policy

Who this policy covers

It covers anyone who visits 88simrig.shop, creates an account, places an order, contacts support, or subscribes to our email updates. The data controller is 88SIM (operator details available on request at support@88simrig.shop), reachable at privacy@88simrig.shop.

What we collect

We collect only what we need to run the store and fulfill your order:

• Account data: name, email, password hash, locale, currency preference.
• Order data: shipping address, billing address, phone number, items purchased, order totals, tax and VAT data, IOSS-related fields for EU shipments.
• Payment data: handled directly by our payment provider (Stripe, and optionally PayPal). 88SIM never sees full card numbers — we receive only a tokenized reference and the last four digits.
• Support data: messages you send us, attachments, order history context.
• Technical data: IP address, user-agent, device type, pages visited, referrer, timestamps. Collected via server logs and first-party analytics.
• Cookies and similar technologies: see our Cookie Policy for the full breakdown.

Why we use it

Each purpose maps to a specific legal basis under GDPR Art. 6:

• To take your order, charge the correct amount, and deliver the product — Art. 6(1)(b), performance of a contract.
• To comply with tax, accounting, customs, and consumer-protection law — Art. 6(1)(c), legal obligation.
• To prevent fraud, secure the site, investigate chargebacks, and improve the product — Art. 6(1)(f), legitimate interest.
• To send marketing email, run non-essential analytics, and set non-essential cookies — Art. 6(1)(a), consent. You can withdraw consent at any time.

Who we share it with

We share personal data only with processors we need to run the business:

• Fulfillment and logistics partners that ship your order and provide tracking. They receive only the data required to deliver — name, address, phone, order contents. They are contractually bound not to use it for their own purposes.
• Payment processors (Stripe, and where enabled, PayPal) for payment, refund, and dispute handling.
• Transactional email provider (Resend) for order confirmations, shipping updates, and password resets.
• Analytics and error-monitoring services, configured to minimize personal data and respect consent signals.
• Law enforcement or regulators when we are legally required to respond. We push back on overbroad requests.

We do not sell your personal data. We do not share it for cross-context behavioral advertising.

International transfers

Because we ship worldwide and use cloud infrastructure, your data may be processed outside your home country, including in the United States and in the country of dispatch. Where data leaves the EU/EEA or the UK, we rely on Standard Contractual Clauses and additional safeguards where required.

How long we keep it

We keep data only as long as we need it for the purpose it was collected:

• Account data: for the life of your account, plus 30 days after deletion to complete final operations.
• Order, invoice, and tax data: retained for the retention period required by applicable tax law (typically 7–10 years) to meet accounting and tax obligations.
• Support tickets: 24 months after the ticket is closed.
• Technical logs: up to 90 days, then rotated.

Your rights

Under GDPR you have the right to access, correct, delete, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. Under CCPA, California residents additionally have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, write to privacy@88simrig.shop. We respond within 30 days (GDPR) or 45 days (CCPA). You can also use the self-serve data export and account deletion tools in your account settings.

If you think we have mishandled your data, you have the right to complain to a supervisory authority — in the EU, your local data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency.

Security

We use TLS on every page, hash passwords with bcrypt, enforce staff MFA, keep an audit log of admin actions, and limit access on a need-to-know basis. No system is perfectly secure — if we ever detect a breach affecting your data, we notify you and the relevant authority without undue delay.

Children

88SIM is not directed at children under 16. We do not knowingly collect personal data from them. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top and, for material changes, notify you by email or via a banner on the site before the change takes effect.