Last Updated: February 19, 2026

1. Data Controller

ORIXA LTD (“we,” “us,” or “our”) is the data controller responsible for your personal data.

• Company Name: ORIXA LTD (Reg: 01-09-434489)
• Address: Andrea Karyou, 20, 3051, Limassol, Cyprus
• Support Email: [email protected]

2. The Data We Collect

We collect, use, and store different types of personal data:

• Identity Data: Name, username, or similar identifier.
• Contact Data: Email address and communication preferences.
• Transaction Data: Details about token purchases, payments, and the specific eSIM offers you have redeemed.
• Technical Data: IP address, login data, browser type/version, time zone setting, and device identifiers used to deliver eSIM profiles.

3. Purpose and Legal Basis for Processing

We only use your personal data when the law allows us to. Most commonly, we use it under the following bases:

• Performance of a Contract: To create your account, manage your token balance, and deliver the eSIM activation data you have purchased.
• Legal Obligation: To comply with Cypriot and EU tax laws (e.g., maintaining financial records of EUR transactions) and telecommunications regulations.
• Legitimate Interest: To detect and prevent fraud, secure our platform, and understand how users interact with our service to improve the platform.

4. Data Retention and Deletion

We keep your personal data only as long as necessary to fulfill the purposes we collected it for.

• Active Accounts: Data is retained while your account is active.
• Account Deletion Grace Period: If you request to delete your account, we apply a 12-month grace period before permanent erasure. During this time, your data is archived and restricted from processing. This period allows us to resolve any pending financial disputes, process potential refunds under our 14-day guarantee, and comply with legal audit requirements.
• Financial Records: Statutory tax laws may require us to keep transaction data (invoices) for up to 7 years.

5. International Transfers

As an eSIM distributor, we work with various global providers. If your data is transferred outside the European Economic Area (EEA), we ensure a similar degree of protection by ensuring at least one of the following safeguards is implemented:

• Transferring data to countries deemed to provide an adequate level of protection by the European Commission.
• Using specific Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Your Legal Rights

Under the GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure (“Right to be Forgotten”): Request deletion of your data (subject to our 12-month grace period and legal retention duties).
• Object/Restrict: Object to the processing of your data for marketing or legitimate interests.
• Data Portability: Request the transfer of your data to you or a third party in a structured, machine-readable format. To exercise these rights, contact us at [email protected].

7. Complaints

You have the right to make a complaint at any time to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy). We would, however, appreciate the chance to deal with your concerns before you approach the commissioner.

8. Payment Processing and Credit Card Data

We do not store sensitive credit card information (such as card number, expiration date, or
CVV) on our servers.

All payments are processed securely by PCI-DSS compliant third-party payment processors
(e.g., Stripe, PayPal, or similar services). These processors handle the collection, processing,
and storage of your payment details in full compliance with the Payment Card Industry Data
Security Standard (PCI-DSS).

We only receive confirmation of successful payment and basic transaction details necessary to
fulfill your order and maintain our financial records.

9. Data Security

We take the protection of your personal data seriously and implement appropriate technical and
organizational measures to safeguard it, including:

• Encryption: All data transmitted between your browser and our servers is protected with
  TLS/SSL encryption. Sensitive data at rest is encrypted where applicable.
• Access Controls: Access to personal data is strictly limited to authorized personnel on
  a “need-to-know” basis. We use strong password policies, multi-factor authentication
  (MFA), and role-based access controls.
• Secure Infrastructure: Our platform is hosted on secure cloud infrastructure with
  regular security updates, firewalls, and intrusion detection systems.
• Monitoring & Testing: We regularly monitor our systems for vulnerabilities and perform
  security assessments.
• Employee Training: All staff involved in data processing receive training on data
  protection and security practices.
• Incident Response: We maintain an incident response plan in case of any potential
  data breach and will notify you and the relevant supervisory authority as required by law.

While we strive to use commercially acceptable means to protect your personal data, no method
of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee
absolute security.

10. When and With Whom We Share Your Data

We do not sell your personal data to third parties for marketing purposes.

We may share your personal data in the following limited situations:

• Service Providers & Processors: With trusted third-party service providers who assist
  us in operating our website and delivering services (e.g., payment processors, hosting
  providers, email delivery services, eSIM provisioning partners, and analytics tools).
  These parties are contractually obligated to protect your data and use it only for the
  purposes we specify.
• Payment Processors: To complete your purchases (as detailed in the Payment
  Processing section above).
• Legal Requirements: When required by law, regulation, or legal process (e.g., court
  orders, subpoenas, or government requests).
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of
  assets, your data may be transferred as part of the transaction (with appropriate
  protections).
• Protecting Rights & Safety: To protect the rights, property, or safety of ORIXA LTD, our
  users, or the public, or to investigate fraud or security issues.
• With Your Consent: In any other situations where you have explicitly consented to the
  sharing.

All third parties with whom we share data are required to maintain appropriate data protection
standards consistent with GDPR.