Privacy policy

Controller. Startia Operadora, S.L.U. (tax ID B56079940, [dirección completa], Córdoba, Spain). Privacy contact: [privacidad@startia.es].

What we process and why.

Data	Purpose	Legal basis	Retention
Email, billing country, language	Process your order, deliver the eSIM, provide support	Performance of the contract	5 years from the order (tax obligations)
Payment data (handled by Stripe; Startia never stores your card)	Payment, fraud prevention, refunds	Contract and legal obligation	Per Stripe; references 5 years
eSIM technical data (ICCID, status, usage)	Activate and manage the service, show usage	Performance of the contract	While the eSIM is active and 12 months after
Account access data (date, time, approximate IP, device)	Account security and detection of unauthorised access	Legitimate interest and security obligation	12 months
Browsing data (cookies)	Site operation; analytics only with consent	Consent	See cookie policy
Marketing communications	Offers and new destinations	Consent (withdrawable in every email)	Until consent is withdrawn

Recipients. Service providers acting as processors under contract: the eSIM connectivity and provisioning provider (Redtea Mobile / eSIM Access, with provisioning servers in the European Union), Stripe Payments Europe (payments), Startia’s email provider and Startia’s hosting in Spain. To provide service in your destination country, technical connection data is processed by that country’s mobile networks, which may involve international transfers necessary for the performance of the contract (art. 49(1)(b) GDPR) and, where applicable, standard contractual clauses. We never sell personal data.

Your rights. You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [privacidad@startia.es] with proof of identity; we reply within one month. You may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Security. Startia Operadora applies technical and organisational measures aligned with ISO 27001 and Spain’s National Security Framework (ENS): encryption of personal data and eSIM profiles at rest and in transit, access control with strong authentication, activity logging, encrypted backups and incident management with notification to the authority within 72 hours where required.

Minors. The service is intended for users aged 18 or over.