Privacy Policy

1. INTRODUCTION

This Privacy Policy describes how we collect, use, share, and otherwise process your personal data in connection with your use of:

• the website located at https://unpack.com/ and its subdomains and any of our other websites on which a link to this Privacy Policy appears (each, the "Website")
• mobile application(s) that we offer subject to this Privacy Policy, including Unpack eSIM mobile application available at Apple App Store and Google Play (each, the "App").
• products, services, content, and other resources available on or enabled via the Website or the App, including Unpack eSIM Service (collectively, with the App and the Website, the "Services").

The Services are intended for individuals who have reached the applicable minimum age of consent under local law. Unless local law requires a higher age, that age is 13; in the EEA and UK, it is 16. If a higher age applies under local law, you will need to meet that higher threshold.

We do not knowingly collect, solicit, or store any information from individuals who have not reached the minimum age. If you are a parent or guardian and believe we have unintentionally collected information from a child, please contact us at [email protected].

Please read the following carefully to understand our practices regarding your personal data and how we treat it.

2. IMPORTANT INFORMATION AND WHO WE ARE

Toggle Inc., a Delaware corporation, is the data controller and is responsible for your personal information ("Company", "we", "us", or "our" in this Privacy Policy).

Contact details

Our full details are:

• Full name of legal entity: Toggle Inc.
• Email address: [email protected]
• Postal address: 131 Continental Dr Ste 301, Newark - 19713-4323 United States (US)
• Telephone number: +1 (760) 512-1393

You have the right to make a complaint at any time with a supervisory authority, in particular in the EEA/UK Member State where you live, work, or where you consider that a breach has occurred.

Changes to the Privacy Policy and your duty to inform us of changes

We regularly review this Privacy Policy.

If we make material changes to this Privacy Policy, we will post the updated version on this page and may notify you by email, through the Services, or when you next log in to your account. We may require you to acknowledge the updated terms before continuing to use the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

3. WHAT DATA WE MAY COLLECT

We collect personal data that is necessary, adequate, and relevant for the purposes described in this Privacy Policy. We may collect additional data where required by law or where you choose to provide it to us. The personal data we collect will depend on the circumstances and your use of the Services.

To make it easier for you to use this Privacy Policy, we have grouped the data collected into the following categories.

• Contact Data includes email address, other contact information you chose to provide to us, such as your name.
• Profile Data includes user ID, email address.
• Transaction Data includes billing and delivery addresses, partial payment card details and records of a user's payments, purchases, deliveries, returns, and refunds.
• Device Data includes type of device, the user's unique device identifier, mobile network information, user's mobile operating system, the type of mobile browser, IP address, time zone setting.
• Usage Data includes logs and details of user's use of the App and the Services, including the dates and times on which the user downloads, access, or updates the App and the Services, any error or debugging information, and the actions we and the user take in relation to them and Cookies Data.
• Cookies Data includes the information collected through cookies and similar technologies.
• Direct Marketing Data includes user's direct marketing preferences, consent for receiving direct marketing from us and/or third parties and the history of the direct marketing communications we have sent to the user.
• Country-level Location Data includes user's approximate current location based on IP address.
• Feedback Data includes user's feedback and survey responses.

We collect data in three ways:

• data you provide to us;
• data we collect automatically;
• data we collect from our partners.

A. Data you provide to us

• Profile Data you submit when you sign up as a user of the Services.
• Details of your request and other data you choose to provide when you request support: Contact Data, Device Data, Profile Data, Usage Data, communications, complaints, or other interactions.

B. Data we collect automatically

When you use the Services, we may automatically collect the following categories of data:

• Profile Data
• Device Data
• Country-level Location Data
• Usage Data

Note that we do not use such data to learn a person's true identity or contact details, but only to provide you with the Services.

C. Data we collect from our partners

Third-party platforms. In case of subscription purchases processed by the Apple App Store or Google Play, we do not access, collect, or store your financial data, such as your credit card number or bank account. You are requested to provide payment details directly to the relevant platform. We may, however, receive limited data related to the purchase. For example, platforms may notify us if a purchase was successful and provide transaction details such as the transaction ID, purchase token, currency, and purchase date and time ("Purchase Data"). Any post-purchase processes are controlled by the platforms. We encourage you to review the privacy policies and terms of service of the platforms for further information before subscribing to the Services.

Third-party payment processor. If you subscribe to the Services directly with the Company, we will use Stripe for processing your payments. We receive the following categories of data from Stripe ("Transaction Data"):

• Stripe customer ID;
• email;
• partial bank card details (card brand (e.g. Visa, MasterCard), last four digits of the card number, expiration month/year), country of the card's issuer;
• country-level billing address.

4. WHY WE COLLECT AND USE YOUR PERSONAL DATA

We will only collect and use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly, we will use your personal data in the following circumstances:

• Consent. Consent means that you have given a specific, informed, and unambiguous indication of your wishes by which you signify agreement to the processing of your personal data. You can withdraw your consent at any time by contacting us.
• Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on the performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

5. AUTOMATED DECISION MAKING AND PROFILING

We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).

6. CRIMINAL OFFENCE DATA AND SPECIAL CATEGORY DATA

We do not intentionally collect criminal offence data about you. However, we may process data relating to criminal offences in monitoring the use of the Services for security purposes, where we suspect you may have committed a crime, such as attempting to make a fraudulent purchase or claim, or circumvent the security of the Services. In such circumstances, we will provide that information to law enforcement and/or use it to establish, exercise, or defend a legal claim. In those circumstances, according to the type of activity and purpose, we will rely on legitimate interests (protecting our business, employees, and other users) and legal obligation (where required by legal, judicial, or law enforcement to disclose or process that information).

7. COOKIES

Like most online services, we may use cookies and similar technologies to provide and personalize your Services experience, analyze Services use, deliver targeted advertising and prevent fraud. You can disable optional cookies in your browser settings, but then some parts of the Services may not function properly.

What are cookies?

Cookies are small pieces of text sent to your web browser that assist us in providing the Services according to the purposes described. A cookie file is stored in your web browser and allows the Services or a third party to recognize you and make your next visit easier and the Services more useful to you.

Cookies can be "persistent" or "session" cookies. Persistent cookies remain on your device when you go offline, while session cookies are deleted as soon as you close your web browser.

How do we use cookies?

We do not use our own cookies in the Services, but we may use third-party cookies. Cookies serve different tasks. For example, they may be used in the Services to report usage statistics, deliver advertisements on and through the Services, and so on in accordance with privacy policies of third parties.

Strictly necessary cookies

Some cookies may be necessary for the Services to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for the Services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but then some parts of the Services may not work. These cookies typically do not store personal data. Please note that you cannot withdraw your consent to cookies that are strictly necessary for the operation of the Services.

Functional cookies

These cookies enable the Services to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

Performance cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Services. They help us understand which pages are the most and least popular and see how visitors move around the Services. The information collected in these cookies are aggregated, meaning that they do not relate to you personally. If you do not allow these cookies we will not know when you have visited the Services, and will not be able to monitor its performance. In some cases, these cookies may be sent to our third-party service providers to help us manage analytics.

Targeting cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

How to opt-out of the installation of Cookies?

If we use cookies in our Services, we will ask about your preferences before collecting any cookies, other than strictly necessary ones. As cookies are linked to the browser you are using, they can be disabled directly by your browser, however, disabling cookies may prevent you from using certain Website features – in particular, services provided by third parties may not be accessible and may not be displayed correctly.

You can find further information about how to manage Cookies in the most commonly used browsers at the following addresses: Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Internet Explorer.

Also, for further information or instructions follow the initiatives provided by the EDAA (EU), Digital Advertising Alliance (US), Network Advertising Initiative or AppChoices for mobile devices, DAAC (Canada), and other similar services.

8. SPECIAL CATEGORIES OF PERSONAL DATA

We do not knowingly collect special categories of personal data such as data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

9. DISCLOSURES OF YOUR PERSONAL DATA

We may disclose your information to certain categories of recipients (for example, cloud storage or third-party payment processor) in order to provide you with the Services and comply with our legal obligations. We share some data with these third parties only when legally permitted or under data processing agreements.

We share your personal data with these third parties only where we have a legal basis as set out above or where such third parties process data on our behalf based on a data processing agreement, which may restrict further subcontracting by such third parties.

We may share your personal data with the following third parties:

• App distribution platforms (Apple App Store / Google Play). App distribution and platform-related data shared for the purpose of the App distribution only. Any data processing is governed by the platform providers independently. You can learn more about Apple App Store and read its privacy policy here; You can learn more about Google Play and read its privacy policy here.
• Amazon Web Services, Inc., USA (AWS), our data storage provider. You can find their privacy policy here.
• Third-party log-in tools. If you choose to log in the Services with the use of a third-party tool (such as Apple or Google), we will collect certain Profile Data from such third-party tool. The exact list of personal data collected will depend on your privacy settings, but it would usually include your identifier and may include your email.
• Stripe, Inc., USA (Stripe), our third-party payment processing provider. If you subscribe to the Services directly with the Company, we will use Stripe for payments, analytics, and other business services. Stripe may collect personal data, including via cookies and similar technologies. The personal data Stripe collects may include Transaction Data and identifying information about devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection, loss prevention, authentication, and analytics related to the performance of its services. You can learn more about Stripe and read its privacy policy here.
• Telna Inc., Canada, provides mobile services through its roaming partners. You can learn more about Telna and read its privacy policy here.
• eSIM service providers. Selected plan device/network technical identifiers may be shared (if required) for the purpose of activation and providing eSIM data plans.
• Amplitude Inc. Aggregated or pseudonymized Usage Data (events, screens viewed, interactions, session duration, frequency), Device Data, Approximate location (country/region based on IP) for the purpose of Services analytics, feature usage analysis, and improvement of user experience.
• ZenDesk Inc. and its affiliates. Data provided directly by the user when contacting support, which may include Contact Data, support request content, including attachments provided by the user, Device Data, Usage Data, Profile Data (to the extent relevant to the request), for the purpose of providing customer support, handling user inquiries, and managing support tickets.
• Firebase Crashlytics by Google LLC and its affiliates. Device Data (device model, OS version, device state at time of crash), Usage Data (Crash logs and stack traces), App version and build information, installation identifier (Crashlytics installation ID), basic diagnostic data (battery level, memory usage at crash time) for the purposes of debugging, monitoring App stability, diagnosing crashes, and improving performance.
• Cloudflare. Device Data, Request and traffic data, approximate location for the purpose of ensuring service availability, infrastructure security, performance optimization, and protection against malicious traffic.
• regulators, law enforcement, and public authorities where necessary to exercise our rights or comply with a legal obligation.

10. INTERNATIONAL TRANSFERS

The Services are global by nature, and your data may therefore be transferred to and processed in countries other than your country of residence. Because different countries may have different data protection laws than your own country, we take steps to ensure adequate safeguards are in place to protect your data, as explained in this Privacy Policy.

Adequate safeguards that our partners may use include transfer of data to the jurisdictions, which are considered by the European Commission to be offering an adequate level of protection for personal data of EU residents, or standard contractual clauses approved by EU Commission, or other methods approved by the relevant regulators in other countries.

Please contact us using the contact details above if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

11. DATA SECURITY

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use, or access. We are continuously developing and implementing administrative, technical, and physical security measures to protect the confidentiality, security, and integrity of the collected data and to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the data under our control. This includes, but is not limited to, data encryption and limitation of access to personal information based on a "need-to-know" principle.

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of the Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

All information you provide to us is stored on secure servers provided by AWS (SOC 2 Type II compliant, ISO 27001 compliant), located in jurisdictions, which are considered by the European Commission to be offering an adequate level of protection for personal data of EU residents or standard contractual clauses approved by EU Commission or other methods approved by the relevant regulators in other countries.

Access to our systems is strictly controlled through firewalls, whitelisting of IP addresses, and the application of the principle of least privilege. All access requires strong, complex passwords and mandatory multi-factor authentication.

Any payment transactions carried out by our third-party payment processing provider, Stripe, are encrypted using mutual transport layer security (mTLS) technology and processed as described at https://docs.stripe.com/security.

12. DATA RETENTION

We keep your information only for as long as necessary to provide the App and the Services to you and fulfil the purposes described in this Privacy Policy.

Once we no longer have a legal basis to retain your personal data, we will either delete it or, in some circumstances, anonymize it (so that it can no longer be associated with you). We may use anonymized data for research or statistical purposes indefinitely without further notice to you.

Personal information printed on paper will be destroyed by shredding.

13. YOUR LEGAL RIGHTS

You have the following rights under data protection laws in relation to your personal data.

• Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.
• Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)
• Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You can also ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with the law. (In some cases, we may need to continue to retain some of your personal data where legally required. If these apply, we will notify you at the time of our response.)
• Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information, which override your rights and freedoms.
• Restriction. Request that we restrict or suspend our processing of your personal data: if you want us to establish the data's accuracy; where our use of the data is unlawful, but you do not want us to erase it; where we no longer require it, but you need us to hold onto it to establish, exercise, or defend legal claims; or you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
• Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.
• Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint with a supervisory authority at any time.

You can exercise any of these rights at any time by contacting us at [email protected] or via the App.

14. US PRIVACY RIGHTS

This section applies to you if you are a resident of any of the US States which have adopted their state privacy acts, including California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Delaware, Iowa, Montana, Tennessee, Florida, New Hampshire, New Jersey, Kentucky, Nebraska, Rhode Island, Indiana (together "US Privacy laws").

• Right to access. You may submit up to two times in a 12-month period, free of charge, a verifiable request to disclose what personal information we collected, used, shared, sold or disclosed about you in the preceding twelve (12) months.
• Right to delete. You have the right to request that we delete any of your personal information we collected and retained, subject to certain exceptions.
• Right to correct. You have the right to request to correct the inaccurate personal information that we hold about you.
• Right to data portability. You have the right to obtain your personal data in a portable and readily usable format.
• Right to opt-out. Depending on your state of residence, you may have the right to opt out of targeted advertising, the sale of personal information, or certain profiling activities. Whether these rights apply depends on our actual processing activities and the law applicable to you.
• Right to be free from discrimination. We may not discriminate against you for exercising any of your rights under US laws.
• Right to limit use and disclosure of sensitive personal information (for California residents). However, we note that we do not intentionally collect sensitive personal information, except where such information is necessary for the provision of the Services or where you choose to provide it to us.

We will respond to your request within 45 days, and in more difficult cases we may extend our response time by another 45 days. If you are a Virginia, Colorado, or Connecticut resident, you have the right to appeal our decision to deny your rights request.

We do not sell our users' data.

15. CONTACT US

Please contact us if you have any questions about this Privacy Policy.

If you have questions about data protection or any requests for resolving issues with your personal data, you can contact us at [email protected] or by contacting us via the App.