Privacy Policy

HARTWICK VENTURES LTD, trading as Velusim, is responsible as controller for the personal information it processes to operate velusim.com, sell and manage its eSIM services and communicate with customers.

Our company number is 17206399 and our registered office is Dept 6789, 196 High Road, Wood Green, London, United Kingdom, N22 8HH. Contact info@velusim.com for privacy questions, rights requests or complaints.

This Policy covers Website visitors, account holders, customers and people who contact us. Telecommunications networks may also process information for their own operations and legal obligations. This Policy describes processing for which Velusim is responsible; it does not suggest that we control every independent network's processing.

The information relevant to your interaction with us may include:

Not every category applies to every user. Service records do not necessarily include the content of communications. The fact that a mobile network carries your traffic does not mean Velusim receives all browsing, call or message content.

Please do not email passwords, full payment-card details, card security codes or unrelated sensitive information. If verification is needed, we will explain what information is relevant and how to provide it appropriately. Payment details entered during checkout are processed for payment authorisation; ordinary support correspondence is not an appropriate way to submit them.

Where UK or EU data protection law applies, we use personal information only where an applicable legal basis permits it.

When relying on legitimate interests, we consider the purpose, necessity and effects of processing on you. We do not rely on that basis where your interests or fundamental rights override our interests. You may ask for more information about the relevant assessment.

Acceptance of the Terms & Conditions is not consent to all processing. If information is needed to enter or perform the contract, failing to provide it may prevent us from creating an account, completing an order or supplying the service. Optional information and marketing choices are not conditions of purchase.

We disclose information only as relevant to the purpose and applicable law. Recipient categories may include:

• Payment-processing, acquiring and banking organisations, for authorisation, settlement, refunds and payment disputes.
• eSIM provisioning and telecommunications organisations, for issuing profiles, activating Plans, managing allowances, providing connectivity and investigating faults.
• Hosting, infrastructure and security providers, for operating and protecting systems.
• Customer communications and support providers, for transactional emails, support enquiries and complaints.
• Marketing or analytics providers, only where the relevant functionality is used and the required legal basis and choices are in place.
• Professional advisers and auditors, where necessary for advice, accounting, audit or legal claims.
• Public authorities, regulators, courts and law-enforcement bodies, where disclosure is required or otherwise lawfully justified.
• Parties to a proposed business reorganisation or transfer, only where disclosure is necessary, proportionate and appropriately protected, with notice of material changes where required.

Some recipients act on our instructions; others have independent legal responsibilities. We use appropriate contractual arrangements where required and limit disclosure to information relevant to the recipient's role. This Policy does not authorise unrestricted disclosure to unspecified parties.

5.1. Retention periods by category

The periods below apply to personal information held by Velusim or processed on our behalf. They identify both the retention period and the event from which it is calculated. We delete or irreversibly anonymise information earlier where its purpose has ended and no other lawful basis requires retention. Pseudonymised information that can still be linked to a person remains personal information.

For example, accounting records for an accounting period ending on 31 December 2026 would normally be retained through 31 December 2032. An account's ordinary profile information is not kept until that date merely because the customer placed an order during that period.

Account closure takes effect when the closure process is completed and confirmed to you. We will not keep that process open solely to postpone deletion. Any active service or outstanding matter affecting closure will be explained. An unresolved accounting obligation or dispute may justify keeping the relevant records separately, rather than keeping an otherwise unnecessary account profile open.

A support case or complaint is closed when the substantive response has been provided, any agreed action has been completed and any internal review already requested has concluded. If the same matter is genuinely reopened, the period for the updated case runs from its subsequent closure. Routine administrative activity or an unrelated new enquiry does not restart retention of an old file.

5.2. Statutory obligations and legal-claim records

Accounting and tax. The six-year accounting period above reflects UK corporation-tax record-keeping requirements. Where required, relevant records are kept until the later of that period, completion of an HMRC enquiry into the matters concerned, or expiry of the applicable enquiry window. A late return or another applicable legal requirement may affect the end date. We determine the date from the relevant accounting period, filing history and specific statutory requirement. Our lack of UK VAT registration does not remove corporation-tax record-keeping obligations.

Legal claims. For ordinary simple-contract claims under the law of England and Wales, the usual limitation period is six years from the date the cause of action accrued, normally the relevant breach. This is not automatically six years from account closure, complaint closure or the date of purchase. Different claims, jurisdictions, court orders or legal rules that postpone or extend a limitation period may require a different calculation.

Where it is necessary and proportionate to retain information for a legal claim, we identify the issue, applicable jurisdiction, relevant limitation rule, starting event and resulting retention end date. Only information needed to establish, exercise or defend that claim is retained on that basis. The existence of a possible limitation period is not a general requirement to keep all customer information for that period.

5.3. Documented exceptions and restricted retention

If a specific record is subject to an unresolved dispute, chargeback, security investigation, regulatory enquiry, preservation notice or legal proceeding when its ordinary period ends, we may retain that record for as long as it remains necessary for that matter and any applicable legal obligation.

We document the reason, affected records and end date or review trigger, restrict access and review continued need at least every six months and when the matter is resolved. Once the reason ends, and no other lawful retention period applies, we delete or anonymise the affected information within 30 calendar days. If a subsequent appeal, enforcement process or further legal requirement necessitates retention, that basis and its duration are assessed separately.

An exception does not automatically extend the retention of unrelated account data, correspondence or logs. Information kept only for compliance or a dispute is not used for unrelated marketing.

5.4. Other service records and preferences

Detailed eSIM and usage information is kept while needed to deliver an active Plan or Top-up and establish the relevant allowance or charge. Once that operational purpose ends, detailed technical records follow the 90-day technical-log limit, measured from the end of that purpose. A minimal record needed to substantiate an order, payment or refund follows the accounting rule; information needed for a particular support case or claim follows the relevant rule above. Retaining a transaction summary does not justify retaining all underlying traffic or diagnostic data.

Marketing subscription information is retained while the relevant subscription or lawful marketing relationship continues. Following an opt-out, we retain only the minimum suppression information needed to prevent further unwanted marketing while the relevant marketing system remains in use, unless a separate legal obligation or claim requires a limited record. Consent evidence is retained while we rely on the consent and, afterwards, only to the extent needed to demonstrate the lawfulness of the relevant activity under the claim criteria in Section 5.2.

Cookie and browser-storage durations are described in our Cookie Policy and the applicable cookie information. Those durations do not authorise indefinite retention of personal information collected through the technologies.

5.5. Deletion, backups and your requests

Our retention schedule applies to records under our control, including copies held by processors on our behalf. Deletion and backup-management processes must give effect to these periods; making a backup does not create a new retention period. Copies awaiting deletion are restricted from ordinary use, and data previously marked for deletion must not be returned to active use following restoration.

Independent organisations may retain information under their own legal obligations and privacy notices; this does not authorise Velusim to retain its copy beyond its applicable period.

You can request deletion or ask how a period applies to your information by emailing info@velusim.com. A scheduled maximum is not a reason to reject a valid earlier erasure request. If particular information must be retained, we will explain the category, reason and applicable duration or determining criteria, subject to lawful restrictions on disclosure.

Travel connectivity can involve processing in your destination and in countries where relevant infrastructure or support operations are located. A destination outside the UK or European Economic Area may have different data protection laws.

Where we make a transfer subject to UK or EU restrictions on international transfers, an applicable legal mechanism is required. Depending on the destination and arrangement, this may be a recognised adequacy decision, appropriate contractual safeguards with necessary additional measures, or a permitted exception in limited circumstances.

Contact info@velusim.com for details of the destinations and transfer mechanism relevant to our processing of your information and for a copy or description of applicable safeguards, subject to lawful redactions. Purchasing a travel Plan is not blanket consent to all international transfers.

Depending on your location and applicable law, you may have rights to access information, correct inaccuracies, request deletion, restrict processing, receive a portable copy of certain information, object to particular processing and withdraw consent.

You can object at any time to processing for direct marketing, including associated profiling. You can also object to processing based on legitimate interests on grounds relating to your situation. Where applicable, we must stop unless we can demonstrate a legally sufficient reason to continue.

To unsubscribe from promotional emails, use the unsubscribe option in the message or email info@velusim.com. Essential order, service and legal communications may still be sent. Withdrawing consent does not affect processing lawfully carried out before withdrawal.

Send rights requests to info@velusim.com. We may request proportionate information to verify identity or clarify a request. Under applicable UK or EU rules, we generally respond without undue delay and within one month, subject to lawful timing adjustments and extensions. If an extension or refusal applies, we will explain the reason and available challenge routes within the required period. Requests are generally free, with exceptions only where permitted by law.

Where applicable law provides safeguards concerning significant decisions made solely by automated means, you may request the relevant information, contest the decision and seek human intervention. Contact us if a transaction or account decision appears incorrect; we will explain the applicable review process.

We use technical and organisational measures appropriate to the information and risks involved. No online system can guarantee absolute security. You can help by protecting account credentials, keeping devices secure and reporting suspected unauthorised activity promptly.

If a personal data breach occurs, we will assess it and notify affected individuals and authorities where required by law. No statement in this Policy is a claim of a particular security certification.

Velusim is intended only for people aged 18 or over. We do not invite children to create accounts or purchase services. If you believe a person under 18 has provided information in connection with an account or purchase, contact us so we can investigate and take appropriate action, including deletion where lawful and appropriate.

You can raise a privacy complaint at info@velusim.com or write to our registered office. Describe the issue and the outcome you are seeking. We will acknowledge a data protection complaint within the applicable legal period, including within 30 days where required by UK law, investigate appropriately and communicate the outcome without undue delay. This acknowledgement period does not replace the separate deadlines for rights requests.

You may complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. If another data protection authority has jurisdiction, you may also contact it, including the authority for your habitual residence, place of work or alleged infringement where applicable. Our internal procedure does not remove that right.

We may update this Policy to reflect changes in processing or legal requirements. Material changes will be brought to your attention where required. A policy update is not a substitute for obtaining new consent when consent is legally needed.

Privacy contact: info@velusim.com · Controller: HARTWICK VENTURES LTD, company number 17206399 · Address: Dept 6789, 196 High Road, Wood Green, London, United Kingdom, N22 8HH