1. Data controller
The data controller is EI S.r.l. — Via Cariati 43, 00178 Roma (RM) — P.IVA ITIT16017671005 (marchio SIMAMMA), reachable at info@simamma.com (privacy contact).
2. Data we collect
Account data (name, email, phone); identity data required before activation (first name, last name, tax ID, country of residence, copy of an ID document, selfies and selfie videos with audio); order data (plans purchased, amounts, eSIM ICCIDs); wallet movements; technical browsing and security data (IP address, access logs, language, currency); consent registry (type, date/time, IP, web/app/email channel).
3. Purposes and legal basis
We process data to: perform the sales contract and activate the eSIM (art. 6.1.b GDPR); comply with tax, accounting and identification obligations under electronic communications regulations (art. 6.1.c); prevent fraud and abuse (legitimate interest, art. 6.1.f); customer support. Marketing to existing customers covers offers similar to the purchased service (soft opt-in, art. 130 c.4 of the Italian Privacy Code), revocable anytime with one click from emails or the account area; to non-customers only with consent (art. 6.1.a). Every consent is logged as proof (art. 7 GDPR).
4. AI identity verification and biometric data
The video identification required by electronic communications regulations may include: automatic document reading (OCR), matching the document photo with your selfie/video (face match), liveness proof, and reading a code aloud with audio transcription. These processes, which may involve biometric data (art. 9 GDPR), are carried out solely to verify your identity and prevent fraud, on the basis of legal obligation and legitimate interest; they are not used for any other purpose nor transferred. Analysis is performed by AI providers (OpenAI, Google) through the Emergent platform.
5. Automated decisions (art. 22 GDPR)
Automatic document analysis produces a proposed outcome: decisions with significant effects (final approval or rejection of verification) always allow human review by our staff. You may request human intervention, express your point of view or contest the decision by writing to info@simamma.com.
6. Recipients and non-EU transfers
Data may be shared with: Airalo (eSIM issuing), Stripe (payments), Twilio (verification SMS), Resend (email), Fatture in Cloud (e-invoicing), Emergent (infrastructure and AI), OpenAI and Google (document AI analysis), Google/Apple (social sign-in), Firebase (push notifications), Cloudflare (anti-bot). Some providers process data in the USA: transfers rely on the EU-US Data Privacy Framework adequacy decision or standard contractual clauses. No data is sold to third parties.
7. Retention
Account and order data: for the duration of the relationship and as required by tax law (10 years for accounting records). ID documents and videos: 360 days from verification, then made inaccessible (shorter on request at info@simamma.com). Consent registry: until account deletion, as proof of consent. Technical and security logs: 30 days.
8. Your rights, self-service
From your account area ("Privacy & consents" section) you can independently: download all your data (access and portability), correct name and email (rectification), grant or revoke marketing consent, delete your account (erasure). For restriction, objection or other requests write to info@simamma.com. You may lodge a complaint with your data protection authority (in Italy: Garante, gpdp.it).
9. Minimum age
The service is reserved to people aged 18 or over: the declaration is requested and recorded at registration or at the app's first launch.
10. Security
Bcrypt-hashed passwords, optional two-factor authentication (mandatory for administrators), encrypted and revocable sessions, brute-force protection, ID documents restricted to administrators, payments fully handled by Stripe (no card data on our servers).