Privacy Notice

Version 2.2 · 21 September 2026 · Covers this website and eSIM orders

This notice covers two things: browsing this website, and buying an eSIM from it. There are no accounts — no password, no profile. There is no advertising, no advertising network and no analytics service. We do not sell your data and we do not build a marketing list from your visit or your order. The only cookie we set ourselves is a one-line security cookie on pages with a form (described below).

What is collected when you visit

Three things, all automatic and all ordinary for any website:

Server logs. Our web server records the page requested, the time, and your browser's user-agent string. Since 20 September 2026 it does not record your IP address at all. These logs are kept so we can keep the site running and secure, for no longer than 30 days.
Page counts, without cookies. We count how many times each page was viewed on a given day, and which website (domain only) sent the visitor. That is the whole record: a date, a page, a number, and for example "google.com". It contains no IP address, no cookie, no session and no browser string, so it cannot tell one visitor from another — and it is not meant to. We use it to see which destinations people look at and which ones they buy. No analytics service or third party is involved.
Network protection. This site is served through Cloudflare, which filters malicious traffic before it reaches us. Cloudflare processes your IP address for that purpose on our behalf, as our processor. If a burst of unusual checkout traffic is detected, we may ask your browser to pass a Cloudflare Turnstile check (a "you are human" test) before an order is created; most people never see it.
One security cookie. Pages that contain a form (for example the order lookup page) set a cookie named csrftoken. It exists only to make sure a form submitted to us really came from this site, it identifies nothing about you, and it is not used for tracking. It is the only cookie we set. At the time of writing, neither Cloudflare's protection nor the Turnstile check sets a cookie on gojowa.com either; if that changes we will update this notice.

The lawful basis for all of this is our legitimate interest in operating a secure website (UK GDPR Article 6(1)(f)). We do not use this data to profile you and we do not sell or share it with anyone else.

What is collected when you buy

Buying an eSIM creates an order record. This is everything in it, and why it is there. We collect nothing for the sake of it.

Your email address. The eSIM, its QR code and its activation code are delivered by email, so this is where your order goes. It is the only contact detail an order requires — we do not ask for your name. Basis: performing our contract with you.
The country you live in. The country you choose on the order form when we ask "Where do you live?". It decides which country's tax rules the sale falls under. At the moment we do not sell to customers who live in the European Union, and this answer is how we apply that. We store the two-letter country code, nothing more precise. Basis: our legal obligation to apply the right tax rules (UK GDPR Article 6(1)(c)).
The billing country of your card. Stripe asks for a billing address on its payment page. What reaches us is the country of that address, as a two-letter code — not the street, town or postcode, which stay with Stripe. It is a second check of the same tax rule: if it shows a country in the European Union, the order is refunded in full before anything is bought on your behalf, and we tell you why. Basis: our legal obligation to apply the right tax rules.
The order itself. Which plan you bought, the destination, what the plan promised on the card (data, validity, network, internet exit, hotspot), the price you paid, and the date. We freeze a copy of the plan as it was shown to you, so a later catalogue change cannot alter what you bought. Your order has a random reference number (not a running count), used in every email about it. Basis: performing our contract; keeping accounts.
Payment references. Stripe's identifiers for the payment session and the payment itself, the amount Stripe reported, and — if money went back to you — the refund identifier. We keep these so we can find the payment, refund it, and answer questions from your bank. We never hold your card details; see the next section. Basis: performing our contract; our legal duty to keep accounting and tax records.
Your consent record. At checkout you tick two boxes: that you want the eSIM supplied straight away, and that you understand this ends your 14-day right to cancel. We store the answers, the moment you gave them, and the version of the terms of sale you agreed to. Consumer law asks us to obtain this before supplying a digital product immediately, and without a record the consent is treated as not given. Basis: performing our contract; our legal duty.
IP address and browser (user-agent) at the moment you order. Here is exactly why. If a cardholder later disputes the payment with their bank (a "chargeback"), we have to show that the order was placed from a particular device, and that the eSIM was delivered at a particular time. Those two values, together with the delivery record below, are that evidence. They are not used for advertising, and we do not build a profile from them. Basis: our legitimate interest in defending against fraud and payment disputes.
The eSIM's technical identity. When our supplier issues your eSIM we receive its ICCID (the SIM's serial number), the activation code and the supplier's order reference. They belong to the eSIM rather than to you, and they stay with the order so that support can find your eSIM and we can prove what was delivered. Basis: performing our contract.
How much data was used. A single number — megabytes used — read from our supplier when we need it, chiefly when you ask for a refund: it lets us tell "never used" from "half used" without asking you to prove anything. We never see what the data was used for. Basis: performing our contract (our refund policy).
Email delivery record. For each order email: sent, delivered or bounced, with times, as reported by our email provider. We no longer record whether an email was opened — see "Email tracking" below. Basis: our legitimate interest in proving delivery.
Refund requests. If you ask for a refund we keep the reason, anything you wrote to us about it, our decision and why. Basis: performing our contract.

Where we rely on legitimate interest — the IP address and browser record from the order, the email delivery record, bot protection, server logs and page counts — we keep that data to defend ourselves against fraud and payment disputes and to keep the service secure, not to identify you or to show you advertising. You can object to this processing at any time by writing to privacy@gojowa.com. We do not currently process anything on the basis of consent, so there is no consent to withdraw.

What we never see

Your card details. Payment is taken on Stripe's own hosted page. Your card number, expiry date and security code never pass through our server; all we receive is Stripe's payment identifier and the amount.
What you do online. We have no access to the traffic your eSIM carries. The only thing our supplier gives us is the total amount of data used. We cannot see — and do not keep — which sites you visit or who you talk to.
Your location. We do not track your device's location. The IP address we keep is from the moment you placed the order, for the reason given above, and nothing after that.
Your name. An order does not ask for one.
Our supplier does not see you. When we buy your eSIM, the request we send to our supplier contains only the package code, the quantity, the price and our own order reference. Your email address, your IP address and nothing else about you goes to them.

If you email us

If you write to one of our addresses, we keep your message and reply so we can deal with what you asked and keep a record of the correspondence. Our email runs on Google Workspace, which acts as our processor. We keep business correspondence for up to two years unless it needs to be kept longer for legal or accounting reasons.

Email tracking

There is none. Until 20 September 2026 our order emails contained a small invisible image that told us when a message was opened; we switched that off and our emails now load nothing from the internet at all. Links in our emails go straight to the page they name and are not rewritten through a tracking service.

What we do keep is what our email provider reports back to us: that an email was sent, delivered, or bounced, and when. That is our evidence if you tell us an eSIM never arrived or a card issuer asks us to prove delivery.

Who processes what, and where

These companies handle data on our behalf, as our processors, and only for the purpose shown.

Who	What for	Where
DigitalOcean	Our server and database	London, United Kingdom
Cloudflare	The network in front of the site; bot check (Turnstile)	Global network
Stripe	Taking payment, refunds, handling payment disputes	Ireland / United States
Resend	Sending your order emails	Ireland (EU)
Google Workspace	Human correspondence (hello@, privacy@)	Global
eSIM Access	Issuing the eSIM	Receives no personal data about you (see "Our supplier does not see you")

Our server is in London, United Kingdom. Stripe, Cloudflare and Google Workspace are international providers and may process data outside the UK; those transfers take place under the safeguards UK GDPR requires. Order emails are sent through Resend, which processes them in Ireland, in the European Union.

How long we keep it

What	How long	Why
Server logs	30 days	Running and securing the site
Order, payment and refund records	Six years	Company accounting and tax records must be kept for six years; it is also the general limitation period for claims under a contract
IP address and browser record from the order	With the order record	Payment-dispute and fraud defence
Country you live in and card billing country	With the order record	Showing which country's tax rules applied to the sale
Email delivery record	With the order record	Proof of delivery
Page counts (no personal data)	Indefinitely — they identify no one	Seeing which destinations are looked at and bought
Human correspondence	Two years	Dealing with what you asked, and keeping a record of it

We do not keep any of this beyond the period shown.

Your rights

Under UK GDPR you may ask us for a copy of the personal data we hold about you, ask us to correct or erase it, object to our processing it, or ask us to restrict it. Write to privacy@gojowa.com and we will respond within one month.

If you are not satisfied with our response you can complain to the UK Information Commissioner's Office at ico.org.uk. We are registered with the ICO under registration number ZC251853.

Who we are

The data controller for this website is GOJOWA TECHNOLOGIES LTD, a private limited company registered in England and Wales on 15 September 2026 under company number 17460599. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Write to privacy@gojowa.com about anything in this notice and it reaches a person, not a queue.

Changes

When this notice changes we will update the version and date at the top. This is version 2.2 (21 September 2026): email open tracking has been switched off and the "Email tracking" section rewritten to say so, server logs no longer record IP addresses, and a cookie-free page counter that stores no personal data has been added. Version 2.1 (20 September 2026) added the country you live in and the billing country of your card, both collected at checkout to apply the right tax rules. Version 2.0 (20 September 2026) covered eSIM orders — what an order record contains and why, retention periods, Stripe as payment processor, the Turnstile bot check and the one security cookie. Version 1.2 (19 September 2026) added Resend as the processor for order emails and the "Email tracking" section. Version 1.1 (15 September 2026) named the company as the data controller. Version 1.0 (13 September 2026) was published before the company existed and named the site's founder as its operator.