Privacy Policy

1. Who is responsible for your information?

MondoMate is a brand of NexCon.io ApS, Danish company registration no. 40831517, Buchwaldsgade 50, 5000 Odense C, Denmark. NexCon.io ApS is the controller for processing whose purposes and means we determine.

For questions about this policy, personal data or your rights, contact legal@mondomate.com. You can also write to our postal address, marked “MondoMate — personal data”. For help with a purchase or your eSIM, contact support@mondomate.com.

2. What information do we process?

The information depends on how you use MondoMate:

• Contact and account details: name, email address, language, login and verification information, and an optional telephone number. For Business, this may include company name, VAT number and user roles.
• Purchases and payments: selected package and destination, price, currency, order and payment references, payment status, billing information, acceptance of terms, and withdrawal or refund requests. Payment card details are entered in the payment provider's solution.
• eSIM delivery and use: eSIM identifiers, allocation, installation and package status, recorded data usage, network country and relevant times. Network country is not the same as precise GPS location.
• Recipients and Business allocations: names and email addresses of people allocated an eSIM, together with allocation, redemption and expiry information.
• Enquiries: support messages, partner enquiries, chat content and images or other information you choose to send us.
• Technical and security information: IP address or derived identifiers, browser and device information, sessions, error events, access events and cookie choices.

We obtain information from you and your use of the service. We may also receive relevant information from payment and telecommunications providers, or from a purchaser, employer or partner ordering or allocating an eSIM to you.

You must provide the contact, payment and delivery information necessary for us to fulfil your purchase. Access to private customer information requires appropriate verification. Providing an optional support telephone number, subscribing to newsletters and using AI chat are not conditions of buying an eSIM.

3. Why do we use the information?

We process personal data for the following purposes and on the following legal bases under the General Data Protection Regulation:

• Performing your contract: purchasing, payment, delivery, activation, managing packages and remaining data, service notifications and customer support. The basis is Article 6(1)(b).
• Managing Business services and recipients: where a contact person or recipient is not themselves a contracting party, we generally rely on our legitimate interest in delivering the ordered service to the correct person and managing the customer relationship, under Article 6(1)(f).
• Protecting and maintaining the service: access controls, preventing abuse, troubleshooting, operational security and necessary legal-claim evidence. We rely on our legitimate interests in a secure, functioning service and protecting our and our customers' rights, under Article 6(1)(f).
• Complying with the law: including accounting, VAT and responding to personal-data rights requests. The basis is Article 6(1)(c).
• Responding to enquiries: Article 6(1)(b) where you take steps towards your own contract, and Article 6(1)(f) for general enquiries and business contacts. The interest is answering the enquiry and managing the relationship.
• Optional newsletters and consent-based measurement: your separate consent, under Article 6(1)(a).

Where processing relies on legitimate interests, our interests must be balanced against your rights. An enquiry or purchase is not, by itself, consent to marketing.

4. Who may receive the information?

Employees with a relevant work-related need and providers contributing to the service may process necessary information. The relevant recipient categories are:

• Telecommunications providers, including eSIM platforms and mobile network operators: necessary eSIM, connectivity and usage information for activation, mobile connectivity and recording use. Mobile networks may process information in the countries where connectivity is provided and through international network infrastructure.
• Hosting, cloud and backup providers: information stored and processed to operate and back up the platform. MondoMate's own application servers are hosted in the EU; this is not a guarantee that every provider processes data only in the EU.
• Payment and accounting providers: payment, order and billing information for payments, refunds and statutory accounting.
• Email and support providers: contact details, messages and necessary order or case information for delivering emails and handling enquiries.
• AI providers: chat messages, any images and relevant conversation and support context when you use AI chat.
• Security and error-monitoring services: technical connection information and relevant events to protect the service, prevent automated abuse and identify faults.
• Analytics and advertising services: visit and usage information where these functions are used on the basis of your consent. Their specific use is described in the cookie information.

A provider may process data on our behalf or as an independent controller for its own purposes, such as a payment provider's or mobile operator's statutory duties. Its role depends on the particular processing.

We may also disclose necessary information to authorities, auditors and legal advisers to comply with legal obligations or establish, exercise or defend legal claims. You can contact legal@mondomate.com for further information about recipients of your personal data.

5. Processing outside the EU/EEA

MondoMate provides an international service. Although our application servers are hosted in the EU, international mobile connectivity and other provider services may involve processing outside the EU/EEA. Processing locations depend, among other things, on the country you travel to, the network connection used and the relevant provider's operations.

Transfers subject to the GDPR's third-country transfer rules require a valid transfer basis. This may be a European Commission adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses with necessary supplementary measures. Exceptions may be used only where their specific conditions are met. Accepting our purchase terms or cookies is not general consent to international data transfers.

Contact legal@mondomate.com for information about the relevant countries and transfer basis for your processing, and how to obtain a copy of any safeguards.

6. When someone else buys or manages your eSIM

The purchaser and eSIM user may be different people. The purchaser receives the order and payment information relating to the purchase. A shared purchase does not itself grant access to other users' private chats, detailed usage or location.

Depending on their role, a Business administrator can manage the company's purchases, recipients and allocations and view relevant status and expiry information. The company is responsible for explaining its own employee administration.

In partner arrangements, a partner may have its own controller responsibilities. Its privacy information applies to its own processing; this policy applies to ours. Where we process information solely on a company's documented instructions, we act as a processor under the relevant agreement. A partner logo does not, by itself, change these roles.

7. AI chat and automated processing

If you use AI chat, your messages, any images and relevant conversation history are processed to answer your enquiry. Verified customer support may include relevant information about your own eSIM. The basis is performing your contract or our legitimate interest in answering enquiries, as described in section 3.

Do not send passwords, payment card numbers or sensitive personal data in the chat. AI answers may contain errors. You can use ordinary support instead and request human handling. MondoMate's shared answer material is maintained from approved, general product information. We do not use your private customer conversations as shared answer material for other customers.

We also use automated rules to record payment and package status, calculate remaining data, control access and identify errors or abuse. These rules include comparing the recorded network country with package coverage and may temporarily interrupt connectivity after a warning if the country is not covered. You can contact us to have a record or decision examined and present your views. If a decision is solely automated and produces legal or similarly significant effects on you, the specific protections in Article 22 GDPR apply, including the relevant rights to human intervention and to contest the decision.

8. How long do we keep the information?

Retention depends on the purpose of the information, whether your service or case is still active, and whether the information is needed for a legal obligation or a specific legal claim. Information must be deleted or anonymised when it is no longer necessary.

For account and eSIM information, the assessment takes account of active packages, unused paid entitlements and the need for reinstallation or reuse. For abandoned purchases, it takes account of whether payment, refunds and delivery have been finally resolved. For chat, support, enquiries, recipient allocations and email information, it takes account of whether the enquiry or delivery has concluded and whether information is still needed for follow-up or evidence. Technical logs, detailed usage and security events are assessed against their specific operational, troubleshooting and security purposes; not all information is needed for the same length of time.

Accounting records are generally retained for five years from the end of the financial year. Required records for transactions covered by VAT One Stop Shop are retained for ten years from the end of the transaction year. Relevant evidence may also be needed while a specific legal claim can be brought or a dispute is being handled.

Marketing stops when you unsubscribe or there is no longer a valid basis. Necessary evidence of consent and withdrawal may be retained separately to document what happened and respect your unsubscribe request.

Removing an eSIM from your device or closing a Business account is not the same as erasing all personal data. An erasure request is handled separately and includes an assessment of active systems, relevant provider copies and backups, together with information we are required to retain. Paid entitlements do not automatically lapse because an account is inactive. Contact legal@mondomate.com about retention of your specific information or to request erasure.

9. Cookies and marketing

We use cookies and similar technologies for purposes including sessions, preferences and security. Analytics and advertising requiring consent are separate choices. See the website's cookie policy and change your choices in its cookie settings.

Newsletter subscriptions are separate from both cookie choices and acceptance of purchase terms. You can unsubscribe from marketing through the link in the email or by contacting us. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Receipts, security notifications and necessary service messages are not marketing.

10. Your rights and complaints

Subject to the applicable conditions, you can access your information, have errors corrected and request erasure or restriction. You can object to processing based on legitimate interests on grounds relating to your particular situation, and you can always object to direct marketing.

You can withdraw consent. Where the conditions apply, you can also receive information you have provided to us in a structured, commonly used, machine-readable format and have it transferred to another provider.

Contact legal@mondomate.com. We generally respond within one month. If an extension is necessary, we will notify you and explain why within the first month. We may request necessary information to verify your identity and protect other people's data. An erasure request is assessed separately from statutory retention duties and any remaining service entitlements.

You can complain to the Danish Data Protection Agency (https://www.datatilsynet.dk/) or another competent data protection authority, such as the authority where you normally live or work.

11. Changes to this policy

We may update this policy if the service or processing changes. The published edition shows its last-updated date. For material changes, we will inform you in a way appropriate to the change. Where new processing requires consent, updating the policy does not replace your consent.