Privacy Policy

Effective: May 2026 · Last reviewed: May 2026

1. Data Controller

The data controller responsible for your personal data is:

BlueGo Solutions OÜ
Registry code: 17482859
Tartu mnt 67/1-13b, Tallinn 10115, Estonia
Contact: admin@bluego.io

2. What Data We Collect

We collect the following categories of personal data:

  • Identity data: first name, last name
  • Contact data: email address, phone number (optional)
  • Billing data: billing address, company name, VAT number (when provided)
  • Transaction data: order history, payment references (card details are processed by Stripe and never stored on our servers)
  • Account data: email, hashed password, session tokens
  • Technical data: IP address, browser type, device type, pages visited, referring URL
  • Communication data: support tickets, contact form submissions, chatbot interactions
  • Flight data: flight numbers, dates, airports (when using flight protection service)

3. How We Use Your Data

We process your data for the following purposes:

  • Order fulfilment: Processing purchases, delivering eSIM activation codes, generating invoices
  • Account management: Creating and managing your account, authenticating access
  • Customer support: Responding to enquiries, managing support tickets
  • Flight protection: Submitting compensation claims on your behalf through AirHelp
  • Legal compliance: Tax reporting, fraud prevention, responding to legal requests
  • Service improvement: Analysing usage patterns to improve our platform (anonymised)

We process your data under the following legal bases (Art. 6 GDPR):

  • Contract performance (Art. 6(1)(b)): Processing necessary to fulfil our contract with you — delivering eSIM plans, managing your account, processing payments
  • Legal obligation (Art. 6(1)(c)): Tax record-keeping, responding to lawful data requests from authorities
  • Legitimate interests (Art. 6(1)(f)): Fraud prevention, security monitoring, service improvement. Our legitimate interest is balanced against your rights and does not override your fundamental freedoms
  • Consent (Art. 6(1)(a)): Non-essential cookies, marketing communications (where applicable). You may withdraw consent at any time

5. Data Sharing

We share your data with the following categories of recipients only as necessary:

  • Payment processor: Stripe, Inc. (USA) — processes card payments under their own privacy policy. Transfer safeguarded by EU–US Data Privacy Framework
  • Third party eSIM providers: receive minimal data required to provision your eSIM (country, plan type)
  • Flight protection partner: AirHelp — receives flight details and contact information to process compensation claims
  • Hosting provider: Hostinger International Ltd. (Lithuania, EU) — hosts our platform on European servers
  • Email service: Our SMTP provider delivers transactional emails (invoices, support notifications)

We do not sell your personal data to third parties. We do not share your data with advertisers or marketing networks.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

  • EU–US Data Privacy Framework (for certified US recipients)
  • Standard Contractual Clauses approved by the European Commission
  • Adequacy decisions where applicable

7. Data Retention

We retain your data for the following periods:

  • Account data: Until you request account deletion
  • Transaction/invoice data: 7 years (Estonian Accounting Act requirement)
  • Support tickets: 2 years after resolution
  • Technical logs: 90 days (security and debugging)
  • Marketing consent records: Until consent is withdrawn + 1 year

After the retention period expires, data is securely deleted or anonymised.

8. Cookies

Our Platform uses the following categories of cookies:

  • Strictly necessary: Session cookies, authentication tokens, CSRF protection. These are essential for the Platform to function and cannot be disabled
  • Functional: Language preference, currency selection. These enhance your experience but are not essential
  • Analytics (third-party): We use Google Analytics and Google Tag Manager to measure website traffic and understand how visitors use our Platform. These tools collect anonymised data such as pages visited, session duration, and general geographic location. Analytics cookies are set only with your consent (Art. 6(1)(a) GDPR) and are not strictly necessary for the Platform to function

Cookie consent is managed through our cookie banner in accordance with the ePrivacy Directive (2002/58/EC). You can change your cookie preferences at any time through the cookie settings link in the website footer.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15): Request a copy of the personal data we hold about you
  • Right to rectification (Art. 16): Correct inaccurate data via your account settings or by contacting us
  • Right to erasure (Art. 17): Request deletion of your personal data, subject to legal retention obligations
  • Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances
  • Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
  • Right to object (Art. 21): Object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing

To exercise any of these rights, please use our email (admin@bluego.io). We will respond within 30 days as required by law. You can also manage most data through your account settings at /account/profile.

10. Security

We implement appropriate technical and organisational measures to protect your data, including: encrypted password storage (bcrypt), secure HTTPS connections, session management with automatic expiry, rate limiting on authentication endpoints, and access controls for administrative systems.

11. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.

12. Supervisory Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
https://www.aki.ee

You may also lodge a complaint with the data protection authority in your country of residence.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on the Platform. The "Effective" date at the top of this page indicates when the policy was last updated.

14. Contact

For any questions regarding this Privacy Policy or your personal data:

BlueGo Solutions OÜ
Tartu mnt 67/1-13b, Tallinn 10115, Estonia
Registry: 17482859
admin@bluego.io

Privacy Policy — BlueGo