Privacy

How Netavo Global Data Services Ltd, trading as ThingSIM, collects, uses and keeps personal information through thingsim.com and the portal, and the cookies it sets.

Last updated: 4 November 2026

Who we are

ThingSIM is a trading name of Netavo Global Data Services Ltd (“we”, “us”), company number 11798207, registered office Beckside Court, Annie Reed Road, Beverley, HU17 0LF, United Kingdom. We are the data controller for the information described here, which we collect through thingsim.com, the portal at my.thingsim.com, the order requests and enquiries you send us, and the SIMs we supply. We are established in the United Kingdom and subject to UK data protection law. Because we offer our services to customers in Ireland, the EU General Data Protection Regulation also applies to how we handle their information. We have not appointed a representative in the EU; for any data protection matter, contact us directly at privacy@netavo.com.

What we collect

  • Your account: your name, email address, organisation, telephone number if you give it, and your password (stored only as a secure hash) or your Google sign-in.
  • Orders and delivery: what you ordered, your company's VAT number, the delivery name and address (including the Eircode), and despatch and tracking details.
  • Payment: the payments you make and their outcome. Where you pay by card, the card payment is taken by Stripe: we do not see or store your full card number; Stripe gives us a reference to the saved card, its brand and last four digits, and the outcome of each payment.
  • SIM and usage data: each SIM's identifiers (ICCID, IMSI and number), its plan, status and activation date, the data it uses and when, and its IP address. We see which network and country a SIM connects through, not its precise location. This is about the device, but it is linked to your account. We do not see the content of the data a SIM carries.
  • Enquiries and order requests: what you send through the contact form, which is stored in our customer relationship system.
  • The website: our server records each request, including your IP address, the page and your browser.

Cookies

thingsim.com can set two kinds of cookie that are not strictly necessary, both for statistics about how the site is used. On the Irish site we set them only if you agree,: a prompt asks you on your first visit, and you can refuse them as easily as accept them:

  • Google Analytics (_ga and _ga_…, up to 2 years): counts visits and the pages viewed, how visitors arrived and their approximate location from the IP address. It does not tell us who you are.
  • Attribution (ts_attr, 30 days): when you first arrive, the campaign, search engine or AI assistant that sent you (source, medium and campaign only), kept so an enquiry or order can be credited to it.

The portal at my.thingsim.com also sets necessary cookies for your sign-in session and protection against forged form submissions, and uses Cloudflare Turnstile to tell people from bots on sign-in. Where you pay by card, Stripe sets its own cookies on the payment page to prevent fraud. The site loads its typeface from Google Fonts, so your browser makes a request to Google.

Changing your choice. Turn off analytics cookies here, or with the link at the foot of every page. It sets a cookie, ts_optout, that stops Google Analytics loading and stops the attribution cookie being written, and removes the ones already set. The same link turns them back on. You can also block or delete cookies in your browser; neither affects sending an order request.

How we use it, and our lawful basis

  • To supply SIMs, run your account, bill you and support you. Lawful basis: performance of our contract with you.
  • To keep records for tax and accounting. Lawful basis: legal obligation.
  • To prevent fraud and abuse and keep the service secure, including the network's own monitoring of SIM traffic. Lawful basis: legitimate interests.
  • To send service emails (despatch, activation, the notice before automatic activation, allowance alerts, payment problems). Lawful basis: performance of our contract.
  • To understand how the site is used and which sources bring customers, through the analytics and attribution cookies above. Lawful basis: consent, which you can withdraw at any time.
  • To send occasional updates about our services, only if you have asked for them. Lawful basis: consent, which you can withdraw at any time.

We do not sell your information and do not make automated decisions about you that have legal or similarly significant effects.

Who we share it with

Only service providers that process it on our behalf, and only what each needs:

  • Stripe, for card payments, where you pay by card.
  • SendGrid, which sends our emails.
  • Microsoft Azure, which hosts the website, shop, portal and our systems.
  • Google, for Analytics, Google Fonts and Google sign-in.
  • Cloudflare, for Turnstile bot checks on the portal.
  • Our mobile network partners, who carry the SIMs' data.
  • Royal Mail, An Post or another courier, for delivery.

We may also disclose information where the law requires it, for example to law enforcement.

Where it is held

Our systems are hosted in the United Kingdom and the European Union. Stripe, Google, Cloudflare and SendGrid may process information in the United States or other countries; where personal information is transferred outside the UK and the European Economic Area we rely on appropriate safeguards, such as an adequacy decision or standard contractual clauses.

How long we keep it

  • Account and order records: while you are a customer, then 6 years for tax and accounting.
  • SIM usage records: 12 months.
  • Enquiries from people who do not become customers: 12 months after our last contact.
  • Google Analytics data: 14 months.
  • Web server records: a short period, for security and troubleshooting.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to withdraw any consent you have given. Email privacy@netavo.com; we will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Data Protection Commission in Ireland at dataprotection.ie. We would appreciate the chance to put things right first.

Changes to this notice

We will update this notice when the way we handle personal information changes, and will revise the date at the top when we do.