Privacy

Last updated: 3 November 2026

Who we are

ThingSIM is a trading name of Netavo Global Data Services Ltd (“we”, “us”), company number 11798207, registered office Beckside Court, Annie Reed Road, Beverley, HU17 0LF. We are the data controller for the information described here, which we collect through thingsim.com, the shop and portal at my.thingsim.com, and the SIMs we supply. Netavo Global Data Services Ltd is registered with the Information Commissioner's Office as a data controller.

What we collect

Your account: your name, email address, organisation, telephone number if you give it, and your password (stored only as a secure hash) or your Google sign-in.
Orders and delivery: what you ordered, the delivery name and address, and despatch and tracking details.
Payment: card payments are taken by Stripe. We do not see or store your full card number; Stripe gives us a reference to the saved card, its brand and last four digits, and the outcome of each payment.
SIM and usage data: each SIM's identifiers (ICCID, IMSI and number), its plan, status and activation date, the data it uses and when, and its IP address. We see which network and country a SIM connects through, not its precise location. This is about the device, but it is linked to your account. We do not see the content of the data a SIM carries.
Enquiries: what you send through the contact form, which is stored in our customer relationship system.
The website: our server records each request, including your IP address, the page and your browser.

Cookies

thingsim.com sets two kinds of cookie that are not strictly necessary, both for statistics about how the site is used:

Google Analytics (_ga and _ga_…, up to 2 years): counts visits and the pages viewed, how visitors arrived and their approximate location from the IP address. It does not tell us who you are.
Attribution (ts_attr, 30 days): when you first arrive, the campaign, search engine or AI assistant that sent you (source, medium and campaign only), carried to the shop so an order can be credited to it.

The shop at my.thingsim.com also sets necessary cookies for your sign-in session, the basket and protection against forged form submissions, and uses Cloudflare Turnstile to tell people from bots on sign-up and sign-in. Stripe sets its own cookies on the payment page to prevent fraud. The site loads its typeface from Google Fonts, so your browser makes a request to Google.

Turning analytics off. Turn off analytics cookies here, or with the link at the foot of every page. It sets a cookie, ts_optout, that stops Google Analytics loading and stops the attribution cookie being written, and removes the ones already set. The same link turns them back on. You can also block or delete cookies in your browser; neither affects ordering.

How we use it, and our lawful basis

To supply SIMs, run your account, bill you and support you. Lawful basis: performance of our contract with you.
To keep records for tax and accounting. Lawful basis: legal obligation.
To prevent fraud and abuse and keep the service secure, including the network's own monitoring of SIM traffic. Lawful basis: legitimate interests.
To send service emails (despatch, activation, the notice before automatic activation, allowance alerts, payment problems). Lawful basis: performance of our contract.
To understand how the site is used and which sources bring customers, through the analytics and attribution cookies above. Lawful basis: legitimate interests. These cookies are used only for statistics, and you can turn them off at any time.
To send occasional updates about our services, only if you have asked for them. Lawful basis: consent, which you can withdraw at any time.

We do not sell your information and do not make automated decisions about you that have legal or similarly significant effects.

Only service providers that process it on our behalf, and only what each needs:

Stripe, for card payments.
SendGrid, which sends our emails.
Microsoft Azure, which hosts the website, shop, portal and our systems.
Google, for Analytics, Google Fonts and Google sign-in.
Cloudflare, for Turnstile bot checks on the shop.
Our mobile network partners, who carry the SIMs' data.
Royal Mail or another courier, for delivery.

We may also disclose information where the law requires it, for example to law enforcement under the Investigatory Powers Act.

Where it is held

Our systems are hosted in the United Kingdom and the European Union. Stripe, Google, Cloudflare and SendGrid may process information in the United States or other countries; where personal information leaves the UK we rely on appropriate safeguards, such as an adequacy decision or the UK International Data Transfer Agreement.

How long we keep it

Account and order records: while you are a customer, then 6 years for tax and accounting.
SIM usage records: 12 months.
Enquiries from people who do not become customers: 12 months after our last contact.
Google Analytics data: 14 months.
Web server records: a short period, for security and troubleshooting.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to withdraw any consent you have given. Email privacy@netavo.com; we will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

Changes to this notice

We will update this notice when the way we handle personal information changes, and will revise the date at the top when we do.