OkieSIM Privacy Policy

1. Introduction

1.1 Flow Travel Technology Limited (Business Registration Number 67239515) ("Flow", "we", "us", "our") operates OkieSIM, a digital eSIM marketplace accessible at www.okiesim.com and any associated mobile applications (together, the "OkieSIM Platform"). We are committed to protecting your personal data in compliance with applicable law, including Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO") and, where applicable to our processing, the EU General Data Protection Regulation and the UK GDPR. This Privacy Policy explains what personal data we collect through the OkieSIM Platform, how we use, share, and protect it, and the choices and rights available to you.

1.2 Flow is the data user (in some jurisdictions, the data controller) responsible for the personal data described in this Privacy Policy. Our Privacy Officer can be contacted at support@flowtheroom.com.

1.3 Where a Network Partner collects identity or device information directly from you for its own regulatory purposes, for example mandatory SIM or eSIM registration in a destination, that Network Partner acts as an independent data user in respect of that information and its own privacy notice applies.

1.4 By using the OkieSIM Platform, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy should be read together with our Terms and Conditions.

2. Information We Collect

2.1 We collect the following categories of personal data:

(a) Contact and order information: your email address and, where you provide it, your name and phone number, collected when you place an Order, create an account, or contact customer support.

(b) Payment information: payment is processed by our third-party payment gateway providers; we receive confirmation of payment and limited transaction details (such as the last four digits of a card, or the payment method used), but we do not store full card numbers.

(c) Device and technical information: when you access the OkieSIM Platform or install an eSIM, we or our Network Partners may automatically receive information about your device, including device model, operating system, EID (eSIM identifier), IMEI, and mobile network information, which is necessary to provision and deliver your Data Plan. We do not collect the content of your communications, your browsing activity while connected to a Data Plan, or your location beyond the country-level network information required to provision and support the service.

(d) Usage and log data: information about how you use the OkieSIM Platform, including IP address, browser type, pages visited, and cookies (see section 10 below).

(e) Communications: records of correspondence between you and our customer support team.

(f) Marketing preferences: your consent or opt-out status for direct marketing, and a record of when, how, and in respect of which classes of marketing subject it was given or withdrawn.

(g) Identity information for local registration: where the law of a destination requires SIM or eSIM registration, the identity information that destination requires. We will tell you at the point of purchase if a destination has this requirement.

2.2 You may decline to provide certain information, but this may prevent you from placing an Order or receiving support.

3. How We Use Your Personal Data

3.1 We use personal data to: process and fulfil your Orders, including provisioning and delivering your eSIM; send order confirmations, delivery details, and service updates; provide customer support and respond to inquiries; process payments and prevent fraud; send direct marketing communications where you have consented, or where we are otherwise permitted by law to do so (see section 11); operate and manage any OkieSIM account you create, including linking it with a Flow membership account where applicable (see section 5); improve and develop the OkieSIM Platform through analytics and feedback; and comply with our legal and regulatory obligations, including those of the destinations in which Data Plans are used.

3.2 We will not use your personal data for a new purpose that is not described in this Privacy Policy, and is not directly related to the purpose for which it was collected, without first obtaining your prescribed consent.

4. Legal Bases for Processing (EEA and UK)

4.1 Where the EU General Data Protection Regulation or the UK GDPR applies to our processing, we rely on the following legal bases: (a) performance of a contract with you, to process and fulfil your Order, provision your eSIM, and provide support; (b) compliance with a legal obligation, for tax, accounting, fraud prevention, and telecommunications registration requirements; (c) your consent, for direct marketing and for non-essential cookies; and (d) our legitimate interests in securing the Platform, preventing fraud and abuse, and improving our services, where those interests are not overridden by your rights and freedoms.

4.2 Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. How We Share Your Personal Data

5.1 We do not sell your personal data in exchange for money. Certain advertising and analytics technologies may nonetheless amount to a sale or sharing of personal information under the laws of some jurisdictions, including California; where that is the case you can control it through our cookie settings. Subject to that, we may disclose personal data to:

(a) Network Partners: the eSIM/data aggregators and/or mobile network operators who provision and deliver your Data Plan, to the extent necessary to activate and support your service. Some destinations may legally require Network Partners to collect and retain additional identity information for SIM/eSIM registration purposes, in which case that requirement, and the information involved, will be disclosed to you at the point of purchase. The Network Partner acts as an independent data user in respect of information it is legally required to collect and retain for registration purposes.

(b) Payment gateway providers, to process your payment.

(c) Other Flow business lines: OkieSIM and Flow's hotel booking platform at app.flowtheroom.com are operated by the same legal entity, Flow Travel Technology Limited. If you create an OkieSIM account, or sign in using your existing Flow account credentials, we will link your email address with your Flow membership account for cross-platform membership purposes, such as Flow Rewards. Because this is a use of your personal data beyond fulfilling your OkieSIM Order, we will obtain your express consent to it at the point you create or link the account, and you may withdraw that consent at any time. If you check out as a guest without creating or linking an account, your personal data is not used for Flow Rewards and is not made available to app.flowtheroom.com for membership or marketing purposes.

(d) Service providers who support our operations, such as cloud hosting, email delivery, customer support tools, and analytics providers, who act on our behalf under written contract, are permitted to process your personal data only on our instructions, and are not permitted to use it for their own purposes.

(e) Legal and regulatory authorities, where required by law, to investigate suspected fraud or illegal activity, or to protect our rights or the safety of others.

(f) A successor entity, in the event of a merger, acquisition, or sale of assets, subject to prior notice where required by law.

(g) Marketing and advertising partners, but only where you have given separate, express, and voluntary written consent to us providing your personal data to them for their own use in direct marketing, and only in respect of the kinds of personal data and classes of marketing subject notified to you when that consent was sought. You may withdraw that consent at any time, free of charge, by contacting support@flowtheroom.com. We do not receive money or other property in return for providing your personal data to any third party for its use in direct marketing.

6. International Data Transfers

Because OkieSIM Data Plans are provisioned across destinations worldwide, your personal data may be transferred to, and processed in, countries outside Hong Kong, including the locations of our Network Partners, service providers, and cloud infrastructure. Where we transfer personal data internationally, we take reasonable steps to ensure it continues to be protected in accordance with this Privacy Policy and applicable law. Where personal data is transferred out of the EEA or the United Kingdom, we rely on an adequacy decision or on the applicable standard contractual clauses, supplemented where necessary by additional safeguards. You may request details of the safeguards we use by contacting support@flowtheroom.com.

7. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your personal data against loss, misuse, and unauthorized access, including secure cloud infrastructure operated by professional third-party providers. Access to personal data is limited to personnel and service providers who need it to perform their functions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Breach Notification

8.1 We maintain an internal incident response procedure for personal data breaches. If a breach leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to your personal data, and that breach is likely to result in a real risk of significant harm to you, we will notify you and the relevant regulator without undue delay and, where a deadline applies under applicable law, within that deadline.

8.2 Our notification will describe, so far as we are able, the nature of the breach, the categories of personal data affected, the likely consequences, the measures we have taken or propose to take, and a contact point for further information.

9. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, including to provide support for past Orders, comply with legal, tax, and regulatory obligations, resolve disputes, and enforce our agreements, after which it is securely deleted or anonymized. Unless a longer period is required by law or is necessary to resolve a dispute, we apply the following indicative retention periods: order and transaction records, seven years from the date of the Order, to meet Hong Kong tax and accounting requirements; account records, for as long as your account remains active and for twenty-four months after it becomes inactive; customer support correspondence, twenty-four months from the close of the enquiry; direct marketing consent and opt-out records, for as long as we operate the Platform, so that we can continue to honour your preferences; and website analytics and log data, twenty-six months.

10. Cookies and Similar Technologies

The OkieSIM Platform uses cookies and similar technologies to operate the website, remember your preferences, and understand how the Platform is used. We use four categories of cookie: strictly necessary cookies, which are required to operate the Platform and process your Order and which cannot be disabled; functional cookies, which remember your preferences; analytics cookies, which help us understand how the Platform is used; and, where deployed, advertising cookies, which help us deliver and measure marketing. Where local law requires it, non-essential cookies are set only after you consent through our cookie banner; elsewhere they are set by default. You may change or withdraw your consent at any time using the cookie settings link on the Platform. You can also control cookies through your browser settings; disabling cookies may affect the functionality of the OkieSIM Platform.

11. Direct Marketing

11.1 We intend to use your personal data in direct marketing, and we may not do so without your consent. Before we do, we will tell you, in an easily readable and understandable form and free of charge, the kinds of personal data to be used and the classes of marketing subjects involved, and we will provide a response channel through which you may tell us that you do not consent.

11.2 The kinds of personal data we use in direct marketing are: your name; your email address; your phone number, where you have provided it; your country of residence and destinations of interest; and your purchase and browsing history on the Platform.

11.3 The classes of marketing subjects are: eSIM Data Plans and new destinations; promotions, discounts, referral offers, and loyalty benefits; surveys and product research; and travel-related products and services offered by Flow, including hotel bookings and Flow Rewards available at app.flowtheroom.com.

11.4 We will not provide your personal data to any other person for that person's use in direct marketing unless you have given separate written consent to that provision, and we have first told you in writing the kinds of personal data to be provided, the classes of persons to whom it will be provided, and the classes of marketing subjects involved. We do not and will not provide your personal data to any person for direct marketing in return for money or other property.

11.5 You may require us to cease using your personal data in direct marketing, and to cease providing it to any other person for direct marketing, at any time and free of charge. To do so, use the unsubscribe link in any marketing message or contact support@flowtheroom.com. We will act on your request without delay and in any event within ten working days, and we will notify in writing any person to whom we have already provided your data for direct marketing.

11.6 Every commercial electronic message we send will accurately identify OkieSIM as the sender, include our electronic mail address at which we can be contacted, and include a functional unsubscribe facility that remains valid for at least thirty days from the date the message is sent, in line with the Unsolicited Electronic Messages Ordinance (Cap. 593). We will not send marketing messages to any number listed on a Hong Kong do-not-call register.

11.7 Opting out of direct marketing does not affect transactional communications relating to your Orders, such as eSIM delivery, receipts, and service notices.

12. Your Rights

12.1 Subject to applicable law, you have the right to request access to, and correction of, the personal data we hold about you, to request its deletion, and to withdraw your consent to direct marketing. To exercise these rights, or for any questions about this Privacy Policy, contact support@flowtheroom.com. We may need to verify your identity before actioning a request.

12.2 Under the PDPO we will respond to a data access or correction request within forty days of receiving it. We may charge a fee for complying with a data access request; any such fee will not be excessive and will be notified to you before we proceed. If we cannot comply within forty days, we will tell you why and respond as soon as practicable thereafter.

12.3 Where the EU GDPR or the UK GDPR applies to our processing, you also have the right to erasure, to restriction of processing, to object to processing carried out on the basis of our legitimate interests, and to receive the personal data you provided to us in a structured, commonly used, and machine-readable format and to have it transmitted to another controller.

12.4 If you are not satisfied with how we have handled your personal data or your request, please contact our Privacy Officer at support@flowtheroom.com in the first instance. You also have the right to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or to the data protection supervisory authority in your country of residence.

13. Children's Privacy

The OkieSIM Platform is not directed at, and we do not knowingly collect personal data from, children under the age of 18. If you believe we have inadvertently collected personal data from a child, please contact us so that we can delete it.

14. Third-Party Links

The OkieSIM Platform may contain links to third-party websites, including payment providers. This Privacy Policy does not apply to those third-party sites, and we encourage you to review their privacy policies before providing any personal data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time by posting the revised version on the OkieSIM Platform with an updated "Effective date". Material changes will be communicated through a prominent notice on the OkieSIM Platform. Where a change would result in your personal data being used for a new purpose, or would materially change our direct marketing practices, we will seek your fresh consent before applying the change to you. Please review this Privacy Policy periodically.

16. Contact Us and Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, or to make a complaint about our handling of it, please contact our Privacy Officer at:

Flow Travel Technology Limited

Email: support@flowtheroom.com

You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, at enquiry@pcpd.org.hk.