Privacy Policy

Globalex · Business No. 035994508

This document sets out the privacy policy of Globalex with respect to the collection, processing, security and transfer of personal information in the course of providing cellular data services abroad (eSIM Data) and Israeli number services abroad (calls, SMS and OTP verification codes in the application / on the Web).

This Policy is drawn up in accordance with the Protection of Privacy Law, 5741-1981, the Protection of Privacy Regulations (Data Security), 5777-2017, and the Regulations on the Transfer of Information to Databases Abroad, 5761-2001.

1. General and Identification of the Database Owner

1.1. Scope of the Policy. This Privacy Policy sets out which personal data are collected by the Company, for which purposes they are used, to whom they are transferred, for how long they are retained, and which rights the Customer and the user have in relation to them.

1.2. Normative framework. The Policy has been drawn up in accordance with the provisions of the Protection of Privacy Law, 5741-1981, and the regulations made thereunder, including the Protection of Privacy Regulations (Data Security), 5777-2017, and the Regulations on the Transfer of Information Abroad, 5761-2001.

1.3. The owner of the database. The controller and manager of the database is Globalex, Business ID (Osek Murshe) 035994508, whose official address for correspondence is P.O. Box 319, Hosen, 2518000. Any approach, question or exercise of a right in matters of privacy and data security shall be directed to the privacy officer by email at: [email protected] or [email protected].

2. The Furnishing of Information and the User's Consent

2.1. Voluntary furnishing. Personal information is furnished to the Company of the Customer's free will. It is clarified that the Customer is under no legal obligation to furnish the information, but that without it the services, in whole or in part, cannot be provided.

2.2. Mandatory data. Data required as a condition of providing the service (such as subscriber details, identity documents for porting, or card details for clearing) are marked as such at the point of collection.

2.3. Consent to use. Use of the Company's website, of the dialler application or of the WebRTC interface, or the submission of a request to purchase an eSIM package or to port a number, constitutes express consent to the collection, processing, retention and transfer of the information as set out in this Policy.

3. The Categories of Information Collected in the Company's Services

3.1. Identifying and personal information: first name and surname, identity card or passport number (for a foreign national), residential or postal address, email address and telephone number for contact.

3.2. Identity and verification documents: where the law or the requirements of the infrastructure operator so require (in particular upon porting an Israeli telephone number or allocating a line), a photographed copy of the identity card or passport is collected, for the purpose of fraud-preventing identity verification.

3.3. Specific communications and service data: SIM/eSIM identifiers (ICCID numbers), end device identifiers (IMEI/UUID), details of data packages purchased, times of activation, data volumes used, Israeli telephone numbers allocated or ported, call log data, and SMS messages (including OTP verification codes from banks and institutions).

3.4. Technical and digital usage data: IP address, browser type and operating system, times of access, pages viewed, general location data (by cellular network / IP) and the source of arrival at the site.

3.5. Payment and accounting data: amounts charged, payment dates, the last 4 digits of the credit card and accounting documents. Full credit card details are not collected, do not pass through the Company's systems and are not stored in them — clearing is carried out directly on a secure page of the clearing company, compliant with the PCI-DSS standard.

3.6. Correspondence and support: customer service enquiries, email messages, chats and records of telephone conversations (including voice recordings made after prior notice).

4. The Purposes of Use of the Information

4.1. Provision and operation: the actual provision of the services, the activation of eSIM packages abroad, the porting of telephone numbers, the management of calls and SMS in the application, maintenance and technical support.

4.2. Identification and security: verification of the Customer's identity (including by means of a one-time code, OTP) and compliance with the regulatory requirements of the Ministry of Communications and of the infrastructure providers.

4.3. Collection and accounting: charging the means of payment, issuing tax invoices and receipts, and conducting collection proceedings in the event of a debt.

4.4. Fraud prevention: preventing communications fraud, identifying prohibited uses, and protecting the security of the Company's network and computer systems.

4.5. Operational notices: sending operational updates, notices that a package's volume has been exhausted, security alerts and changes to the terms of service.

4.6. Marketing and mailing: sending marketing offers and advertising material, subject to obtaining express consent under section 30A of the Communications Law.

5. Transfer of Information to Third Parties

5.1. Guiding principle. The Company does not sell or rent personal information to third parties. Information shall be transferred solely to the parties and for the purposes set out below:

5.2. Communications infrastructure providers in Israel and abroad: the transfer of necessary data to cellular network providers and international communications infrastructures (for example the international eSIM provider eSIM-Go, and licensed operators in Israel for the purposes of porting and connectivity), for the purpose of providing data and calls.

5.3. Clearing and finance: licensed clearing companies and financial institutions, for the purpose of effecting payments and refunds.

5.4. Computing and cloud providers: providers of cloud systems, storage, servers, accounting systems and operational email/SMS delivery.

5.5. Requirements of law and court orders: the furnishing of information to competent authorities, a court or the police, pursuant to a judicial order or a legal obligation.

6. Transfer of Information Outside the Borders of the State

6.1. International transfer. Since the eSIM and international communications services are based upon communications infrastructures and servers located around the world (such as the servers of the infrastructure provider eSIM-Go and global cloud servers), personal information and communications data may be transferred, processed and stored outside Israel.

6.2. Compliance with the regulations. Every transfer of information outside Israel is carried out in accordance with the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001, under agreements securing adequate protection of the information.

7. The Period of Retention of the Information and its Deletion

7.1. Retention period. Personal information shall be retained in the Company's databases for such time as is required to fulfil the purposes for which it was collected, or for the period required under any law.

7.2. Accounting obligation. Accounting documents, transaction data and charging records shall be retained for 7 years, in accordance with the requirements of the tax and bookkeeping laws of Israel.

7.3. Deletion and anonymisation. At the end of the retention period, or following the handling of a justified deletion request, the information shall be securely deleted or fully anonymised so that it can no longer be linked to the Customer.

8. Advertising Mail and Marketing Communications

8.1. Consent to mailing. Advertising material shall be sent by email or SMS solely subject to obtaining express prior consent, in accordance with section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982.

8.2. Right of withdrawal and removal. The Customer may withdraw their consent at any time and request removal from the mailing list by clicking the removal link in the body of the message or by contacting the email address: [email protected].

8.3. Operational notices. Operational notices (such as order confirmations, OTP verification codes, receipts, notices that a package is exhausted and security alerts) do not constitute advertising material and shall be sent to the Customer as a central part of the service.

9. Cookies and Tracking Technologies

9.1. Use of cookies. Cookies and tracking technologies are used on the Company's sites for proper operation, the retention of user preferences, information security and the statistical analysis of visitor traffic.

9.2. Categories of cookies and the consent interface. Essential cookies operate automatically. Analytics, statistics and marketing cookies operate subject to the user's approval in the cookie management interface (cookie banner) appearing on the site.

9.3. Control of settings. A user may change their preferences in the site's cookie interface or block cookies through the browser settings. Blocking essential cookies may impair the functioning of the site.

9.4. Tracking of service e-mails. Operational e-mails the Company sends, such as account and login details, billing reports, collection notices and links for updating a payment method, may include a small invisible image, and links that pass through the Company's servers on the way to their destination. This lets the Company know whether a message was opened and whether a link in it was clicked. The time of the open or click, the number of times, and the type of mail program or service that loaded the message are recorded. This information is used to confirm that important service information reached the Customer, and for billing and support. It is not used for advertising or profiling, and it is kept with the record of the message for the period set out in section 7. Open tracking can be prevented by blocking the automatic loading of images in the mail program; links keep working either way. Some mail providers load images automatically, so a message may be recorded as opened even if it was not read.

10. The Rights of the Data Subject (Inspection, Correction and Deletion)

10.1. Right of inspection. Under section 13 of the Protection of Privacy Law, every person is entitled to inspect the information concerning them held in the Company's database.

10.2. Right of correction and deletion. A person who has inspected information and found it to be incorrect, incomplete, unclear or out of date may approach the owner of the database with a request to correct the information or to delete it, under section 14 of the Law.

10.3. Manner of approach and timetable (30 days). A request for inspection or correction of information shall be directed in writing to the email address: [email protected]. The Company shall respond to the request within 30 days of its receipt, in accordance with the Protection of Privacy Regulations (Conditions for Inspection of Information and Procedures for Appeal against a Refusal of a Request for Inspection), 5741-1981.

10.4. Appeal to a court. Where a request for inspection or correction is refused, the applicant may lodge an appeal with the Magistrates' Court in the manner prescribed by law.

11. Data Security

11.1. Security measures. The Company operates advanced organisational and technological measures to secure the information in the database, including the encryption of communications protocols (SSL/TLS), strict access permission controls, system monitoring and event logging, in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017.

11.2. Absence of absolute immunity. While the Company makes considerable efforts to secure the information, no computer system is entirely immune. The Company does not undertake that the services will be absolutely immune from unauthorised intrusion.

11.3. Reporting of incidents. In the event of a serious data security incident, the Company shall act in accordance with the provisions of the law, including reporting to the Privacy Protection Authority and to the data subjects as necessary.

12. The Privacy of Minors

12.1. Minors excluded. The Company's services are intended for users aged 18 and over only. The Company does not knowingly collect personal information from minors. Should it come to the Company's knowledge that information concerning a minor has been collected, the information shall be deleted from its records immediately.

13. Changes to the Privacy Policy and Governing Law

13.1. Updates. The Company may update the Privacy Policy from time to time. The updated text shall be published on the Company's website, stating the date of its update. A material change to the Policy shall be brought to the notice of users by an announcement on the site or by email.

13.2. Law and jurisdiction. This Policy is subject to the laws of the State of Israel alone. Exclusive jurisdiction in any dispute shall lie with the competent courts of the Northern District.

13.3. Governing version. This document is published in Hebrew and in English. In any case of conflict or inconsistency between the texts, the Hebrew text alone is the governing and binding text.

Globalex · P.O. Box 319, Hosen 2518000 · Privacy email: [email protected]