Privacy Notice
How Quibity collects, uses, and protects personal data through the partner portal. Written for humans — a plainer summary of the legal positions our data-processing agreement spells out.
These pages are a working draft pending review by Quibity's legal team. They will change before launch.
1. Scope
This notice covers personal data processed through partners.quibity.com. It applies to the partner contacts who sign in (you), and to end-user data only where we process it on your behalf. End-user data collected directly by Quibity from travellers using eSIMs is covered by the consumer privacy notice at quibity.com/privacy.
2. Who we are
The data controller for the partner portal is Quibity Srl, operated by Magic Srl, both registered in the Republic of San Marino. Our data-protection contact is [email protected].
3. What we collect
Account data: name, work email, brand, country, language, and partnership type. Billing data: legal entity, address, tax ID, invoicing email, payment-method tokens (not card numbers). Activity data: sign-in events, feature usage, audit events, browser fingerprint for security. Support data: anything you share when you contact us.
4. Why we process it
To run the partnership (contract), to bill and pay you (contract / legal obligation), to keep the Portal secure (legitimate interest), to comply with tax and commercial law (legal obligation), and to improve the product (legitimate interest, minimisation-first). We don't sell your data. We don't share it with advertising networks.
5. Who sees it
Quibity and Magic staff with a legitimate need. Vetted sub-processors: Postmark (transactional email), our hosting provider (EU region), our observability vendor, and our accounting system. A current sub-processor list is available on request from [email protected].
6. International transfers
Primary processing is in the EU / San Marino. Where a sub-processor is outside that area, we rely on an adequacy decision or Standard Contractual Clauses plus supplementary measures (encryption in transit and at rest, access controls).
7. How long we keep it
Active account data: while the partnership is live plus two years. Invoicing data: up to 10 years where tax law requires. Audit logs: 2 years. Support tickets: 3 years. Email-suppression records: kept until manually cleared, so we do not re-attempt mail to a bounced address.
8. Your rights
You can ask for a copy of your data, correct it, export it, or ask us to delete what we are not legally required to keep. For partner-account data you can do most of this yourself in Settings. For anything else, email [email protected] and we will respond within 30 days. You can also complain to the San Marino data-protection authority.
9. Security
TLS in transit; encryption at rest for the primary database; quarterly access reviews; vulnerability scanning on every deploy; incident-response runbook with a 72-hour notification target. Our engineers are trained on least-privilege access; production secrets are rotated on every role change.
10. Cookies
The Portal uses only first-party functional cookies: a session cookie, a CSRF token, and an onboarding-progress token. We do not use third-party analytics cookies or advertising cookies on the Portal. If this ever changes we will add a consent banner and update this notice.
11. Changes to this notice
We will email material changes to the primary contact on file at least 30 days before they take effect. Non-material edits (typos, clarifications) take effect immediately; the effective date at the top of this page reflects the last revision.
12. Contact
Privacy questions or requests: [email protected]. Postal address: Magic Srl, Via del Voltone, 47891 Dogana, Republic of San Marino.