Privacy Policy

Background

Tonave Services Limited understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all our clients, customers, and partners, and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

Definitions

Platform means all channels through which the Services are made available, including the Telegram bot @tonmobile available at https://t.me/tonmobile (also available as @mobile at https://t.me/mobile), the web application at https://web.tonmobile.com/, and the TonMobile eSIM mobile applications for iOS and Android.

1. Information About Us

1.1 Tonave Services Limited, trading under the brand name TonMobile, is a limited company, registration number HE 435321, with a registered office address at 18 Souliou, 2018, Strovolos, Nicosia, Cyprus.

1.2 We ARE NOT a mobile provider or mobile network operator. Data services are provided by their respective network providers in their country. Although we are not the network provider, we will provide support to end-users who purchase services we resell.

1.3 WE DO NOT ASSUME ANY RESPONSIBILITY AND MAY NOT BE HELD RESPONSIBLE OR LIABLE FOR CONNECTIVITY AS SUCH, ITS QUALITY, QUANTITY, DIVERSITY, COVERAGE, SECURITY, OR ANY OTHER FEATURE OR OPTION A CONSUMER MAY EXPECT FROM A MOBILE OPERATOR OR PROVIDER.

1.4 We provide our services via the Platform. All channels are equally available. If you disagree with our Privacy Policy, Terms and Conditions, or any other policy, please do not use our services.

1.5 Contact details:

• Email: info@tonmobile.com

2. What Does This Notice Cover?

This Privacy Policy explains how we collect, process, and use your personal data through our Platform and in the course of providing our services.

It also covers how we use personal data for analytics and marketing, advertising purposes, including behavioral data used for marketing through third-party advertising and analytics platforms.

Finally, it explains your rights under the law relating to your personal data.

3. What Is Personal Data?

Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the "GDPR") as 'any information relating to an identified or identifiable person who can be directly or indirectly identified in particular by reference to an identifier'. In Cyprus, the GDPR is supplemented by the Law Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018). Together, these instruments (and any other applicable data protection laws) are referred to in this Policy as the "Data Protection Legislation".

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

4. What Personal Data Do You Collect and How?

We may collect and hold some or all of the following personal data:

• Email address: collected directly from you.
• Business information: business name, business address, contact details, collected directly from you via email.
• Payment information: payment transactions are processed securely by third-party payment processors. We do not directly collect or store card details, account numbers, or bank information. We may receive transaction confirmation data such as payment status and amount.
• Public profile information: Telegram username, display name, and profile picture(s), automatically received via the Telegram Bot API when you interact with our bot. This information is limited to data you have chosen to make publicly available in your Telegram account settings. We do not have access to the data that is chosen as private in your Telegram account. Please note that Telegram processes your data independently in accordance with its own Privacy Policy available at https://telegram.org/privacy.
• Cookies and similar technologies: IP addresses and general geolocation, browser type and version, device type and operating system, referring URL and website navigation patterns, session timestamps and activity logs. This data may be collected by first-party cookies (set by us) or third-party cookies and services, e.g., Google Analytics, Meta Pixel, Reddit Pixel, and Trustpilot widgets or tracking tools (as further described in Parts 11 and 12).

5. How Do You Use My Personal Data?

We may use your personal data for the following purposes:

• Administering our business;
• Supplying our services and support to you;
• Managing payments for our services;
• Personalising and tailoring our services for you;
• Communicating with you and supplying you with information on our services;
• Delivering relevant advertising and measuring its effectiveness, including via third-party platforms such as Google Ads.

With your permission and/or where permitted by law, we may also use your personal data for marketing purposes, which may include contacting you by email with information, news, and offers on our services. You will not be sent any unlawful marketing or spam. You may opt-out of marketing emails at any time by clicking the unsubscribe link included in every marketing email.

We will only use your personal data for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with that or those original purpose(s) and need to use your personal data for that purpose.

In some circumstances, where permitted or required by law, we may process your personal data without your consent. This will only be done within the bounds of the Data Protection Legislation and your legal rights.

We also use third-party analytics and advertising technologies (see Section 11) to help us understand how users interact with our Platform, optimize and improve our services and advertising, marketing efforts, and deliver targeted advertisements. This includes the use of tracking technologies such as cookies and pixels. Where required by the Data Protection Laws, we obtain your consent before enabling these technologies.

With your permission and/or where permitted by law, we may also use tools from Trustpilot (see Section 11) to invite feedback, display reviews, and understand how users interact with embedded review components.

6. How Long Will You Keep My Personal Data?

We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including to comply with legal, accounting, or reporting obligations. The following retention periods apply to the categories of personal data we collect:

• Account data (email address, Telegram username and profile information): 7 years from the date of last account activity.
• Payment data (transaction confirmation data, payment status and amount): 7 years, in accordance with applicable accounting and tax obligations.
• Customer support data (correspondence and communications): 7 years, in accordance with applicable limitation periods for legal claims.
• Cookies and analytics data: 13 months from the date of collection, in accordance with industry standards.
• Marketing data: until you withdraw your consent or unsubscribe, plus 3 years thereafter.

Once your data is no longer required, we will securely delete or anonymize it.

7. How and Where Do You Store or Transfer My Personal Data?

We store your personal data electronically within the European Union (EU). Specifically, your account and transactional data is stored on servers located in Germany, and analytics data is stored on servers located in the Netherlands. Both locations are within the EU and subject to the protections of GDPR.

In certain circumstances, personal data collected through third-party analytics or advertising tools (e.g., Meta Pixel, Google Analytics, Reddit Pixel) may be transferred to, processed or stored outside the EU by those third-party providers. Where such transfers occur, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognised mechanisms, and where required additional measures to ensure an adequate level of protection for your personal data.

We take all practicable steps to ensure that your personal data is protected against unauthorised or accidental access, processing, erasure, loss, or use, including by requiring third-party service providers to implement appropriate technical and organisational security measures.

8. Do You Share My Personal Data?

We do not sell your personal data. However, we may share certain personal data, such as data collected via cookies and online identifiers and usage data, with third-party analytics, advertising service providers and review platforms (e.g., Meta, Google, Reddit, Trustpilot) as outlined in Section 11.

When you make a payment, your transaction is processed by a third-party payment processor. We share only the data necessary to complete your payment (such as transaction amount and currency) with that processor. The identity of our current payment processor(s) is available upon request via the contact details in Section 10.

If we share any of your personal data with third parties as described above, we will take all appropriate steps to ensure it is processed securely and in accordance with applicable data protection laws and your rights.

Where any personal data is transferred outside of the EU, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognised mechanisms, and where required additional measures to ensure an adequate level of protection for your personal data.

9. Your Rights

Under applicable Data Protection Legislation you may have certain rights in relation to your personal data, depending on your location. These may include the following:

9.1 Right of Access — you have the right to request a copy of the personal data we hold about you (commonly known as a subject access request). All such requests should be made in writing via the contact details in Section 10. There is normally no fee; however, if your request is manifestly unfounded or excessive, a reasonable administrative fee may be charged. We aim to respond within 20 calendar days and in any case no later than one month of receiving your request.

9.2 Right to Rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you without undue delay.

9.3 Right to Erasure ("Right to be Forgotten") — you have the right to request that we delete your personal data where there is no compelling reason for its continued processing, for example where the data is no longer necessary for the purpose for which it was collected.

9.4 Right to Restriction of Processing — you have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have contested.

9.5 Right to Data Portability — you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

9.6 Right to Object — you have the right to object at any time to the processing of your personal data for direct marketing purposes, or where processing is based on our legitimate interests.

9.7 Rights Related to Automated Decision-Making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

9.8 To exercise any of the rights listed above, please contact us using the details provided in Section 10. We will respond to all legitimate requests within one month. We may need to verify your identity before processing your request.

9.9 If you are located in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. In Cyprus, the competent authority is the Office of the Commissioner for Personal Data Protection at www.dataprotection.gov.cy.

10. How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

• Email: info@tonmobile.com

11. Use of Analytics and Advertising Technologies

We use the following third-party technologies on our Platform to analyse, improve our performance, and support our marketing and advertising efforts:

11.1 Google Analytics and Google Ads

We use Google Analytics to collect pseudonymised personal data about your interaction with our Platform and services (e.g., pages visited, time on page, referral source, device type).

We also use Google Ads, which may use this data to support remarketing, i.e. showing you ads across the web based on your interaction with our Platform.

These services may involve the transfer of personal data outside the EU. Where such transfers occur, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognised mechanisms, and where required additional measures to ensure an adequate level of protection for your personal data.

Google processes personal data in accordance with its own privacy policy.

• You can opt-out of Google Analytics tracking in your browser by installing the Google Analytics Opt-out Browser Add-on at: https://tools.google.com/dlpage/gaoptout.
• Google's Privacy Policy is available at: https://policies.google.com/privacy

11.2 Meta (Facebook) Pixel

We use Meta Pixel to measure advertising performance, understand user behavior, and show relevant ads on Meta platforms. Meta Pixel tracks actions such as visits to our Platform, clicks, and conversions. Data may be linked to your Meta account if you're logged into its platform and may be used for personalized advertising.

Meta processes personal data in accordance with its own privacy policy.

• Manage your Meta ad preferences at: https://www.facebook.com/ads/preferences
• Meta's Privacy Policy is available at: https://www.facebook.com/about/privacy

11.3 Reddit Pixel

We use Reddit Pixel to track conversions and improve the effectiveness of our Reddit advertising campaigns. This may include collecting IP addresses, browser data, and information about your actions on our Platform.

Reddit processes personal data in accordance with its own privacy policy.

• Manage your Reddit ad preferences at: https://www.reddit.com/personalization/
• Reddit's Privacy Policy is available at: https://www.reddit.com/policies/privacy-policy

11.4 Trustpilot

We use Trustpilot to collect and display customer reviews. When you interact with a Trustpilot widget on our Platform or receive an invitation to leave a review, Trustpilot may use cookies or similar tracking technologies to understand your interaction with their service. This may include collection of personal data such as your IP address, browser details, and other device identifiers.

Trustpilot processes personal data in accordance with its own privacy policy.

• Manage your Trustpilot cookies: through your browser settings or Trustpilot Cookie Policy
• Trustpilot's Privacy Policy is available at: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms

11.5 Meta SDK

We use the Meta SDK (Facebook) to measure the effectiveness of our advertising and to promote the app through Meta Ads. For this purpose we collect and share with Meta Platforms, Inc. your device advertising identifier (IDFA on iOS / Advertising ID on Android), app activity (install, launch) and purchase information (amount and currency). On Apple devices the advertising identifier is shared only after you grant permission in the system App Tracking Transparency prompt. You can withdraw consent at any time in your device settings (iOS: Privacy & Security → Tracking; Android: reset or limit the advertising ID). Learn more: https://www.facebook.com/about/privacy.

12. Cookies

A cookie is a small text file placed on your computer or device by our Platform when you visit certain parts of our site and/or when you use certain features of our services.

Our Platform may place and access certain first-party Cookies on your device. These Cookies are placed directly by us and are used solely by us to enhance and personalize your experience and to provide and improve our Platform. We ensure that your privacy and personal data are protected and respected at all times.

By using our Platform, you may also receive certain third-party Cookies. These are Cookies placed by websites or parties other than us. Third-party Cookies are typically used for features like analytics, performance monitoring, or additional functionality. These Cookies are not essential to the functioning of our Platform and your experience will not be impaired if you refuse them. These Cookies are described in more detail in Part 11.

Before any non-essential Cookies are placed on your device, you will be shown a clear prompt (e.g., a pop-up) requesting your consent to place them. By giving your consent, you enable us to offer you the best possible experience and service. You may choose to allow only first-party Cookies or block third-party ones. You may also withdraw your consent at any time.

Certain features of our site and services rely on Cookies to function correctly. These are considered "strictly necessary" Cookies for functioning of the Platform. Your consent is not required for these, but you may disable them in your browser settings. However, if you disable them through your browser settings, some parts of our Platform may not function properly.

12.1 Managing and Deleting Cookies

In addition to the controls we provide, you can manage Cookies through your internet browser settings. Most browsers allow you to block all Cookies, only third-party Cookies, or specific Cookies. You may also delete Cookies already stored on your device.

Please note that deleting or blocking Cookies may remove saved preferences (such as login information) and affect the functionality and performance of our site or services.

We recommend keeping your browser and operating system up to date and referring to the official help and support resources from your browser or device manufacturer if you need assistance with privacy settings.

13. How Can I Access My Personal Data?

You have the right to request access to the personal data we hold about you and to obtain a copy of it.

You may submit a request using the contact details provided in Section 10. We may need to verify your identity before processing your request.

We will respond to your request within the timeframes required by applicable data protection laws. In general, we aim to respond within one month of receiving your request. In certain circumstances, for example where your request is complex or you have made multiple requests, we may require additional time, in which case we will inform you accordingly.

There is normally no charge for making a request. However, where permitted by applicable law, we may charge a reasonable administrative fee or refuse to act on a request that is manifestly unfounded or excessive.

14. Complaints About Our Services

If you wish to make a complaint about our services or customer support, please refer to our Complaints Policy available at https://tonmobile.com/en/complaints. All personal data submitted as part of a complaint will be processed in accordance with this Privacy Policy and treated with strict confidentiality.

15. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be made available on https://tonmobile.com/en/privacy.

Tonave Services Limited · HE 435321 · 18 Souliou, 2018, Strovolos, Nicosia, Cyprus

2026 © TonMobile. All rights reserved