Firsty Cookie Policy
Last Updated: 30 June 2025
This Cookie Policy explains how Bamboo Connected (BV) 's-Gravenhekje 1/ A, 1011 TG Amsterdam, trading as Firsty ('us', 'we', 'our') and our third-party partners as set out in the tables below, use cookies and similar technologies on our website and our app (hereinafter both referred to as 'website').
For more general information about how we process your personal data when visiting the website, using the app or when entering into a contract with us, please visit our Privacy Policy.
1. What are cookies?
A cookie is a small data or text file that a website stores on your computer or mobile device when you visit the site. Cookies help us to optimize your browsing experience on our website by remembering technical choices (for example a language choice), and by showing you specific content that may be of interest to you.
2. What types of cookies do we use?
We use cookies for a variety of purposes. Some cookies are necessary for the technical functioning of our website, while others are used for analytics and advertising. This helps us to improve our website and your experience.
You can choose to allow some types of cookies. Note that blocking some types of cookies may impact your experience of the site and the services we are able to offer.
We have categorized our cookies into the following groups to make it easier for you to understand what they are used for. We also have added information on the lifespan and the retention period. The lifespan is the technical time the cookie file stays on a visitor's browser. This is its "expiration date." The retention period is how long we keep the personal data collected by the cookie.
2.1 Necessary Cookies
The cookies in this category are essential to ensure that our website and our app works properly. They remember, your login details, language preference and products in your basket. Therefore, you cannot disable these cookies.
(a) First Party Cookies
| Cookie Name | Purpose | Legal basis | Path/domain | Lifespan | Retention period |
| cookie_consent | Stores your cookie consent preferences. | Legitimate interest | firsty.app | 6 months | 6 months |
| cookie_language | Remembers your preferred language for the website. | Legitimate interest | firsty.app | 6 months | Active session |
| session_id | Maintains your user session after login. | Legitimate interest | firsty.app | Active session | Active session |
(b) Third Party Cookies
| Cookie name | Purpose | Legal basis | Path/Domain | Lifespan | Retentio period |
| firebase_(Firebase) Google LLC | Handles user authentication manages user sessions. | Legitimate interest | firsty.app | 180 days | 180 days |
2.2 Analytics Cookies
These cookies collect information about how you use our website and/or our app, such as which pages you visited and which links you clicked on. These cookies and similar technologies help collect data that allows us to measure audience engagement and site statistics. This helps us to understand how services are used, and to enhance their content, quality and features, while also allowing us to develop and improve website and app.
You can choose to accept or reject these cookies via the 'Cookie Management' link in the footer of our website.
(a) Third Party Cookies
| Cookie name | Purpose | Legal basis | Path/Domain | Lifespan | Retention period |
| _ga (Google Analytics) Google LLC | Used to distinguish users and collect information about page visits. | Consent | firsty.app | 14 months | 14 months since collection |
| firebase_ (Firebase) Google LLC | Collects anonymous data to help understand users behaviour and improve the app and website experience | Consent | firsty.app | 8 weeks | 180 days since collection |
| appsflyer_ Appsflyer | Provides mobile attribution and marketing analytics to understand how users interact with our marketing campaigns. | Consent | firsy.app | Active session | 24 months |
2.3 Advertising and Measuring Cookies
These cookies track your online activity to help advertisers deliver more relevant advertising. These cookies can share that information with other organizations or advertisers.
You can choose to accept or reject these cookies below via the 'Cookies Management' link in the footer of our website.
(a) Third Party Cookies
| Cookie name | Purpose | Legal basis | Path/Domain | Lifespan | Retention period |
| _fbp (Meta Pixel) Meta | Tracks user behaviour on the website for advertising and retargeting. | Consent | firsty.app | 90 days | 90 days |
3. Automated decision making
Some of the services we use that place cookies on your device, particularly for advertising and analytics, engage in automated decision-making, including profiling.
When you consent to Advertising and Measuring Cookies, technologies like the Meta Pixel track your activity on our website, such as the pages you visit and the links you click. This information about your online behaviour can be used to build a profile of your interests. This process enables advertisers to show you content on other platforms (retargeting) that are more relevant to your perceived interests. The main consequence for you is that the advertising you see outside of our website may be tailored to your browsing habits.
4. Your Choices and How to Withdraw Consent
You have the right to decide whether to accept or reject non-necessary cookies. You can exercise your cookie preferences at any time by changing your preferences via the 'Cookies Management' link in the footer of our website.
Most web browsers also allow you to control cookies through their settings. You can find out how to manage cookies on popular browsers here:
Please note that if you choose to block cookies, your experience on our website may be impacted.
5. Your rights regarding the data processed via our Cookies
Insofar a cookie entails the processing of personal data, you have several rights under the GDPR. You can exercise these rights by contacting us via the details set out in point 5 of this Policy.
(a) Right of Access: You can request a copy of the personal data we hold about you.
(b) Right to Rectification: You can ask us to correct or complete any inaccurate or incomplete personal data.
(c) Right to Erasure (‘Right to be Forgotten’): You can request that we delete your personal data. Please note that this right is not absolute and only applies in certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected).
(d) Right to Restriction of Processing: You can request that we temporarily freeze the use of your personal data in certain situations.
(e) Right to Object: You can object to the processing of your data where we rely on our legitimate interests as a legal basis. You have an absolute right to object to your data being used for direct marketing.
(f) Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
(g) Right to Withdraw Consent: Where we process your data based on your consent, you have the right to withdraw that consent at any time.
(h) Right to Lodge a Complaint with a supervisory authority.
6. Changes to this Cookie Policy
We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal, or regulatory reasons. In such case we will inform you via your inbox in your profile in the app.
The date at the top of this Cookie Policy indicates when it was last updated.
7. Contact Us
If you have any questions about our use of cookies or other technologies, please email us at support@firsty.app or by post to:
Bamboo Connected (BV) 's-Gravenhekje 1/ A, 1011 TG Amsterdam
For more information on our partners' privacy practices, please visit their respective privacy policies:
Firsty privacy policy
Last Updated: 30 June 2025
Version 1.0
1. Introduction
This is the privacy policy of Bamboo Connected (BV), trading as Firsty (hereinafter “Firsty”, “we”, "our" or “us”). It outlines how we collect, use, store, and protect the personal data of individuals who use our website, mobile application, and e-SIM services (collectively, our “Services”).
We are committed to protecting your privacy and handling your data in an open and transparent manner. This policy is designed to help you understand what data we collect, why we collect it, and what your rights are in relation to your personal data.
2. General Information
2.1 Who is the data controller?
The entity responsible for the processing of your personal data (the “data controller”) is:
Bamboo Connected (BV), a legal entity incorporated under the laws of the Netherlands.
's-Gravenhekje 1/ A, 1011 TG Amsterdam
NL Company Number: 91046106
Contact Email: support@firsty.app
For any questions or to exercise your rights regarding your personal data, please contact us using the details provided in Section 9.
2.2 How do we receive your personal data?
We collect your personal data in the following ways:
(a) Directly from you: When you sign up for our Services, purchase an e-SIM, use our mobile app, contact customer support, or interact with our website.
(b) From third parties: We may receive data from our business partners (e.g., mobility partners,…) when you sign up for Firsty through a partner offer.
3. How We Use Your Personal Data
We collect and process your personal data for the purposes outlined below. The following table details the categories of your data that we process, the purpose and legal basis for the processing, as well as the applicable retention period.
| N° | Categories of Personal Data | Purpose(s) of Processing | Legal Basis for Processing | Retention Period |
| 1 | User Account & Service Provision data Telephone Number; Email Adresses; Password; security logs; Payment Events (e.g successful transaction confirmation, not full card details) | [object Object] User sign-up and authentication (login). Processing your orders and sending confirmations/invoices. Enabling the functionality of the e-SIM. Managing your account and customer relationship. | Performance of a contract (Art. 6.1.b GDPR) | We retain this data for a period of 7 years after the termination of our contract or, in the absence thereof, since the last interaction with you. |
| 2 | Numerical Service Usage Data Data usage (GBs consumed, network used) | To monitor your data usage to ensure the correct functioning of your data plan. For network management and service optimisation. | Performance of a contract (Art. 6.1.b GDPR) | We retain this data for one (1) year after the end of the contract. |
| 3 | Direct Marketing & Communication data Email Adresses; Telephone Number (for SMS); First Name; Last Name. | To send you communications about our products and services, including: Promotional offers and discounts. New product announcements. Push notifications or in-app messages about offers. | Consent (Art. 6.1.a GDPR). You will be asked to provide consent (opt-in) before we send you any marketing messages. You can withdraw your consent at any time by clicking 'unsubscribe' at the bottom of such direct marketing messages. | We will process this data until you withdraw your consent (e.g., by clicking the "unsubscribe" link in an email), but in no case longer than 5 years after our last interaction with you. |
| 4 | Customer Support Data Name, email, phone number; Content of communications (e.g., emails, chat logs via out chatbot) | To respond to your inquiries, provide support, help you get the best out of the Service, and resolve issues with your account or our services. | Performance of a contract (Art. 6.1.b GDPR) | We retain this data for a period of 2 years after the chat session ends. |
| 5 | Management of B2B Partnerships Identification Data (e.g., name/corporate identifier provided by partner); Consumption Data (amount of Service data used, in which country it was used) | Only if you are an indirect client through one of our partners: For our "Firsty for employees" service, to allow partner companies to monitor usage for centralized invoicing. Only if you are an indirect client through one of our partners: For commercial partnerships: to provide anonymized data and promo code usage back to the partner.,[object Object] | Performance of a contract (Art. 6.1.b GDPR) with you and your employer. | We retain this data in line with our agreement with the business partner in question, and for a maximum period of 5 years after your relationship with the partner ends. |
| 6 | Observed and generated data from using our Services Technical identifiers (such as device identifier); Network location data: Location data of an end-user’s device collected through their use of a mobile network; | To provide our core Services: Linking your e-SIM to your account. Enabling calling & data functionality. Managing your account & customer relationship. // (to offer our e-sim services, for functional monitoring of these Services to maintain the quality of our Services). | Performance of a contract (Art. 6.1.b GDPR) | We retain this data for a period required by applicable legislation after its collection (e.g., 7 years for tax records) or for up to 10 years for legal claims. |
| 7 | Dispute Management data Identification and contact data, all correspondence related to the dispute, financial data (e.g., claims for damages), court documents, witness statements, any other evidence. | For the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. | Legitimate Interest (Art. 6.1.f GDPR) to establish, exercise, or defend legal claims. | We retain this data for the duration of the dispute and up to 10 years after its conclusion. |
| 8 | Data subject to regulatory notification obligations Depending on the notification, the mandatory data subject to regulatory disclosure requirements | [object Object],To comply with our legal and regulatory obligations when there is a reporting obligation (f.i. GDPR, NIS2) | Legal obligation (Art. 6.1.c GDPR). | We retain this data for the statutory retention period linked to the specific notification obligation. |
4. Data Sharing & Third Parties
We will not sell, rent or otherwise disclose your personal data to any third party, except as described in this policy.
4.1 Service Providers (Data Processors)
We use third-party service providers listed below who process personal data on our behalf for the purposes set out above. These parties are required to process such information based on our instructions and in accordance with this policy.
Authentication: Google Firebase (USA)
Authentication and Customer Support: Meta (EU)
Payment Processing: Adyen (EU)
Customer Support & CRM: Intercom (EU)
Cloud Hosting & Infrastructure: Google Cloud Platform (EU), Amazon Web Services (EU) and other providers storing data in Belgium & NL.
Telecom Infrastructure: Mavenir
Collaboration & Productivity Tools: Google Workspace, Slack, Monday.com
4.2 Commercial Partners
We work with commercial partners. When you use our Services through one of these partners, we may share basic data with them as described in the table above. In these relationships, Firsty may act as a data controller or a data processor, depending on the specific agreement with the partner. This policy applies to situations where Firsty is the data controller; in cases where Firsty acts as a data processor, the partner is responsible for the lawful processing of your data, and Firsty will operate within the boundaries of the instructions given by that partner.
4.3 Legal Authorities
We may be required to disclose your personal data to law enforcement, judicial, or administrative authorities if, and only if, required by law.
5. Do we engage in automated decision-making?
In certain, limited circumstances, we use automated decision-making to protect the security and integrity of our Services. This means a decision is made automatically without human intervention. These processes are necessary for the performance of our contract with you.
Failed Payments: Our system automatically monitors payment transactions. If five (5) consecutive payment attempts from your account fail, your account will be temporarily suspended. A temporary suspension means you will not be able to use your e-SIM service until the outstanding payment is successfully processed.
Service Abuse: Our systems monitor data consumption to ensure it aligns with the terms of your purchased data plan. If the system detects that technical measures, such as firewalls, have been bypassed to consume data beyond your plan's limits ('Service abuse'), your account will be automatically blocked. This measure protects our network integrity and ensures fair service for all users.
In any case where an automated decision has been made about you, you have the right to obtain human intervention, express your point of view, and contest the decision. To do so, please contact our customer support team.
6. Do we transfer your personal data outside the European Economic Area (EEA)?
In connection with the abovementioned processing purposes, we try to avoid as much as possible the transfer of personal data that we collect from you to third party data processors located outside the European Economic Area.
When we transfer personal data that we collect from you to third party data processors located in countries that are outside of the European Economic Area and which do not offer an adequate level of protection, we ensure the use of appropriate data transfer tools such as the entering into of the standard contractual clauses issued by the European Commission.
Our user authentication is managed by Firebase Authentication, a service provided by Google LLC. For this purpose, your telephone number is processed in data centers located in the United States. We rely on the EU/US Data Privacy Framework, to ensure an adequate level of data protection for this transfer.
7. Data Security
We are committed to keeping your personal data secure. We use the native security features of our trusted third-party service providers and configure our tools and systems to be as secure as possible. This includes measures like encryption, access controls, and regular security reviews. We have procedures in place to handle any suspected data security breach and will always notify any applicable regulator and you where we are legally required to do so.
8. What are your rights as a data subject?
You have the following rights as a data subject:
the right to access to personal data that we hold about you;
the right to ask us to update or correct any out-of-date or incorrect personal data that we hold about you;
where the processing is based on your consent, the right to withdraw consent at any given time, without affecting the lawfulness of processing based on consent before its withdrawal;
the right to erasure where the conditions of article 17 of the GDPR have been met;
the right to restriction of processing where the conditions of article 18 of the GDPR have been met;
the right to data portability insofar the conditions of article 20 GDPR apply to you;
the right to object to processing of personal data concerning you, insofar the conditions under article 21 GDPR have been met; and
the right to opt out of any direct marketing communications that we (with your consent) may send you.
You can exercise these rights at any given time by emailing us at the email address referred to in Section 9.
9. Do you have a question or complaint?
9.1 Contact Firsty
For any questions, requests, or complaints regarding our use of your personal data, you can contact our Data Protection representative at: privacy@firsty.app.
9.2 Contact the relevant authority
You also have the right to lodge a complaint with the supervisory authority where you are located. You can find a list of all EU data protection authorities by clicking here.
For the Netherlands, this is:
Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
Tel. (+31) - (0)88 - 1805 250
https://www.autoriteitpersoonsgegevens.nl/en
10. Changes to this Privacy Policy
We may update this Privacy Policy from time to time in order to reflect changes to the way we use your data or for other operational, legal, or regulatory reasons. In such case we will inform you via your inbox in your profile in the app.
The date at the top of this Privacy Policy indicates when it was last updated.