Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") is entered into between Blue Coconut Limited trading as Roamly Travel ("Processor") and the organisation using the Travel Safety Hub service ("Controller") and forms part of the Terms of Service for the Travel Safety Hub.

This DPA reflects the parties' agreement with respect to the processing of Personal Data in accordance with the requirements of UK GDPR and the Data Protection Act 2018.

2. Definitions

• Controller: The organisation subscribing to the Travel Safety Hub service
• Processor: Roamly Travel (Blue Coconut Limited)
• Personal Data: Information relating to identified or identifiable travelers
• Data Subject: Individual travelers whose data is processed
• Processing: Any operation performed on Personal Data
• Sub-processor: Third-party service providers engaged by the Processor

3. Scope and Nature of Processing

3.1 Purpose of Processing

The Processor will process Personal Data for the following purposes:

• Providing travel safety monitoring and compliance services
• Risk assessment and alert generation
• Emergency response coordination
• Regulatory compliance reporting
• Processing eSIM purchases and delivering digital travel connectivity services (registered portal clients only)

3.2 Types of Personal Data

• Traveler identification (name, email, phone, employee ID)
• Travel details (destinations, dates, trip purpose)
• Passport information (with explicit consent)
• Emergency contact details (with explicit consent)
• Location data (with explicit consent)
• Risk assessment data
• eSIM purchase details (customer name, email, phone for order fulfillment — portal clients only)
• Payment transaction data (processed by Stripe as sub-processor)

3.3 Categories of Data Subjects

• Employees travelling for business purposes
• Contractors and temporary workers
• Other authorised travellers registered by the Controller

4. Controller and Processor Obligations

4.1 Controller Responsibilities

The Controller shall:

• Ensure lawful basis for processing exists before providing data to the Processor
• Obtain necessary consents from Data Subjects where required
• Provide clear privacy notices to Data Subjects
• Respond to Data Subject rights requests in coordination with the Processor
• Maintain records of processing activities

4.2 Processor Responsibilities

The Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Implement appropriate technical and organizational security measures
• Maintain confidentiality of Personal Data
• Assist the Controller in responding to Data Subject rights requests
• Assist the Controller in ensuring compliance with GDPR obligations
• Delete or return Personal Data at the end of the service provision
• Make available all information necessary to demonstrate compliance

5. Security Measures

The Processor implements the following technical and organizational measures:

• Encryption: Sensitive data encrypted at rest and in transit using industry-standard algorithms
• Access Controls: Role-based access control (RBAC) with multi-factor authentication
• Data Isolation: Organization-level data separation using Row-Level Security
• Audit Logging: Logging of all data access and modifications
• Regular Backups: Automated daily backups with 30-day retention
• Incident Response: 24/7 security monitoring and incident response procedures
• Penetration Testing: Regular third-party security assessments
• Employee Training: Mandatory data protection training for all personnel

6. Sub-processors

6.1 Authorised Sub-processors

The Controller authorises the Processor to engage the following sub-processors:

• Supabase Inc: Database hosting and authentication services (USA/EU)
• Resend: Email delivery services (USA)
• Stripe Inc: Payment processing (USA/EU)
• Risk Intelligence Providers: Travel advisory and risk assessment data
• Airalo Inc: eSIM Network Provider - Purpose: eSIM activation, delivery, and network connectivity. Data processed: Customer name, email, IP address, order details. Location: Singapore (HQ), Global operations. Safeguards: Standard Contractual Clauses, ISO 27001 certified. Role: Sub-processor (Roamly is Controller, Airalo is our Processor).

6.2 Sub-processor Changes

The Processor will inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object to such changes.

6.3 Sub-processor Obligations

The Processor ensures that sub-processors are bound by written agreements imposing data protection obligations equivalent to those set out in this DPA.

7. Data Subject Rights

The Processor shall assist the Controller in responding to Data Subject requests to exercise their rights under UK GDPR, including:

• Right of Access: Providing data export functionality within the platform
• Right to Rectification: Enabling data updates and corrections
• Right to Erasure: Implementing deletion workflows within 30 days
• Right to Restrict Processing: Allowing temporary processing restrictions
• Right to Data Portability: Providing data in machine-readable JSON format
• Right to Object: Processing objections and implementing restrictions

Response time: The Processor will assist the Controller within 14 days of a request.

8. Data Breach Notification

8.1 Notification Procedure

The Processor shall notify the Controller without undue delay and in any event within 24 hours of becoming aware of a Personal Data breach.

8.2 Breach Information

Notification shall include at minimum:

• Nature of the breach and categories/numbers of Data Subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact point for further information

8.3 Cooperation

The Processor shall cooperate with the Controller and provide reasonable assistance in investigating and remediating the breach.

9. International Data Transfers

Personal Data may be transferred to and processed in countries outside the United Kingdom:

• Adequacy Decisions: Transfers to countries recognised as adequate by UK authorities
• Standard Contractual Clauses: Use of UK approved SCCs for other transfers
• Additional Safeguards: Technical measures including encryption and access controls

The Processor maintains documentation of all international transfers and applicable safeguards.

10. Data Retention and Deletion

10.1 Retention Period

Personal Data is retained for 90 days following trip completion, unless:

• Legal or regulatory requirements mandate longer retention
• The Controller requests extended retention with documented justification
• Active legal proceedings require data preservation

10.2 Automated Deletion

The Processor implements automated deletion processes that:

• Automatically delete expired data on schedule
• Maintain anonymized audit logs for compliance
• Notify Controllers of upcoming deletions

10.3 Service Termination

Upon termination of services, the Processor shall:

• Provide the Controller with a complete data export within 30 days
• Securely delete all Personal Data within 90 days unless legally required to retain
• Certify deletion upon Controller's request

11. Audits and Compliance

11.1 Right to Audit

The Controller may audit the Processor's compliance with this DPA:

• Upon reasonable notice (minimum 30 days)
• During normal business hours
• No more than once per year unless a breach is suspected
• Subject to confidentiality obligations

11.2 Audit Reports

The Processor shall provide:

• Annual SOC 2 Type II reports (when available)
• ISO 27001 certification (when obtained)
• Penetration test summaries (upon request)
• Data processing records and logs

12. Liability and Indemnification

Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the main Terms of Service.

The Processor shall indemnify the Controller against fines imposed by supervisory authorities resulting from the Processor's breach of this DPA, to the extent such breach was not caused by the Controller's instructions or actions.

13. Term and Termination

This DPA shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller.

Upon termination, obligations regarding data deletion, return, and confidentiality shall survive.

15. eSIM-Specific Data Processing Obligations (Portal Clients)

15.1 Controller-Processor Relationship

eSIM services are available exclusively to registered Roamly client portal users. Roamly Travel acts as Controller (owns customer relationship) and Airalo acts as Processor (executes technical fulfillment). All customer communications are directed to Roamly Travel.

15.2 Data Minimization

Only essential fields transmitted to Airalo:

• Required: Name, Email, IP Address
• No extraneous PII in API metadata or custom headers
• Payment data never shared (handled by Stripe as separate processor)

15.3 eKYC Compliance

For countries requiring ID verification:

• User explicitly notified BEFORE purchase
• Consent checkbox required
• ID documents encrypted before transmission
• Secure API endpoint used
• Retention: 30 days maximum, then deletion

15.4 Right to Deletion (Cascade)

When user requests deletion:

• Roamly deletes data within 30 days
• Roamly instructs Airalo to delete (via API if available)
• If no API available: Manual deletion request sent
• Confirmation of deletion documented

15.5 Security Requirements

• Encryption in Transit: TLS 1.2+ for all Airalo API calls
• Encryption at Rest: AES-256 for stored eSIM order data
• Access Control: Least privilege, MFA required, only essential staff
• No Portable Storage: USB drives and external HDDs prohibited
• Secure File Sharing: Unique expiring links (max 10 days) or secure portal

15.6 Support Handling

• Users contact Roamly for all data requests (not Airalo)
• Airalo redirects users to Roamly (per contract Section 8.2)
• Roamly coordinates all GDPR requests with Airalo

15.7 Breach Notification

• Airalo must notify Roamly within 24 hours of data breach
• Roamly notifies affected users per GDPR requirements
• Joint investigation and remediation

15.8 Audit Rights

• Roamly can audit Airalo's data handling (annual)
• Airalo provides SOC 2 reports (if available)
• Airalo provides compliance documentation on request

Contact Information

For questions about this DPA or data processing practices, please contact:

Blue Coconut Limited (trading as Roamly Travel)
Data Protection Officer
Email: hello@roamlytravel.com

Supervisory Authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk