Roamly

    Privacy Policy

    Last updated: 30/10/2026

    1. Introduction

    Roamly Travel, a trading style of Blue Coconut Limited (Company Number: 14816129), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

    2. Information We Collect

    We may collect the following types of personal information:

    • Name and contact details (email address, phone number)
    • Organisation name
    • Enquiry details and correspondence
    • Technical data (IP address, browser type, device information)
    • Usage data (how you interact with our website)

    3. How We Use Your Information

    We use your personal information to:

    • Respond to your enquiries and provide our services
    • Communicate with you about your travel arrangements
    • Improve our website and services
    • Analyse website usage and performance via Google Analytics 4
    • Comply with legal obligations
    • Send marketing communications (with your consent)

    4. Legal Basis for Processing

    We process your personal data under the following legal bases:

    • Contract: To fulfil our contractual obligations to you
    • Legitimate interests: To operate and improve our business
    • Consent: For marketing communications (which you can withdraw at any time)
    • Legal obligation: To comply with legal requirements

    5. Data Sharing

    We do not sell your personal information. We may share your data with:

    • Service providers who help us operate our business (e.g., email services, payment processors)
    • Google LLC — we use Google Analytics 4 to analyse website usage. Anonymised usage data (pages visited, session duration, traffic source) is shared with Google. Google may process this data in the United States under standard contractual clauses. See Google's Privacy Policy.
    • Travel service providers necessary to fulfil your bookings
    • Law enforcement or regulatory bodies when required by law

    6. Data Retention

    We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Typically, we retain customer data for 7 years after the last interaction for tax and legal compliance purposes.

    7. Your Rights

    Under UK GDPR, you have the right to:

    • Access your personal data
    • Correct inaccurate data
    • Request deletion of your data
    • Object to processing of your data
    • Request restriction of processing
    • Data portability
    • Withdraw consent at any time

    To exercise any of these rights, please contact us at hello@roamlytravel.com

    8. Cookies

    Our website uses cookies to enhance your experience. For detailed information about the cookies we use, please see our Cookie Policy.

    9. Security

    We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

    10. International Transfers

    Your personal data may be transferred to and processed in countries outside the UK. When we do so, we ensure appropriate safeguards are in place to protect your data in accordance with UK GDPR.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

    13. Travel Safety Hub Data Processing

    For organisations using our Travel Safety Hub service, we process additional traveller information to fulfil our duty of care obligations and ensure traveller safety:

    Data Collected

    • Essential Information (Required): Traveller name, email, destination, travel dates
    • Optional with Consent: Passport details, emergency contacts, location tracking data
    • Organisation Data: Company name, admin contact details
    • Safety Information: Risk assessments, compliance alerts, travel advisories

    Legal Basis for Processing

    • Contract: Fulfilling travel arrangements and duty of care obligations
    • Legitimate Interest: Safety monitoring, risk assessment, emergency response
    • Legal Obligation: Health & safety regulations, compliance requirements
    • Consent: Location tracking, passport storage, emergency contact processing

    Data Retention

    We retain traveler data according to the following schedule:

    • Standard Retention: 90 days after trip completion
    • Legal Holds: Extended retention when required by law or regulatory requirements
    • Automatic Deletion: Data is automatically deleted after the retention period unless legal requirements dictate otherwise
    • Anonymized Audit Logs: Retained for security and compliance purposes

    Data Protection Measures

    • Encryption of sensitive fields (passport numbers, emergency contacts, location data)
    • Row-Level Security (RLS) policies ensuring organization-level data isolation
    • Complete audit trail of all data access
    • Regular security assessments and penetration testing
    • Secure backup and disaster recovery procedures

    Third-Party Data Sharing

    We share traveler data only when necessary:

    • Emergency Services: In case of emergency or safety incidents
    • Travel Risk Providers: For real-time risk assessments and travel advisories
    • Organisation Admins: Your company's designated safety coordinators
    • Regulatory Authorities: When required by law

    Your Rights as a Traveller

    In addition to the standard GDPR rights, travellers have:

    • Right to Access: View all data we hold about you
    • Right to Export: Download a complete copy of your data in JSON format
    • Right to Deletion: Request immediate deletion of your data (subject to legal obligations)
    • Right to Withdraw Consent: Withdraw consent for optional data processing at any time
    • Right to Audit: View who has accessed your data and when

    Data Processing Agreement

    Organisations using the Travel Safety Hub enter into a Data Processing Agreement (DPA) with Roamly Travel. View our complete Data Processing Agreement.

    • Controller: Your organisation acts as the data controller
    • Processor: Roamly Travel acts as the data processor
    • Sub-processors: Disclosed in our DPA and updated regularly

    14. Contact Us

    If you have any questions about this Privacy Policy or our data practices, please contact us:

    Blue Coconut Limited (trading as Roamly Travel)
    Email: hello@roamlytravel.com

    You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection issues.

    15. eSIM Data Processing (Registered Portal Clients Only)

    Controller-Processor Relationship

    eSIM connectivity is available exclusively to registered Roamly client portal users. Roamly Travel acts as the Data Controller (we own the customer relationship), while Airalo acts as our Data Processor (executes eSIM orders). You maintain a direct relationship with Roamly Travel.

    Data Collected for eSIM Services

    • Required: Name, Email Address, IP Address (for fraud prevention)
    • Transaction: Order details, payment information (processed via Stripe)
    • Device: Phone model (for compatibility verification only)
    • NOT Collected: Physical address, date of birth (unless legally required)

    Data Shared with Airalo

    For order fulfillment, we share: Name, Email, IP Address. Payment details are NEVER shared (handled separately by Stripe). Data is shared only for eSIM activation and delivery purposes.

    eKYC Requirements (Country-Specific)

    Some countries require ID verification for eSIM activation. If required:

    • You'll be explicitly notified BEFORE purchase
    • ID documents are encrypted before transmission
    • Stored temporarily (30 days maximum) then deleted
    • You can opt-out (but won't receive eSIM in those countries)

    Data Retention

    • Roamly: 90 days post-delivery (for support and refunds)
    • Airalo: Per their retention policy
    • You can request earlier deletion (subject to legal obligations)

    Your Rights

    • Access: View all data we hold about you
    • Deletion: Request deletion from both Roamly and Airalo
    • Rectification: Correct inaccurate data
    • Objection: Object to processing (may prevent eSIM delivery)

    Security Measures

    • Encryption in transit (TLS/SSL) for all Airalo API communications
    • Encryption at rest (AES-256) for stored order data
    • Access control: Only authorised staff can access orders
    • No portable storage: Data never on USB drives or external devices
    • Secure file sharing: Time-limited encrypted links (max 10 days)

    Support & Complaints

    Contact us for all data requests: hello@roamlytravel.com. Airalo support will redirect you to us per our agreement. Unresolved complaints can be escalated to the ICO.