Privacy Policy

This Policy applies to customers globally. Jurisdiction-specific rights and disclosures are provided in Section 10 (UK, EU/EEA, Switzerland), Section 11 (California and other US states), Section 12 (Canada), Section 13 (Brazil — LGPD), Section 14 (Australia) and Section 15 (Other jurisdictions).

1. Who We Are (Data Controller)

BlueRoam Ltd is the data controller (or “business” for US state laws, or “data fiduciary” / equivalent term in other jurisdictions) for your personal data.

• Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
• Company number: 17215030
• Privacy contact: hello@blueroam.io
• EU Representative (Art. 27 EU GDPR): Panos Vlahos, Patron 4, 4044, Limassol, Cyprus
• UK Data Protection Officer / Privacy Lead: Andrew Folson, Elpidas 14, 4529, Pyrgos Limassol, Cyprus (or via hello@blueroam.io)

2. Laws That Apply

Depending on where you are located when your data is processed, one or more of the following laws may apply:

• UK GDPR and the Data Protection Act 2018;
• EU GDPR (Regulation 2016/679);
• Swiss Federal Act on Data Protection (revFADP);
• US state laws including CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), OCPA (Oregon) and other applicable state laws;
• Brazil LGPD;
• Canada PIPEDA (and Quebec Law 25);
• Australia Privacy Act 1988;
• Other applicable national or sub-national data-protection laws.

3. Scope

This Policy applies to personal data we collect:

• when you visit blueroam.io or use our applications;
• when you create an account or purchase an eSIM Data Plan;
• when you contact us (support, complaints, sales);
• when you interact with our marketing communications;
• from third-party sources (payment processors, fraud-prevention partners, identity verification providers, Partner Network operators).

4. Personal Data We Collect

We do not intentionally collect “special category” / “sensitive” personal data unless required by law (e.g., from identity documents that incidentally reveal it, in which case we process the minimum necessary). We do not knowingly collect data from children under 18 (under 13 in the US — see §11).

5. How We Use Your Personal Data (Purposes and Legal Bases)

We process personal data on the following legal bases under Article 6 UK/EU GDPR (and equivalent bases under other laws):

Where we rely on legitimate interests, we have carried out and documented a balancing test. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

6. Cookies and Similar Technologies

Our use of cookies is governed by our Cookie Notice at blueroam.io/cookies. Non-essential cookies are set only with your consent in line with the EU/UK ePrivacy regimes, the Quebec Law 25 cookie rules and other applicable laws. US users in CPRA states have the right to opt out of “sharing” / “sale” of personal data through cookies (see §11).

7. Marketing

7.1 We send marketing communications where you have consented or where we are permitted under applicable law (e.g., the UK PECR “soft opt-in” for existing customers; CAN-SPAM in the US; CASL in Canada with express or implied consent).

7.2 Opt out at any time via “unsubscribe” in any marketing email, account preferences, or hello@blueroam.io. Opt-outs do not affect transactional or service-related communications.

8. Disclosure to Third Parties

We share personal data with:

• Partner Networks and eSIM platform providers (to provision and manage your eSIM);
• Payment service providers (e.g., NeptunePay);
• Identity verification and fraud-prevention providers where EDD or AML screening applies;
• Cloud hosting and IT infrastructure providers (e.g., AWS);
• Communications providers (email, SMS, customer support);
• Analytics providers (e.g., Google Analytics, etc.), subject to your cookie preferences;
• Professional advisers (lawyers, accountants, auditors) under duties of confidentiality;
• Regulators, law enforcement and other authorities where required by law or to protect our rights or others’;
• Acquirers, investors or successors in corporate transactions.

We require all processors to act only on documented instructions and maintain appropriate security and confidentiality (UK/EU GDPR Art. 28 and equivalent).

We do not sell personal data in the ordinary commercial sense. For the specific definitions of “sell” and “share” under California and other US state laws, see §11 and our US Privacy Notice.

9. International Data Transfers

9.1 BlueRoam is based in the UK. Where personal data is transferred to or from countries that do not have an adequacy decision, we use one of the following safeguards:

• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• The EU Standard Contractual Clauses (2021);
• A recognised adequacy regulation/decision;
• Another lawful transfer mechanism under Article 46 or 49 UK/EU GDPR.

9.2 Data may also be subject to onward transfer by Partner Networks and payment providers, in each case under their own data-protection regimes.

9.3 You can request copies of the safeguards via hello@blueroam.io.

10. UK, EU/EEA and Swiss Residents — Your Rights Under UK GDPR / EU GDPR / revFADP

Subject to applicable law and exemptions, you have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict processing in certain circumstances;
• Object to processing based on legitimate interests or for direct marketing;
• Data portability for data processed on the basis of consent or contract;
• Withdraw consent where processing is based on consent;
• Not be subject to decisions based solely on automated processing producing legal or similarly significant effects (see §16);
• Lodge a complaint with your local supervisory authority (e.g., the UK ICO at ico.org.uk; in the EU, your national DPA — list at edpb.europa.eu).

To exercise these rights: hello@blueroam.io. We respond within one month (extendable by two further months in complex cases). We may need to verify your identity.

EU/EEA residents may also contact our EU Representative at Panos Vlahos, Patron 4, 4044, Limassol, Cyprus (or via hello@blueroam.io).

11. California and Other US State-Law Residents

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or any other US state with a comprehensive consumer privacy law that applies to BlueRoam, you have additional rights described in our US Privacy Notice. In summary:

• Right to know what personal information we collect, use, disclose and (if applicable) sell or share;
• Right to delete personal information we hold about you;
• Right to correct inaccurate personal information;
• Right to opt out of “sale” or “sharing” of personal information for cross-context behavioural advertising;
• Right to limit use of “sensitive personal information” (California);
• Right to data portability;
• Right to non-discrimination for exercising your rights;
• (Colorado, Connecticut, Texas, Oregon and some others) Right to opt out of profiling for legally or similarly significant decisions;
• Right to appeal denials of your requests (Virginia, Colorado, Connecticut, Texas, Oregon).

To exercise these rights, see the US Privacy Notice or email hello@blueroam.io.

BlueRoam does not sell personal information for money. We may “share” personal information for cross-context behavioural advertising in the CPRA sense; if you wish to opt out, see the “Do Not Sell or Share My Personal Information” link in our website footer and our US Privacy Notice.

12. Canada (PIPEDA, Quebec Law 25)

If you are in Canada, you have rights to access, correct and challenge our handling of your personal information under PIPEDA and provincial laws (including Quebec Law 25). You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or to your provincial commissioner. Quebec residents have specific rights including data portability and rights regarding automated decision-making (see §16).

13. Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD) including access, correction, anonymisation/blocking/deletion, portability, information about sharing, withdrawal of consent and review of automated decisions. Complaints may be lodged with the Brazilian National Data Protection Authority (ANPD).

14. Australia

If you are in Australia, you have rights under the Privacy Act 1988 and the Australian Privacy Principles, including access and correction rights. Complaints may be lodged with the Office of the Australian Information Commissioner at oaic.gov.au.

15. Other Jurisdictions

If you are in a country not specifically named above, we comply with applicable local data-protection laws. You may contact hello@blueroam.io to exercise rights available under those laws.

16. Automated Decision-Making

Some elements of our fraud, sanctions and risk-screening processes involve automated decisions (e.g., automatic decline of a high-risk transaction). Where such a decision produces legal or similarly significant effects for you, we will, on request:

• inform you of the decision;
• allow you to obtain human intervention;
• allow you to express your point of view; and
• allow you to contest the decision.

Contact hello@blueroam.io.

17. Data Retention

After retention periods, data is securely deleted or anonymised, save where retention is required by law.

18. Security

We implement appropriate technical and organisational measures including encryption in transit and at rest, access controls, network security, pseudonymisation, regular testing, incident response and staff training. No system is completely secure; we notify you and/or competent authorities of breaches as required by law (within 72 hours under UK/EU GDPR; under varying timeframes for US states; without undue delay under LGPD, etc.).

19. Children

Our Services are not directed at, and we do not knowingly collect data from, individuals under 18. In the US, we comply with the Children’s Online Privacy Protection Act (COPPA) and do not knowingly collect data from children under 13. If you believe a child has provided personal data, contact hello@blueroam.io and we will take appropriate steps.

20. Changes to This Policy

We may update this Policy. The “Effective date” shows when the latest version took effect. Material changes are notified by email or via the Platform with reasonable notice.

21. Contact

• Email: hello@blueroam.io
• Post: Data Protection, BlueRoam Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
• EU Representative (Art. 27 GDPR): Panos Vlahos, Patron 4, 4044, Limassol, Cyprus (or via hello@blueroam.io)
• UK ICO: ico.org.uk | 0303 123 1113
• EU DPAs: edpb.europa.eu
• California Attorney General: oag.ca.gov/privacy