US Privacy Notice

This US Privacy Notice supplements our Privacy Policy and applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other US states whose comprehensive consumer-privacy laws apply to BlueRoam Ltd (“BlueRoam”, “we”, “us”, “our”). It is provided under:

• The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”);
• The Virginia Consumer Data Protection Act (“VCDPA”);
• The Colorado Privacy Act (“CPA”);
• The Connecticut Data Privacy Act (“CTDPA”);
• The Utah Consumer Privacy Act (“UCPA”);
• The Texas Data Privacy and Security Act (“TDPSA”);
• The Oregon Consumer Privacy Act (“OCPA”);
• Other applicable US state laws.

For all other matters, including data we collect, how we use it, our service providers, retention, and security, please see our Privacy Policy.

1. Categories of Personal Information We Collect

In the last 12 months, we have collected the following categories of personal information about US residents:

We do not knowingly collect personal information from children under 16 for purposes of selling or sharing it.

2. Purposes for Which We Use Personal Information

• Providing and improving the Services (account, orders, eSIM provisioning, support);
• Processing payments and refunds;
• Fraud prevention, sanctions and AML screening, security;
• Communicating with you (transactional and, with consent or under permitted bases, marketing);
• Personalisation, analytics, and product improvement;
• Compliance with legal obligations;
• Establishing, exercising, or defending legal claims;
• Corporate transactions (M&A, restructuring).

We limit use of sensitive personal information to the purposes permitted by CPRA Reg. §7027 (necessary to perform the services or for security, fraud prevention, and compliance) unless we obtain your consent.

3. Categories of Personal Information Disclosed or “Sold”/“Shared”

3.1 Disclosed for a business purpose

We disclose categories A–J (above) to service providers and contractors who help us run our business, under contracts that prohibit them from using the information for any other purpose. These include:

• Payment processors;
• Cloud infrastructure and hosting providers;
• Identity verification and fraud-prevention vendors;
• Customer support tooling;
• Email/SMS communications providers;
• Analytics providers;
• Professional advisers (lawyers, accountants, auditors).

3.2 “Sold” or “Shared” (CCPA/CPRA definitions)

BlueRoam does not sell personal information for money.

We may “share” certain categories of personal information (in the CCPA/CPRA technical sense, meaning cross-context behavioural advertising disclosure) — specifically Identifiers (A), Internet/network activity (E), and Geolocation (F) — with advertising partners via third-party advertising cookies and pixels. You can opt out as described in §5.

Under VCDPA, CPA, CTDPA, UCPA, TDPSA, and OCPA, our equivalent disclosure for “targeted advertising” and “sale” is the same.

We do not sell or share personal information of consumers under 16.

4. Your Rights

Depending on your state of residence, you have some or all of the following rights:

5. How to Exercise Your Rights

5.1 Submit a request

• Email: hello@blueroam.io
• Webform: blueroam.io/privacy-request
• Post: Privacy Requests, BlueRoam Ltd, 128 City Road, London, EC1V 2NX, United Kingdom

We respond within 45 days (California; extendable by 45 days), 45 days (Virginia, Colorado, Connecticut, Utah, Texas, Oregon; extendable by 45 days where reasonably necessary).

5.2 Verification

We verify your identity using information already in our records (e.g., email, order history). For sensitive requests we may ask for additional verification (e.g., signed declaration under penalty of perjury under California law).

5.3 Authorised agents

You may use an authorised agent. We require written authorisation (e.g., power of attorney for sensitive requests) and verification of both the agent and the consumer.

5.4 Opt-out of sale/sharing/targeted advertising

You can opt out by:

• Clicking “Do Not Sell or Share My Personal Information” in our website footer;
• Enabling the Global Privacy Control (GPC) signal in your browser (we treat GPC as a valid opt-out for California, Colorado, Connecticut, Texas, and Oregon residents);
• Adjusting your cookie preferences in our cookie banner.

5.5 Limit use of sensitive personal information (California)

Click “Limit the Use of My Sensitive Personal Information” in the website footer.

5.6 Appeals (Virginia, Colorado, Connecticut, Texas, Oregon)

If we deny your request, you may appeal by replying to our decision email or by writing to hello@blueroam.io. We respond to appeals within 60 days.

6. Retention

We retain personal information for the periods set out in our Privacy Policy (§17). We do not retain personal information for longer than reasonably necessary.

7. Non-Discrimination and Financial Incentives

We do not discriminate against you for exercising your privacy rights. We do not currently offer financial incentives for the collection or sale of personal information.

8. “Shine the Light” (California Civ. Code §1798.83)

California residents may request information about disclosures of personal information to third parties for their direct-marketing purposes. We do not currently disclose personal information for third parties’ direct-marketing purposes.

9. Contact

For questions about this Notice or our US privacy practices:

• Email: hello@blueroam.io
• Post: Privacy Office, BlueRoam Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
• California Attorney General: oag.ca.gov/privacy
• California Privacy Protection Agency: cppa.ca.gov