Privacy Policy

1. Identification and Contact Details of the Data Controller

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the “GDPR”), as well as Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), users are informed that the personal data provided through the website, the mobile application, and the services associated with MyRoamUp will be processed by:

ROAMUP MOBILITY S.L.
NIF: B26955195
Registered office: Espronceda 39, Mezzanine, Left Door, 28003 Madrid, Spain.
Contact email address: hello@myroamup.com
Email address for matters related to privacy and data protection: support@myroamup.com

This Privacy Policy applies to the website www.myroamup.com, the MyRoamUp mobile applications for iOS and Android, the private customer area, the affiliate portal, and any service related to the marketing, provision, activation, and management of international connectivity services using eSIM technology.

Purpose of data processing

Personal data will be processed for the following purposes:

2.1 User account management

To manage user registration, identification, and authentication within the platform, allowing access to the private area, contracted services, order management, purchase history, administration of purchased eSIMs, and general user account management.

2.2 Provision of the contracted services

To manage the purchase, provision, activation, maintenance, and support of the eSIM services marketed by MyRoamUp.

This purpose includes the generation and delivery of installation QR codes, the management of technical identifiers associated with each eSIM, checking the service status, monitoring data usage, and handling incidents related to connectivity.

2.3 Administrative, accounting, and tax management

To issue invoices, manage payments, comply with tax obligations, carry out accounting tasks, retain the documentation required by applicable regulations, and manage cancellation, refund, return requests, or any other administrative procedure related to the contracted services.

2.4 Customer service and technical support

To respond to queries, information requests, technical issues, complaints, and any communication related to the services provided.
This purpose includes the management of contact forms, information requests, pre-contractual enquiries, technical issues, and communications made through the different channels made available by MyRoamUp.
Communications made via email, web forms, support chat, or instant messaging services enabled by MyRoamUp may be processed for the purpose of responding to queries, incidents, and requests related to the services.

2.5 Affiliate programme management

To manage the contractual relationship with affiliates and collaborators, including commission calculation, issuance of settlements, generation of self-billing invoices, management of promotional codes, and sales attribution.

2.6 Platform security

To ensure the security of the systems, prevent unauthorised access, detect fraudulent activities, protect the integrity of the platform, and maintain audit logs that allow the traceability of the operations carried out.
Likewise, limited processing of technical data may be carried out for the purpose of detecting unauthorised access, fraudulent activities, misuse of the platform, or potential cyberattacks targeting MyRoamUp’s systems.

2.7 Compliance with legal obligations

To comply with any legal, regulatory, tax, commercial, or administrative obligations applicable to MyRoamUp.

2.8 Commercial communications

Where the user has given consent or where there is a legal basis that permits it under applicable regulations, MyRoamUp may send commercial communications related to its products, services, promotions, news, advertising campaigns, product recommendations, discounts, loyalty programmes, or other marketing actions.
The user may object at any time to the sending of these commercial communications through the mechanisms provided for this purpose in each communication or by contacting MyRoamUp through the channels indicated in this Privacy Policy.

2.9 Service-related communications

MyRoamUp may send communications necessary for the proper provision of the contracted services. These communications may include purchase confirmations, delivery of eSIMs and QR codes, invoices, notices related to the activation, status, usage, or expiration of the contracted services, technical support communications, security notifications, information about incidents that may affect the service, and any other communication necessary for the performance of the contractual relationship.

These communications form part of the provision of the service and may be sent even where the user has not given consent to receive commercial communications.

Categories of data processed

For the fulfilment of the purposes described, MyRoamUp may process the following categories of data:

Identification Details

First and last name, email address, preferred language, and login credentials.

Contact details

Phone number, postal address, country of residence, and any other information necessary for the administrative management of the contractual relationship.

Tax and billing details

Tax ID number, VAT number or equivalent tax identifier, company name, tax address, and data contained in the invoices issued.

Financial data

Información relativa a compras realizadas, importes abonados, impuestos aplicables, moneda utilizada y referencias de pago.

MyRoamUp does not store full bank card numbers or financial credentials. Payments are managed by specialised payment service providers.

Data associated with eSIM services

Technical identifiers such as ICCID, activation status, provision date, expiration date, top-ups made, installation QR codes, and any other information necessary for the proper provision of the service.

Affiliate data

Identification, tax, banking, and operational information necessary for the management of affiliate relationships and the payment of commissions.

Audit data and technical logs

Audit data and technical logs
Activity logs, event history, status changes, technical incidents, communications sent, events received from technology providers, and certain technical information generated during the use of the platform. This information may include access logs, session identifiers, IP addresses, browsing data, and other information obtained through cookies or similar technologies, in accordance with the provisions set out in this Privacy Policy and the Cookie Policy.

Lawful basis for processing

The legal basis that legitimises the processing described is:

  • The performance of a contract or the implementation of pre-contractual measures.
  • Compliance with legal obligations applicable to MyRoamUp.
  • The consent given by the data subject.
  • The legitimate interest of MyRoamUp in ensuring the security of its systems, preventing fraud, improving the quality of its services, and properly managing its relationship with its customers and collaborators.

Likewise, where the processing is based on the consent of the data subject, they may withdraw it at any time without affecting the lawfulness of the processing carried out prior to such withdrawal.

Data related to the use of the eSIM

In order to provide the contracted services, MyRoamUp processes certain technical data associated with the eSIMs supplied.
This processing is limited exclusively to the information necessary for the provision, activation, maintenance, and support of the contracted connectivity.
MyRoamUp does not access, monitor, or store the content of communications made by users through the eSIMs, including phone calls, text messages, emails, messaging applications, or browsing carried out by the user.

Disclosure of data and service providers

As a general rule, MyRoamUp does not sell, rent, or disclose its users’ personal data to third parties for those third parties’ own commercial purposes.

However, in order to properly provide the services offered through the platform, certain personal data may be processed by external providers acting on behalf of ROAMUP MOBILITY S.L. as data processors, following our instructions at all times and in accordance with the contracts and safeguards required by applicable data protection regulations.

These providers may be involved in activities related to:

  • The provision, activation, and technical management of eSIM services.
  • Payment processing and verification.
  • Administrative, commercial, and billing management.
  • Hosting, maintenance, and monitoring of the technological infrastructure.
  • Customer service and technical support.
  • The performance of statistical analyses and measurement of platform usage.
  • The management of advertising campaigns, marketing actions, and improvement of the user experience.
  • Fraud prevention and the protection of systems and services.

In particular, for the proper provision of the contracted connectivity services, certain technical data associated with the eSIMs, such as service identifiers, activation statuses, and other data strictly necessary for the provision and management of the service, may be disclosed to the technology provider responsible for the mobile connectivity infrastructure.

Likewise, the data necessary for payment management may be processed by providers specialised in electronic payment services, while administrative and billing information may be managed through technological tools used by MyRoamUp for the management of its operations.

All providers involved in the processing of personal data have been selected based on criteria of solvency, security, and regulatory compliance, and are subject to the corresponding contractual obligations regarding confidentiality and data protection.

Outside the cases described above, MyRoamUp will only disclose personal data where there is a legal obligation, a request from a competent authority, or where such disclosure is necessary for the establishment, exercise, or defence of legal claims.

7. International Data Transfers

Where any of the providers used by MyRoamUp processes data outside the European Economic Area, such processing will only be carried out where appropriate safeguards exist in accordance with the GDPR, including adequacy decisions by the European Commission, standard contractual clauses, or other legally recognised mechanisms.

Retention period

Personal data will be retained for the time necessary to fulfil the purposes for which they were collected and, subsequently, for the applicable statutory limitation periods.

Invoices and accounting documentation will be retained for the periods required by commercial and tax regulations.

Data associated with the user account will remain active for as long as the account remains valid.

Technical and security logs may be retained for the time necessary to ensure the traceability of operations and the protection of systems.

When personal data are no longer necessary for the purposes for which they were collected, they may remain duly blocked for the periods required by applicable regulations in order to address any possible legal, administrative, or tax liabilities.

Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing, and data portability at any time by sending a communication to:

support@myroamup.com

They also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing of their data does not comply with the applicable regulations.

10. Security measures

MyRoamUp applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Among other measures, communication encryption systems, secure credential storage, role-based access control, audit logs, system monitoring, and regular backups are used.

11. Changes to the Privacy Policy

MyRoamUp may amend this Privacy Policy when necessary to adapt it to regulatory, technological, or functional changes.

The current version will be permanently available for consultation through the website and the mobile application.

12. Data we do not collect

MyRoamUp does not request or deliberately process special categories of personal data as defined in Article 9 of the General Data Protection Regulation, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning health, or information relating to users’ sex life or sexual orientation.

Likewise, MyRoamUp does not store full bank card numbers, security codes (CVV/CVC), or financial credentials. All payments are processed directly by specialised payment service providers operating under their own security measures and privacy policies.

The application also does not use device geolocation features or continuously track users’ physical location.

However, certain technical data, such as IP addresses, session identifiers, access logs, or security events, may be processed on a limited basis where necessary to ensure the proper functioning of the platform, prevent fraudulent activities, or protect the security of the systems.

13. Use of cookies and similar technologies

The MyRoamUp website uses cookies and similar technologies that help ensure the proper functioning of the platform, improve the browsing experience, analyse the use of the services, and measure the effectiveness of certain advertising actions.

Information regarding the use of cookies, tracking technologies, and analytics tools is detailed in the corresponding Cookie Policy, accessible from the website.

The user may manage their consent preferences at any time through the tools provided for this purpose.

Likewise, MyRoamUp may use analytics and measurement tools to understand how users interact with the platform, detect incidents, improve the user experience, and evaluate the performance of advertising campaigns. These tools will process information in accordance with the consent preferences configured by the user and in accordance with their respective privacy policies.

14. Minors

The services offered by MyRoamUp are intended for adults with sufficient legal capacity to contract telecommunications services and carry out commercial transactions.

MyRoamUp does not knowingly collect personal information from minors. If it becomes aware that personal data of a minor has been collected without the corresponding legal authorisation, such data will be deleted as soon as possible.

If any person considers that a minor has provided personal data through our services, they may contact us at support@myroamup.com.

15. MyRoamUp mobile application

The MyRoamUp mobile application allows users to manage their account, purchase eSIMs, check the status of their services, download invoices, access their purchase history, and contact support.

The application does not use login systems through Google, Apple, or Facebook, nor does it send push notifications to the user’s device.

Likewise, the application does not access the device’s location or process any additional data other than those necessary for the provision of the contracted services and the proper operation of the platform.

The information relating to data usage, eSIM status, and contracted services displayed in the application comes from MyRoamUp’s internal systems and from the technology providers necessary for the provision of the service.

16. Applicable law and jurisdiction

This Privacy Policy shall be governed by and interpreted in accordance with Spanish and European legislation on the protection of personal data.

Without prejudice to the rights granted to consumers and users under applicable regulations, any dispute related to this Privacy Policy shall be resolved in accordance with current Spanish and European legislation.

Last updated: June 2026