This Privacy and Cookie Policy describes how personal information is collected, processed and protected for users of the : https://www.roamrapid.com/.
We may update this Privacy and Cookie Policy according to new legislative or jurisprudential requirements and/or business needs, among other reasons. The new version of this Privacy and Cookie Policy will be applicable from the moment of its publication on the Website. Therefore, the User is recommended to review this Privacy and Cookie Policy regularly. This Privacy and Cookie Policy will always be available on the Website so that the data subjects can consult it at all times.
Please bear in mind that to access and use our website you must be an adult and have the legal capacity to enter into contracts, according to the applicable national laws and regulations of your birth or residence country.
Without affecting your rights under applicable legislation, the present Privacy and Cookie Policy is not contractual or part of your contract with us.
This Privacy and Cookie Policy will always be available on this website so that the data subjects can consult them at all times.
For any doubts or questions related to this Privacy and Cookie Policy, you can contact our Customer Service Team by email: info@roamrapid.com..
Who is the personal data controller?
TRAVENTIX SOLUTIONS SL (hereinafter, “the Company”, “We”, “Us” and the like) is the controller of the User’s personal data. We are firmly committed to regulatory compliance and the privacy and protection of personal data of Users. Accordingly, in the present Privacy and Cookie Policy, the User (hereinafter “the User”, “you”, “your”) of the: https://www.roamrapid.com/ (hereinafter, “the/our Website”) will find all the relevant information to better understand what We do with your personal data.
What does this Policy apply to?
This Privacy and Cookie Policy applies to the personal data that We collect and process from you as a User of our Website as well as the services offered within it. The Website is exclusively available to individuals aged 18 or over with full legal capacity under the laws of their country of residence. The Company shall not be liable if the User fails to meet this age requirement.
The Company shall not be liable if the User is not of legal age according to the laws and regulations of their country of birth or residence. In this regard, it is the sole responsibility of parents and/or legal guardians to exercise appropriate control over the online activity of their minor children and prevent their access to Websites whose content is not suitable or recommended for minors.
What does personal data mean and which data do We collect and process?
For the purposes of this Policy, "personal data" refers to all data that identifies you or that could be used to identify you, such as:
- Identification and contact details: your name, email address, and other data you provide when you register, purchase a Product, or contact our Customer Service.
- eSIM service data: To provide and manage your eSIM, we receive from our eSIM provider the ICCID and IMSI of your eSIM profile, your data usage, the country from which your connection exits to the internet, and the activation status of your eSIM. We use this information to show your usage and to manage top-ups and renewals. Through the eSIM service, we do not receive your device model, operating system or geolocation.
- Payment and transactional details: billing address, selected payment method, currency, transaction history, and invoicing data. Sensitive card data is handled directly by our authorised payment service providers; we do not store your complete card data.
- Usage and preference data: your plan selection, Auto Top-Up and Global Plan settings, order history, and interactions with your private account area.
- Browser and app-based activity: IP address, pages visited, and similar information collected via cookies or similar technologies. See our Cookie Policy for further detail.
- Customer Service email records.
What do We use your personal data for?
Please be informed that you only are required to provide personal data and information that is strictly necessary to fulfil the purposes explained below. In this regard, if you provide Us with more information than is expressly required, you consent to its processing for the purpose(s) for which it was granted.
We may use your personal data for the following purposes:
- to manage your order, provision and deliver your eSIM profile and provide the Service you purchased, including Auto Top-Up and Global Plan where activated;
- to manage your private account area and customer support requests;
- to collect the fees of the subscription plans to the Services offered through the Website and process transactions;
- to comply with our legal obligations, legal requirements, laws, and regulations and/or to respond to judicial, police or the corresponding authorities’ requirements;
- to protect, investigate, and deter fraudulent, unauthorized, or illegal activity on/through our Website;
- when applicable, to improve the Service offered by analyzing disaggregated data not associated with a particular User’s personal information.
What is the legal basis for processing your personal data?
We only process your personal data when there is a legal basis for doing so. The legal basis will depend on the reason(s) why we collect and process your personal data. In almost all cases the legal basis will be:
- Performance of a contract: processing your email address and payment data is necessary to provide the Services you have requested or subscribed to;
- The consent you have provided us to install cookies and/or similar technologies on your device(s) to track your activity in these websites, for example, information you share with third-party partners about your browser or device for advertising purposes.
- To comply with our legal obligations and/or to attend administrative, judicial, police, or the corresponding authorities’ official requirements.
- Our legitimate interests in (i) offering an enhanced user experience when you access and use the Website and operate it efficiently, (ii) monitoring fraudulent activity to preserve the security and integrity of our Website; (iii) providing advertisements to users according to their interests; (iv) defending and addressing our rights in the event that a claim regarding our Website and/or Service may arise.
How long do we keep your personal data for?
We will keep your personal data only for as long as you maintain an active account or subscription with us. Beyond that point, your personal data will be retained, under appropriate security safeguards and restricted access, for the period required to comply with our legal obligations and/or for our legitimate interests (e.g., to address claims in connection with the services offered through the Website, or to complete the investigation of detected fraudulent or illicit activity). Once the applicable retention period has elapsed, your personal data will be securely deleted from our information systems.
This Website unequivocally declares that it does not save, store, share, or retain any data related to your facial information, biometric templates, or other personally identifiable biometric data.
Who do We share the User’s personal data with?
We will not share your personal information with third parties without your consent. Nonetheless, in order to provide the Services and comply with our legal obligations, protect our legal rights, or respond to a valid legal request, we may communicate your personal data to the following third parties, including but not limited to:
(i) Payment processors: to handle billing and subscription management through PCI-DSS-compliant providers;
(ii) Third-party providers such as our eSIM connectivity provider (Hong Kong SAR). These providers are contractually bound to process submitted data solely for the purpose of executing the requested services;
(iii) Local mobile network operators in the countries where you use your eSIM, as described below.
(iv) Other service providers to perform functions and provide Services to us, such as hosting and backend infrastructure, database storage and management, email management, store marketing, credit card processing, customer service and others.
(v) administrative, police or judicial authorities as long as the data is required in accordance with the applicable law and regulations;
(vi) law firms to respond to claims regarding our Website or services offered through it;
The third parties mentioned above may have their headquarters outside the European Economic Area (EEA), therefore, your personal data will be the object of international transfers. In any event, if a personal data international transfer is deemed appropriate, We inform you that we will only transfer personal data to recipients located in countries that ensure an adequate level of data protection or, failing that, offer the appropriate safeguards required by the current applicable law and regulations on the protection of personal data, to ensure that your personal data is properly protected and that your individual rights and freedoms are guaranteed. In this regard, please be informed that the third parties mentioned above are committed to standard contractual clauses approved by the EU Commission certification in case of transfers outside EEA together with additional measures.
When you use your eSIM abroad, your device connects to the network of a local mobile operator in the country you are visiting. These operators handle the technical data needed to provide connectivity under their own privacy policies, and this is necessary to deliver the service you requested
How do We protect your personal data?
Your trust is very important to Us and for this reason, your personal data is stored confidentially and securely in our information systems. We are committed to protecting the security of your personal information and we implement the appropriate technical, organizational, administrative and security measures to safeguard and protect your information and personal data against illegal or unauthorized access, misuse or disclosure. We use unique identifiers to process your data anonymously, ensuring it is never directly linked to your personal identity. We are not responsible for security incidents arising from factors outside our reasonable control.
What rights do you have and how can you exercise them?
We inform you that the Users can withdraw their consent to processing their personal data at any time. Users may also exercise the following rights: access, verify and seek rectification, have their Personal Data deleted or otherwise removed, restrict the processing of their data, object to processing of their data, as well as the right to have the Personal Data transferred to another controller (portability), with a written request, addressed to us, via the following e-mail: info@roamrapid.com. We also inform you of your right to lodge a complaint to the Supervisory Authority.
What are cookies and what are they used for?
For the purposes of this Policy, the single term ‘cookies’ refers to cookies and/or similar technologies that track information about accessing and interacting with our Website, for different purposes such as facilitating information about the user’s device, the User’s navigation through our Website, remembering your browsing preferences, customizing the services offered on this Website, the user’s purchase and cancellation history, to generate aggregate statistics based on user interaction, among others.
The memorized data recorded by cookies takes up a small space on a device’s memory and does not harm the device in any way.
When are cookies installed?
Interacting with our Website and purchasing the paid services offered in it implies the installation of cookies, which may belong to us or be from third parties.
The use of third-party cookies is subject to the Cookies and Privacy Policies of these third parties. Therefore, We will not be responsible for the content or the veracity of the mentioned policies of said third parties. Please consult the website(s) and/or Website(s) of said third parties to obtain more information or if you want to change your preferences for setting these cookies.
What type of cookies are installed?
Cookies that can be installed include the following:
- Session cookies: these are used to identify the User during the session, prevent the User from having to repeat processes in the Website and are automatically deleted when the browser on the User’s device is closed.
- Persistent cookies: these are used to identify the User during the session, prevent the User from having to repeat processes in the Website and remain installed for a certain time in the browser of the User’s device.
- Owned cookies: these are sent to the User's device from our Website and/or computer equipment, managed by Us, and their information is collected for our purposes.
- Third-party cookies: these are sent to the User's device from computer equipment or Website managed by another company (partners and/or service providers) and their information can be collected for our purposes (i.e to know the geographical location of the User) and/or to manage or improve the services that these third-party companies offer (i.e to manage the payment of the Website’s services.).
- Technical cookies: these allow the management and operation of this Website and enable its functions and services, for example, to carry out the purchase process and manage payment, etc.
- Analytical cookies: these allow Us to analyze the use of this Website and recognize which functionalities interest users the most, to improve the quality and functionalities of our services (i.e. the Website’s look and feel, messages’ design for usability, etc.) This information is obtained from disaggregated data which is not associated with a particular User or his/her personal information.
- Preference or personalization cookies: they allow the storage of personalized information so that the User can access the service with certain characteristics such as the language, the number of results to be displayed in a search, the appearance or content of the service depending on the type of browser, etc.
To install cookies in your device's browser, we need your express consent, although other cookies are exempt from such consent. The exempt cookies are User authentication or identification cookies (session cookies only).
We have enabled adequate mechanisms to obtain your consent for the installation of cookies that require it. However, please be informed that, in accordance with the Websitelicable laws and regulations, (i) it will be understood that your consent has been given if you modify the configuration of the browser by disabling the restrictions that prevent the installation of cookies and that, (ii) when the installation of cookies is necessary to provide you with the services that you have expressly requested, your consent will not be necessary.
The use of third-party cookies is subject to the Cookies and Privacy Policies of these third parties. Therefore, you must consult the websites of said third parties to obtain more information or if you want to change your preferences for setting these cookies. We will not be held responsible for the content or the veracity of the aforementioned policies of said third parties.
Which Cookies are used on this Website
The Website installs owned technical cookies for consent, sign-in and account creation and, only with consent, analytical and advertising cookies from Google, Microsoft, Amplitude and Datadog. The language is selected through the URL. The Website may also set the first-party NEXT_LOCALE cookie when redirecting from an unprefixed URL to remember the selected language for up to one year.
| Cookie | Provider | Party | Category | Purpose | Duration | Consent |
|---|
| didomi_token | Didomi (consent platform) | Owned, managed by Didomi on our behalf | Technical, persistent | Stores the User's cookie choices: the purposes and providers accepted or rejected. | Consent duration set in Didomi | Not required |
| didomi_dcs | Didomi (consent platform) | Owned, managed by Didomi on our behalf | Technical, persistent | Stores the same choices in Didomi's compact consent-string format. | Consent duration set in Didomi | Not required |
| euconsent-v2 | Didomi (IAB TCF) | Owned, managed by Didomi on our behalf | Technical, persistent | Stores the choices as an IAB TCF consent string. Only installed if IAB TCF is enabled in Didomi. | Consent duration set in Didomi | Not required |
| sb-<project>-auth-token (may be split into .0, .1) | Us (Supabase authentication) | Owned | Technical, persistent | Keeps the User signed in to their account. HttpOnly, Secure, SameSite=Lax. Set only on login and account pages. | Until sign-out or expiry of the session (Supabase default, up to 400 days) | Not required |
| __Host-register-email | Us | Owned | Technical, persistent | Pre-fills the email address in the registration form when a guest buyer returns to create an account more than 30 minutes after paying. Contains the purchase email. HttpOnly, Secure. Deleted when the registration form is sent. | 10 minutes | Not required |
| rr_attribution_session | Us | Owned | Session | Category to be confirmed | Session | Consent required |
| AMP_<key> | Amplitude | Third-party | Analytical, persistent | Stores the Amplitude device id, session id and, for signed-in Users, a customer id, to measure use of the Website. <key> is the first 10 characters of the Amplitude API key. | 1 year | Required (analytics) |
| AMP_MKTG_<key> | Amplitude | Third-party | Analytical, persistent | Stores the campaign (UTM parameters, referrer, click ids) of the visit for attribution. | 1 year | Required (analytics) |
| _ga | Google Analytics 4 (via GTM) | Third-party | Analytical, persistent | Distinguishes Users for usage statistics. | 2 years (400 days in Chrome) | Required (analytics) |
| _ga_<measurement-id> | Google Analytics 4 (via GTM) | Third-party | Analytical, persistent | Keeps the session state for usage statistics. <measurement-id> is the GA4 ID (G-…). | 2 years (400 days in Chrome) | Required (analytics) |
| _gcl_au | Google Ads (via GTM Conversion Linker) | Third-party | Advertising, persistent | Links purchases on the Website to Google Ads campaigns. | 90 days | Required (advertising) |
| _gcl_aw | Google Ads (via GTM Conversion Linker) | Third-party | Advertising, persistent | Stores the Google Ads click id (gclid) when the User arrives from an ad. | 90 days | Required (advertising) |
| _gcl_gb, _gcl_gs | Google Ads (via GTM Conversion Linker) | Third-party | Advertising, persistent | Store additional Google Ads click information (gbraid, wbraid) used for traffic from iOS devices. | 90 days | Required (advertising) |
| _uetsid | Microsoft Advertising (Bing UET tag, via GTM) | Third-party | Advertising, persistent | Identifies the User's session to attribute purchases to Microsoft Advertising campaigns. | 1 day | Required (advertising) |
| _uetvid | Microsoft Advertising (Bing UET tag, via GTM) | Third-party | Advertising, persistent | Pseudonymous visitor id across sessions, for conversion tracking and remarketing. | 13 months | Required (advertising) |
| _uetmsclkid | Microsoft Advertising (Bing UET tag, via GTM) | Third-party | Advertising, persistent | Stores the Microsoft click id (msclkid) when the User arrives from a Bing ad. | 90 days | Required (advertising) |
| MUID | Microsoft (set on Microsoft's domains) | Third-party | Advertising, persistent | Microsoft's user id, synchronised across Microsoft domains when the UET tag loads. | 1 year | Required (advertising) |
| _dd_s | Datadog RUM | Third-party | Analytical (performance), persistent | Groups the User's interactions into a session to detect front-end errors and measure performance. | 15 minutes of inactivity, 4 hours maximum | Required (analytics) |
The Website also uses local storage, which is not a cookie but is covered by this Privacy and Cookie Policy. Didomi keeps a copy of the User's choices there. The entry roamrapid.attribution keeps the campaign parameters of the last visit (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid, ttclid), is only written with advertising consent, and is cleared when a new browser session starts.
Amplitude (AMP_TEST, AMP_TLDTEST) and Datadog (dd_cookie_test_*) briefly set test cookies to check that cookies can be written; they are deleted immediately.
Payment is completed on Stripe's hosted checkout page (checkout.stripe.com). Stripe installs its own cookies on that domain to process the payment and prevent fraud; they are governed by Stripe's cookie policy,.
Durations of third-party cookies are each provider's defaults and must be checked against the final Didomi, GTM, Amplitude and Datadog configuration before publication. Sources: Didomi cookies and storage, Microsoft Advertising UET cookies.
Which Services do not install cookies
Several providers process data for the Website without installing anything on the User's device, because they are called from our servers or sit in front of them.
| Service | Role | Why no cookie is installed |
|---|
| AWS Amplify Hosting and Amazon CloudFront | Hosting, routing and content delivery (CDN) | They serve pages and assets without setting cookies; cookies are excluded from the cache key. |
| Algolia | Destination and plan listings and search | Search requests are sent from our backend, so the User's browser never contacts Algolia. |
| Datadog (backend) | Server error monitoring and logs | Runs on our servers only. The front-end part (RUM) is listed in the table above. |
| Amazon SES and our email provider | Transactional emails (order confirmation, account emails) | Sent from our servers; no browser involvement. |
| eSIM Access | eSIM provisioning | Called from our servers only. |
Enhanced purchase data
When a User completes a purchase, We send the purchase details together with the buyer's email address and name to Google Tag Manager and Amplitude. This lets Us measure which campaigns lead to purchases (Google Ads enhanced conversions) and understand repeat purchases.
Google (GTM / Google Ads): the email and name are normalised and hashed (SHA-256) in the User's browser before they are sent, so Google receives only the hashed values. They are sent only if the User has accepted advertising cookies.
Amplitude: the purchase event is sent from our servers and linked to the User's customer id. Email and name are added as user properties only if the User has accepted analytical cookies.
Data sent with every purchase: order id, plan, destination, quantity, price, currency and the campaign the User arrived from.
The legal basis is the User's consent. Withdrawing consent stops future sends; it does not delete data already sent, which the User can request from Us as described hereto.
How can the User block or refuse cookies?
You can, at any time, revoke the consent given for the installation of this Website’s cookies, by configuring the settings of the browser of your computer or mobile device. The instructions about how to manage or delete cookies for the most common browsers can be found at the following links:
Please bear in mind that in the event that you decide to block, disable or delete cookies, certain functions of this Website that require the use of cookies are not available to you.
You can also configure the browser of your computer or mobile device to accept or reject all cookies by default, or to be notified of the receipt of cookies and to decide each time whether or not to allow the installation of the same.
Moreover, you can activate the following options in order to limit the scope of the cookies installed or their operation:
- private browsing, through which your browser stops saving browsing history, website passwords, cookies, and other information of the pages you visit, or
- the non-tracking function, by which the browser asks the websites you visit not to track your browsing habits, for example, to serve advertisements of your interest in the sites you visit.
How can you reach us?
If, at any time, you have any questions regarding the use of cookies on our Website, please do not hesitate to contact us at info@roamrapid.com.
