1. Who we are and who this policy covers
Roam Caller sells travel eSIMs: digital SIM profiles that give your phone mobile data in more than 108 countries. This policy explains what personal data we collect when you use our website, buy or top up an eSIM, or contact us, and what we do with it.
Who is responsible. Internova Technologies Limited, 431 Woodcrest Dr SE, Washington, DC 20032, USA, which owns the Roam Caller brand ("Roam Caller", "we", "us") is the data controller for customers who buy from us directly.
If you bought through one of our business partners (for example a bank, fintech app, airline, travel agency or insurer), that partner decides how your data is used in their product and is the controller for it. We process the data needed to issue and run your eSIM on the partner's behalf, under a written agreement with them. Their privacy notice applies to everything they do; this policy applies to what we do.
2. What we collect
We collect only what we need to sell, deliver and support your eSIM. We never see the content of your browsing, messages or calls: your traffic passes through the mobile networks abroad, not through our systems.
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, phone number, country of residence | You, or the business partner you bought through |
| Order details | Plans bought, prices, currency, dates, top-ups, refunds, the partner's order reference | Our systems |
| Payment | Payment method type, the last 4 digits of a card, transaction references. We never store full card numbers or bank PINs. | Our payment providers |
| eSIM and device | eSIM identifier (ICCID), installation status, phone make and model, operating system version | Our eSIM supplier and your device |
| Usage and network | Data used and remaining, expiry date, the country and mobile network the eSIM connects to, connection times | Our eSIM supplier and its partner networks |
| Identity documents, only where required | Passport or national ID details, when a destination country's law requires checks before an eSIM works there | You, collected by us or our eSIM supplier |
| Support | Messages, call notes, screenshots you send us | You |
| Website and marketing | IP address, browser type, pages viewed, marketing preferences | Your browser and you |
We do not knowingly collect sensitive data such as health, religion or biometrics. The usage and network data above shows roughly where your phone is (the country and network), not your precise location.
3. How we use it and why we're allowed to
Data protection laws require a lawful reason, or "legal basis", for each use. Ours:
| What we do | Legal basis |
|---|---|
| Sell you an eSIM, deliver the QR code and install details, apply top-ups | Performing our contract with you |
| Take payment, issue receipts and refunds, prevent payment fraud | Contract; legal obligation; legitimate interests (fraud prevention) |
| Show data used and days left, and warn you when data runs low or a plan expires | Contract |
| Answer support requests and fix connection problems | Contract; legitimate interests |
| Run identity checks a destination country requires | Legal obligation |
| Keep accounting and tax records | Legal obligation |
| Detect abuse, such as reselling eSIMs without permission or using them for fraud or spam | Legitimate interests; legal obligation |
| Improve our service using combined, non-identifying statistics | Legitimate interests |
| Send offers and travel tips by email, SMS or WhatsApp | Your consent, which you can withdraw at any time |
| Use non-essential cookies on our website, if we add any | Your consent |
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We share personal data only with the parties below, and only what each one needs. Service providers act on our instructions under written contracts that require them to protect it.
| Who | What they get | Why |
|---|---|---|
| Our eSIM supplier | Order details, eSIM identifier, device details; identity details where a destination requires them | To issue, activate, top up and support your eSIM |
| Mobile networks in the countries you visit | eSIM identifier and network connection data | To connect you. They act under their own country's telecoms rules. |
| Payment providers (Stripe and Flutterwave) | Payment and order details | To take payments and refunds and prevent fraud |
| The business partner you bought through, if any | Order status, eSIM install details, data usage | To run the service they offer you |
| Cloud hosting, email and support tools | The data needed for each task | To run our systems, send receipts and QR codes, and answer you |
| Professional advisers | What a given matter needs | Legal, audit and accounting work |
| Regulators, courts and law enforcement | Only what the law requires | When we are legally required to, for example by a court order |
| A buyer of our business | Customer records | Only if Roam Caller is merged or sold, under this policy |
5. International transfers
A travel eSIM works across borders, so your data does too. It may be processed in Nigeria, in the countries where our eSIM supplier, payment providers and cloud hosts operate, and in the countries you travel to.
When we send personal data out of the country it was collected in, we use the safeguards that country's law requires. These include:
- transfers to countries the regulator recognises as giving adequate protection
- written contracts with standard data protection clauses, such as those approved by Nigeria's Data Protection Commission (NDPC), the European Commission or the UK
- your consent, or the transfer being necessary to perform our contract with you, for example connecting your eSIM to a network abroad
You can ask us for a copy of the safeguards that apply to your data.
6. How long we keep it
We keep data only as long as we need it, then delete it or make it anonymous.
| Data | Kept for |
|---|---|
| Orders, payments, refunds and invoices | 6 years after the transaction, for tax and accounting law |
| Contact details and eSIM records | While your eSIM is active, then 2 years for support and disputes |
| Usage and network data | 12 months after the eSIM expires |
| Identity documents for destination checks | As long as the destination's law requires, then deleted |
| Support conversations | 3 years after the request is closed |
| Marketing preferences | Until you unsubscribe, then a record of the opt-out so we don't contact you again |
| Website analytics | Up to 13 months |
We keep data longer only when the law requires it or we need it for a legal claim.
7. Security and breaches
We protect personal data with encryption in transit and at rest, access limited to staff who need it, two-factor login for our systems, and regular security reviews. Payment card details are handled by PCI DSS-certified payment providers and never reach our servers.
Treat your eSIM QR code like a key: anyone who scans it before you can install your eSIM. Don't share it, and contact us at once if you think someone else has it.
If a breach puts your rights at risk, we will notify the relevant regulator within the legal deadline (72 hours in Nigeria, Kenya, Uganda and under the GDPR; "as soon as reasonably possible" in South Africa). We will also tell you without undue delay, with what happened and what you can do.
8. Your rights
Wherever you live, you can ask us to:
- give you a copy of your personal data
- correct data that is wrong or incomplete
- delete your data, unless we must keep it by law (for example tax records)
- stop or limit a use of your data, including any use based on our legitimate interests
- send your data to you or another provider in a common digital format, where the law provides this
- withdraw your consent, for example to marketing, without affecting what we did before
Write to us at the address in section 9. We may ask you to prove who you are. We answer within 30 days, or sooner where your country's law requires, and we don't charge unless a request is clearly excessive. If you bought through a business partner, we may pass your request to them.
You can also complain to the data protection regulator where you live:
| Country | Law | Regulator |
|---|---|---|
| Nigeria | Nigeria Data Protection Act 2023 | Nigeria Data Protection Commission (NDPC) |
| Ghana | Data Protection Act 2012 (Act 843) | Data Protection Commission |
| Côte d'Ivoire | Law No. 2013-450 | ARTCI |
| Senegal | Law No. 2008-12 | Commission de Protection des Données Personnelles (CDP) |
| Cameroon | Law No. 2024/017 on personal data protection | The data protection authority set up under that law |
| Kenya | Data Protection Act 2019 | Office of the Data Protection Commissioner (ODPC) |
| Uganda | Data Protection and Privacy Act 2019 | Personal Data Protection Office (PDPO) |
| Egypt | Personal Data Protection Law No. 151 of 2020 | Personal Data Protection Center |
| Tunisia | Organic Law No. 2004-63 | INPDP |
| Morocco | Law No. 09-08 | CNDP |
| South Africa | Protection of Personal Information Act 2013 (POPIA) | Information Regulator |
| EU, EEA and UK | GDPR and UK GDPR | Your national authority; the ICO in the UK |
We'd appreciate the chance to fix a problem first, so please contact us before going to a regulator.
9. Cookies, marketing, children, changes and contact
Cookies. Our website doesn't use analytics or advertising cookies. If we add them, we will ask for your consent first and let you change your choice at any time.
Marketing. We send offers only with your consent. Every email has an unsubscribe link, and you can reply STOP to SMS or WhatsApp messages. Service messages, such as your QR code, receipts and data-low warnings, are not marketing and will still be sent.
Children. Our service is for people aged 18 and over. A parent or guardian may buy an eSIM for a child's phone and is responsible for its use. We don't knowingly collect data from children; if you think we have, contact us and we will delete it.
Changes. We will post any update here with a new effective date. If a change matters to you, we will also tell you by email or in our service before it takes effect.
Contact. Internova Technologies Limited, owner of the Roam Caller brand, 431 Woodcrest Dr SE, Washington, DC 20032, USA.