Privacy Policy

AENEA Global Ltd (trading as "RoamFree") is the "Data Controller" of your personal data. We are registered in England and Wales (Company No. 16743851).

Registered Office: 186 Moorside Road, Swinton, Manchester, England, M27 9LE

Contact Email: [email protected]

Because of our privacy-first approach, we only collect what is strictly necessary:

• Email Address. Required to send your eSIM QR code and order receipt.
• Order History. Transaction ID, the specific eSIM plan purchased, destination country, and price.
• Payment Information. Handled securely by our payment processor (Stripe). We never see, touch, or store your full credit card details.
• IP Address. Temporarily stored in our server logs purely for security and fraud-prevention purposes.

What we do NOT collect:

• We do not ask for your name, phone number, or physical address.
• We do not use behavioural analytics, marketing pixels, or third-party tracking scripts.
• We do not send marketing emails.

Under UK GDPR, we process your data under the following legal bases:

• To deliver your eSIM (Performance of a Contract). We use your email address and order history to fulfill our contract with you.
• To process payments (Performance of a Contract). Facilitated via Stripe.
• To protect our systems (Legitimate Interests). We log IP addresses on our servers to detect and prevent fraud and unauthorised access.
• To maintain financial records (Legal Obligation). We must retain basic transaction records to comply with UK tax law (HMRC).

We do not sell your data. We only share specific data with trusted third parties necessary to run our service:

• Stripe (Ireland/USA). Processes your payment.
• Zendit (USA/Global). Our underlying eSIM provider. They receive your email address, purchased plan details, and the ICCID (eSIM serial number) to provision the service.
• Resend (USA, or EU on upgraded plans). Our transactional email provider. They process your email address to ensure your eSIM reaches your inbox.
• Hetzner (Germany). Our website host. Server logs are securely processed here.

Some of our processors (Stripe, Zendit, Resend) are based in or transfer data to the United States. When your data is transferred outside the UK, we ensure it is protected to UK GDPR standards by ensuring our processor agreements include the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

• Server Logs (IP Addresses). Automatically deleted after 30 days.
• Email & Order History. Retained for as long as necessary to provide customer support (usually up to 12 months from purchase).
• Financial/Transaction Records. Retained for 7 years to comply with UK tax and accounting laws.

We do not use non-essential, marketing, or tracking cookies. We only use strictly necessary technical cookies required to keep your session active during the checkout process. Therefore, we do not require a cookie consent banner.

You have extensive rights regarding your personal data:

• Right of Access. Request a copy of the data we hold about you.
• Right to Rectification. Ask us to correct inaccurate data.
• Right to Erasure. Ask us to delete your data (exceptions apply for tax-required data).
• Right to Restriction & Objection. Ask us to restrict or object to our processing.
• Right to Data Portability. Request your data in a structured, machine-readable format.

To exercise any of these rights, please email us at [email protected]. We will respond within one calendar month.

If you are unhappy with how we have handled your personal data, please contact us first at [email protected]. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO).

ICO Website: ico.org.uk
ICO Telephone: 0303 123 1113