Privacy Policy

1. Introduction & Data Controller

Welcome to Mapians (mapians.com), operated by Roam Communication Limited ("we", "us", or "our"). We are committed to protecting your privacy and ensuring your personal information is handled safely and responsibly.

Roam Communication Limited is a company registered in England and Wales under Company No. 16116903, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are registered as a data controller with the UK Information Commissioner's Office (ICO) under registration reference ZB619042.

This Privacy Policy explains how we collect, use, process, and safeguard your personal information when you use our website, mobile applications, and international prepaid eSIM data services, in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable international data privacy standards.

2. Information We Collect

We only collect the information necessary to provide, manage, and secure your travel eSIM services:

• Identity and Contact Information: Full name, verifiable email address, country of residence, and phone number (if optionally supplied for support).
• Order and Transaction Details: eSIM plan selected, destination country or region, order reference numbers, purchase timestamps, transaction status, and currency.
• Technical and Device Information: eSIM ICCID, SM-DP+ server address, activation timestamp, device model (used exclusively to confirm hardware eSIM compatibility and guide setup), and approximate network country location.
• Security and Network Logs: A cryptographic keyed hash of your IP address (we store a one-way secure hash rather than the raw IP address to prevent fraudulent orders, bot attacks, and chargebacks while preserving privacy).
• Payment Information: All payment transactions are handled directly through PCI-DSS Level 1 compliant payment gateways (Stripe, Revolut, Stripe, and PayPal). We never receive, process, or store full credit or debit card numbers on our servers.

3. Legal Bases for Processing (UK GDPR)

We process your personal information under the following lawful bases set out in Article 6 of the UK GDPR:

• Performance of a Contract (Article 6(1)(b)): Processing is necessary to generate your eSIM profile, deliver your QR code, provision carrier network access abroad, and provide customer support.
• Legal and Statutory Obligation (Article 6(1)(c)): Fulfilling our accounting, taxation (HMRC/VAT), and regulatory telecommunications recordkeeping obligations in the United Kingdom.
• Legitimate Interests (Article 6(1)(f)): Maintaining the security and integrity of our systems, preventing fraudulent transactions, resolving customer disputes, and improving service performance.
• Consent (Article 6(1)(a)): For optional promotional communications or non-essential cookies, where you have granted express affirmative consent.

4. How We Use Your Data

Your data is used strictly for the following purposes:

• Fulfilling eSIM orders, generating digital profile credentials, and emailing installation instructions.
• Providing 24/7 technical customer support and troubleshooting connection difficulties abroad.
• Verifying and authenticating payment transactions to protect against fraudulent activities.
• Notifying you of important account updates, order receipts, or service notices.
• Continuously optimizing our marketplace coverage, network speeds, and user experience.

5. Data Sharing & Third Parties

We strictly never sell, rent, trade, or monetize your personal data to any third parties or marketing brokers. We share data only with trusted service providers necessary to deliver our services:

• Telecommunications Carriers and Aggregators: Upstream carrier partners (such as Orange, Vodafone, Three, O2, and tier-1 roaming clearinghouses) strictly to allocate network resources, provision the eSIM profile, and verify connectivity status.
• Payment Gateways: Regulated payment processors (Revolut, Stripe, PayPal) for secure transaction processing.
• Infrastructure and Cloud Hosting: Secure cloud infrastructure hosted in ISO-certified data centers with strict encryption in transit (TLS 1.3) and at rest.
• Transactional Communications: Email infrastructure providers used to deliver order receipts and QR code credentials.
• Legal Authorities: Only when required to comply with a valid court order, warrant, or mandatory statutory requirement under English law.

6. International Data Transfers

As an international travel telecommunications marketplace operating across 190+ countries, technical provisioning data may be processed through partner networks located outside the United Kingdom or European Economic Area (EEA). Where cross-border data transfers occur, we implement robust safeguards including UK International Data Transfer Agreements (IDTAs) and standard contractual clauses approved by the UK Information Commissioner.

7. Data Retention

We retain your personal data only for as long as is necessary to satisfy the purposes for which it was collected:

• Accounting and Transaction Records: Retained for 6 years in accordance with UK statutory tax and corporate accounting legislation.
• Customer Support Records: Retained for up to 2 years to assist with ongoing support inquiries and warranty resolution.
• Security and Fraud Prevention Hashes: Automatically purged within 90 days.

8. Your Rights Under UK GDPR

Under UK data protection laws, you possess fundamental rights regarding your personal information:

• Right of Access: You may request a complete copy of the personal data we hold about you.
• Right to Rectification: You may request the correction of any inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your personal data where continuing retention is no longer necessary. You can also submit an automated request via our Account Deletion page.
• Right to Restrict Processing: You may request the restriction of processing under certain legal circumstances.
• Right to Data Portability: You may request a machine-readable export of your personal data.
• Right to Object: You may object to data processing carried out under our legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.

9. Contact & Data Protection Officer

If you have any questions regarding this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Officer:

• Email: support@mapians.com
• Postal Address: Data Protection Officer, Roam Communication Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

You also have the right to lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (Website: ico.org.uk, Telephone: 0303 123 1113).