Privacy Policy

1. Introduction

This Privacy Policy explains how PALOP Roam Connect, Lda. ("PALOP Connect", "we", "us", or "our") collects, uses, stores, and protects your personal data when you visit our website, create an account, or use our eSIM connectivity services.

Please read this policy carefully. If you have questions, contact us using the details in Section 14.

2. Who Is the Data Controller

The data controller responsible for your personal data is:

As a company established in Portugal, we are subject to the GDPR and are supervised by the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority.

3. What Data We Collect

We collect personal data in the following ways:

3.1 Data You Provide Directly

• Account registration: name, email address, password (encrypted).
• Purchase & billing: billing address, payment method details (processed by our payment provider — we do not store full card numbers).
• Support requests: messages, email correspondence, device information you share with us.

3.2 Data Collected Automatically

• Usage data: pages visited, features used, timestamps, click data.
• Device & technical data: IP address, browser type, operating system, eSIM device identifiers (EID).
• Network data: data consumption associated with your active eSIM plan (required for billing and service delivery).

3.3 Data from Third Parties

• Payment processors: transaction confirmation and fraud signals.
• Network operators: data usage reports necessary to manage your plan.

We do not collect special categories of personal data (such as health, religion, or biometrics) and we do not sell your data to any third party.

4. How We Use Your Data

We do not use your data for automated decision-making or profiling that produces significant legal effects without human review.

5. Legal Basis for Processing (GDPR)

Under the GDPR (Article 6), we process your data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing your account data, delivering eSIM plans, and handling payments is necessary to fulfil our contract with you.
• Legal obligation (Art. 6(1)(c)): Retaining billing records and usage data to comply with Portuguese tax law, ANACOM regulations, and other applicable legal requirements.
• Legitimate interests (Art. 6(1)(f)): Fraud prevention, network security, improving our services, and direct marketing of similar products to existing customers (where permitted).
• Consent (Art. 6(1)(a)): Sending you marketing emails or using non-essential cookies — where you have given explicit opt-in consent. You may withdraw consent at any time.

6. Who We Share Your Data With

We do not sell your personal data. We share data only as necessary and with appropriate safeguards:

All third-party processors are bound by Data Processing Agreements (DPAs) that require them to handle your data in compliance with the GDPR.

7. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where transfers outside the EEA are necessary (for example, to network operators in PALOP countries), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries with an EU adequacy decision.
• Case-by-case assessment and necessary protective measures in accordance with GDPR Chapter V.

You may request information about specific safeguards by contacting us at privacy@palopconnect.com.

8. How Long We Keep Your Data

After the applicable retention period, data is securely deleted or irreversibly anonymised.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights. We aim to respond to all requests within 30 days.

To exercise any of these rights, email us at privacy@palopconnect.com with your name, registered email, and description of your request. We may ask you to verify your identity before processing the request.

10. Cookies & Tracking

Our website uses cookies and similar technologies. We use:

You can manage your cookie preferences at any time via the Cookie Settings panel on our website, or by adjusting your browser settings. Blocking certain cookies may affect your experience.

We comply with EU Directive 2002/58/EC (the ePrivacy Directive) as implemented in Portuguese law.

11. Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access. These include:

• Encryption of data in transit (TLS/HTTPS) and at rest where appropriate.
• Access controls — only authorised personnel can access personal data.
• Regular security assessments and vulnerability testing.
• Secure password storage using hashing.

In the event of a personal data breach that poses a risk to your rights, we will notify the CNPD within 72 hours as required by GDPR Article 33, and inform affected users without undue delay where required by Article 34.

12. Children

Our Services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a minor has registered on our platform, please contact us at privacy@palopconnect.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date and notify you by email if you are a registered user, at least 30 days before the changes take effect.

We encourage you to review this policy periodically. Continued use of our Services after changes indicates acceptance of the updated policy.

14. Contact & Supervisory Authority

For any privacy-related questions, requests, or concerns, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Portuguese supervisory authority:

You may also lodge a complaint with the data protection authority in your EU country of residence if it differs from Portugal.