Privacy Policy | Holafly

1. Introduction

This privacy policy (“Notice”) is intended to inform you about how your Personal Data will be handled by Holafly Limited (“Holafly” “we” “us” or “our”) and sets out the information including personal information detailed below relating to you or which you provide to us (“Personal Data”) that will be collected and processed by Holafly and/or on its behalf by its third party service providers when you contact us through our channels, such as our application, website or, once you have contracted for our services. We are required to give you this information, including to inform you about your data protection rights, under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Does Holafly comply with data protection laws?

Holafly takes its data protection obligations seriously and will never share personal data with any third parties without the proper legal basis. We are committed to compliance with data protection and privacy regulations globally, including GDPR, UK data protection laws, and relevant privacy frameworks in North America, Australia, and Latin America, with privacy by design integrated into all our services.

2. Holafly as data controller

For the purposes of this Notice, the controller of your personal data is Holafly Limited of 6th Floor, 2 Grand Canal Square, Dublin 2, D02 A342, Ireland. Holafly is responsible for your Personal Data.

Holafly is committed to respecting your fundamental right to the protection of your Personal Data and this Notice is intended to inform you about the processing of your Personal Data by us.

3. Types of Personal Data we process about you

Category of Personal Data	Details
Website Usage and Device Data: When you visit our application, or our website.	Your visits and interactions with our website including which webpages you visit, time and date of access, what you click on, when you perform these actions; Your device data including your IP address, location data, device type and language, browser type and other related information; and Any linked websites that you access through the website. Most of this Personal Data is collected using cookies on the Website. Please see our Cookies Policy for more information about how the website uses cookies.
Customer Data: When you purchase an e-SIM or data plan.	Full name; title, country of residence; current location; residential address; network provider; telephone number; payment information; e-mail address; device type (e.g. make and model); a copy of your passport, driving licence or similar documentation for identification (where necessary); and other details relating to you when you interact with us regarding the purchase of an e-SIM.

4. Sources of your Personal Data

During the course of our contractual relationship with you or when you visit our website or application, we will collect Personal Data either: (1) directly from you, or (2) indirectly from third parties (for example, once you have contracted for our services, through our affiliates or travel agencies).

When you browse on our website, different cookies and other tracking devices may be installed on your device, as set out in our Cookies Policy. Where we collect your Personal Data by using cookies on our website, which are not necessary for the Website to operate, we require your consent to do so.

5. For what purpose and on what legal basis do we process personal data?

We have set out in the below table the key context upon which (“Legal Basis”) we process your Personal Data. We also explain how (“Nature of Processing”) and why (“Purposes”) we obtain and collect your Personal Data.

Legal Basis	Nature of Processing and Purposes	Categories of Personal Data
Compliance with a Legal Obligation	Holafly may process your Personal Data where it is necessary to comply with legal obligations to which we are subject under European Union and/or applicable laws, including but not limited to safeguarding and complying with law enforcement requests.	Customer Data Website Data
Performance of a Contract	To provide you with access to the website and to allow you to use the website. To manage the purchase of the e-SIM or data plan that we sell on our website and the payment relating to such products. To calculate and issue charges for services provided to you. To review and attend to customer incidents, queries, complaints or requests relating to our products and services. To manage and perform any after-sales services. To manage your registration as a user of our website and/or application, as well as to allow your access to the Holafly's private user area	Customer Data Website Data
Legitimate Interest	To facilitate the use of your e-SIM or data plan, including the administration of your account, and to provide customer care to you. To better understand how our customers use our website in order to improve it. To tailor products and services to you and, if you consent to direct marketing, to tailor direct marketing. To monitor against and prevent cyber-security issues and unauthorized use of our information, IT systems and/or equipment. To streamline our business processes by using external platforms; To conduct internal business reviews and, if necessary, contact the customer in the event that fraud or identity theft is detected or there are reasonable suspicions of fraud, identity theft or illegal activity. To record calls for training purposes and to improve our customer service. To conduct periodic reviews of our services and carry out satisfaction surveys to evaluate and improve the quality of the service we provide. To carry out any other activities necessary to the running of our business, including system testing, network monitoring, staff training, and quality control. To send communications about products or services similar or related to those previously purchased or shown interest in, including reminders about incomplete purchases or information about complementary services that may enhance the user experience.	Customer Data Website Data

5.1 Communications and Marketing

Holafly may contact you through the communication channels you have provided (such as email, in-app notifications or push notifications) for purposes related to the provision, management and promotion of our services.

Service-related communications: To contact you regarding essential information related to the activation, use, performance, or availability of your eSIM or connectivity services (including service alerts, technical issues, usage notifications, reminders, or quality-related communications). This processing is necessary for the performance of a contract to which you are a party.
Customer support and requests: To respond to any inquiry, request, or incident raised by you through any of our contact channels (such as email, chat, social media, or in-app support). This processing is necessary for the performance of a contract or, where applicable, based on our legitimate interest in providing high-quality customer service.
Incomplete purchase or checkout reminders: To remember your activity on our website or app and contact you if you have started but not completed a purchase, in order to allow you to resume the process without re-entering your details. This processing is based on our legitimate interest, as it facilitates the completion of a service you have already shown interest in and improves your user experience.
Useful service information: To provide you with relevant information related to your purchased services, such as instructions for installation or activation, tips for optimal usage, destination-related connectivity advice, or a summary of previous purchases. This processing is based on our legitimate interest in improving customer satisfaction and encouraging continued use of our services.
Administrative and security communications: To send you administrative or operational messages, including security alerts or updates related to your account or services. This processing is necessary for the performance of a contract or to comply with legal obligations (e.g.: applicable data protection obligations).
Customer experience and market research:
- Customer satisfaction surveys and reviews: We may send you surveys to collect feedback about your experience with Holafly to understand customer satisfaction and improve our services. This processing is based on our legitimate interest in improving our products and services.
- Market research: With your consent, we may use your data to conduct surveys or interviews aimed at developing or improving our products and services.

Any feedback collected may be used internally for analysis and reporting purposes and, where applicable, displayed in anonymised or aggregated form to help other customers make informed decisions. This process is based on our legitimate interests in conducting analyses that help improve our products and services.

5.2 Marketing Activities

Under the conditions described below, Holafly may process your personal data for marketing purposes.

Marketing communications to existing customers: When you purchase a Holafly eSIM or connectivity service, you may receive marketing communications related to similar or complementary Holafly products and services (such as destination-based eSIMs, top-ups, upgrades, or special offers), via email or other electronic channels. This processing is based on our legitimate interest in promoting products and services that may be of interest to you, as long as you have purchased our products or services, and provided you have not opted out and a reasonable period of time has not elapsed.
Consent-based marketing: Where required by applicable law, we will send you promotional communications (such as discount codes, special campaigns, or newsletters) only after you have given your explicit consent. You may withdraw your consent at any time by clicking the unsubscribe link included in each communication or by managing your preferences through your account or our Privacy form.
Opt-out and preferences: You can unsubscribe from marketing communications at any time by clicking the unsubscribe link included in each email or by managing your preferences through your account or our Privacy form.
Personalised marketing and offers: We may personalise the content of the aforementioned marketing communications or offers based on your previous purchases, usage patterns, or destination preferences, in order to avoid sending irrelevant content. This processing is based on our legitimate interest in providing meaningful and relevant communications.

6. With whom do we share Personal Data?

Depending on the Purpose for which we process your Personal Data, we may share such Personal Data with some or all of the following recipients to the extent necessary:

Holafly internal/ intra-group entities: Internal departments and services (such as our sales department, marketing department or IT department).
Telecommunications service providers: Service providers located in the appropriate jurisdiction for which the e-SIM service was purchased.
Regulatory authorities and law enforcement agencies: Where we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request, such as the Revenue Commissioners, Department of Social Protection, the Data Protection Commission, Workplace Relations Commission, the Irish courts, An Garda Síochána or any other applicable authorities.
Third party advisors/ professionals: Professional advisors who provide professional services to us e.g. consultants, legal advisors.
Third party service providers: We engage third party suppliers who may process your Personal Data on our behalf for the above Purposes. These include the following:
Administrative services.
Advertising and communication services.
Corporate social responsibility services.
Maintenance services.
Physical security services.
Archiving, custody, storage and digitalization services.
Document removal and destruction services.
Back-office services.
IT services.

Does Holafly share customer data with third parties?

"Our network carriers only process the minimal technical information needed for the service to function, such as the IMSI (International Mobile Subscriber Identity), the MSISDN (mobile number identifier), and the IP addresses used to establish the connection. This information is standard in all mobile services worldwide and is necessary for routing traffic and enabling connectivity.

Our network partners only access technical data required for connectivity and cannot see details such as names, emails, payment information, or browsing activity. All communications use end-to-end encryption (HTTPS, SFTP, SSH), ensuring data remains encrypted in transit. We implement data minimization principles and maintain strict partner agreements to prevent linking internet traffic to identifiable individuals."

7. International Data Transfers

Users resident in the European Union should note that your Personal Data will be transferred to certain recipients (mainly our external service providers) who are located outside the European Economic Area (“EEA”) in countries with laws and practices that do not contain equivalent data protection rights for your Personal Data (e.g. Thailand, Colombia). Where such transfers occur, we ensure that appropriate safeguards are in place by ensuring that: a) transfers do not occur without our prior written authority; and b) that an appropriate transfer mechanism, such as Module 2 of the Standard Contractual Clauses (as approved by the European Commission) or an adequacy decision of the European Commission, is in place to protect your Personal Data. If you would like to find out more about any transfers which affect your Personal Data, please contact us by e-mailing dpo@group.holafly.com.

8. Your data protection rights

Right	Further Information
Right of Access	You have the right to request a copy of the Personal Data held by Holafly about you and to access the Personal Data which we hold about you.
Right to Object	You have a right to object at any time to the processing of your Personal Data where Holafly processes your Personal Data on the legal basis of pursuing its legitimate interests.
Right to Rectification	You have the right to have any inaccurate Personal Data which Holafly holds about you updated or corrected.
Right to Erasure	In certain circumstances, you may also have your Personal Data deleted. For example, if you exercise your right to object and Holafly does not have an overriding reason to process your Personal Data or if we no longer require your Personal Data for the purposes as set out in this Notice.
Right to Restriction of Processing	You have the right to ask Holafly to restrict processing your Personal Data in certain cases, including if you believe that the Personal Data that we hold about you is inaccurate or if our use of your Personal Data is unlawful.
Right to Data Portability	You may request Holafly to provide you with your Personal Data which you have given Holafly in a structured, commonly used and machine-readable format.
Right to lodge a complaint	You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or in the place where an alleged infringement occurred. The relevant supervisory authority in Ireland is the Data Protection Commission. For further information see www.dataprotection.ie
Right to Object to Automated Decision-Making, including Profiling	You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning Data Subjects or similarly significantly affects them. We may not be able to comply with this request where the processing is necessary to enter or perform our contract with them or when the processing is authorised under a law to which we are subject.

9. How long do we retain your Personal Data

In general, we will store your Personal Data in accordance with our obligations under applicable Irish and European Union laws and/or for as long as we have a relationship with you plus a reasonable period of time after that. Your Personal Data will be stored as long as necessary in light of the purpose(s) for which it was obtained. The criteria used to determine the retention periods include:

The length of the contractual relationship plus 7.5 years after that from the date of termination;
Whether retention is prudent in light of Holafly's legal position (such as with respect to statutes of limitations, litigation or regulatory investigations);
Whether there is a legal obligation to which Holafly is subject; and/or
6 months for connection history and call recording.

What is the Holafly data retention procedure?

Holafly retains customer data only for as long as necessary to provide the service and comply with legal obligations. Once this period ends, the data is securely deleted or anonymized, in line with GDPR, the world’s strictest privacy regulation, giving customers the highest level of protection.

10. Children’s Personal Data

Holafly understands the importance of safeguarding the Personal Data of children, which we consider to be an individual under the age of 18 in Ireland or the equivalent age as specified by law in your jurisdiction.

Children under the age of 18 years old are prohibited from using Holafly’s services. We do not knowingly collect (or knowingly allow any third party to collect) Personal Data from persons under the age of 18. If we become aware that Personal Data has been collected from a person under the age of 18, we will delete this Personal Data and terminate that individual’s account as quickly as possible.

11. Who should I contact in order to exercise my data protection rights or for any questions relating to my Personal Data?

Holafly has a Data Protection Officer in accordance with applicable laws. If you have any questions about the information detailed in this Notice or would like to exercise your data protection rights, please contact our data protection officer at dpo@group.holafly.com or fill the form located at the end of this page.

12. Updates to this Notice and other information

We will make best efforts to keep this Notice up to date. This Notice will be regularly reviewed and may be amended and updated from time to time as necessary. Any updates to this Notice will be posted to this section of the website.

This Notice is drafted in the English language. In the event that there is a conflict between this English language version of the Notice and any translated copies of the Notice, the English version shall prevail.