PRIVACY POLICY

At Holafly, we are committed to protecting your personal data and always respecting your Privacy. The purpose of this Privacy Policy is to inform you, in a clear and simple manner, about how and for what purpose we process your personal data, as well as your rights under Applicable Data Protection Laws.

“Applicable Data Protection Laws” shall be understood to mean the regulations applicable to the processing of your personal information, depending on your location and our compliance with local regulations in the jurisdiction where you are located, such as the General Data Protection Regulation 2016/679 (“GDPR”); the UK Data Protection Act 2018 (as amended) (“UK DPA”) and the UK GDPR; the Swiss Federal Act on Data Protection of September 25, 2020 (“FADP”); relevant U.S. State comprehensive privacy laws, including without limitation the California Consumer Privacy Act as amended by the California Privacy Rights Act and its implementing regulations (“CCPA”); and other applicable U.S. state privacy laws (“US State Privacy Laws”); and other local applicable data protection and privacy laws as they may be enacted or amended from time to time.

Who is the Data Controller?

Holafly Limited (hereinafter “Holafly”, “we” or “us”) is the Data Controller and responsible for the processing of your personal data to provide you the services identified in this Privacy Policy (the “Policy”). We are a company with a registered address at 6th Floor, 2 Grand Canal Square, Dublin 2, DO2 A342, Ireland with company number 745325.

We have a Data Protection Officer in accordance with Applicable Data Protection Laws, for all data protection rights and queries you can contact our Data Protection Officer at dpo@holafly.com.

This Policy applies to all processing activities carried out by Holafly through the Services identified in this Website, our Application and our Terms and Conditions (“the Services”)

What information do we collect from you?

You should be aware that we may collect different categories of personal data from you:

Identification and contact details: We collect information about you when you sign up for an account, subscribe to our newsletter, or make a purchase via our Services. This may include your name, surname, email address, postal code, home address and other data as requested in the relevant forms. We also collect this information when you interact with us through our customer support channels, such as when you submit complaints and claims, or when you contact us to exercise your data protection rights.

Usage data and user feedback: In addition to the information associated with signing up and contact forms, we process personal data arising from your interactions with our Services, and the performance of our Services. This allows you to access your account login history, technical errors, eSIM download history, data plan, residence, number of orders, or connectivity speed. We also collect information when you post reviews, feedback, or comments directly on our website or through integrated third-party review platforms.

Payment and transactional details: When you decide to purchase any of our products and services, we collect the necessary information to process your transaction and generate invoices. This may include your billing address, selected payment method, currency, and transaction history. Please note that sensitive payment card data is securely handled directly by our authorized third-party payment gateways. Holafly does not hold these sensitive card details.

Service related technical data: Due to the nature of our services, we automatically collect technical information required to provision, activate, and maintain your mobile connectivity. This includes your device model, operating system, unique device identifiers (such as IMSI, EID, IMEI, MSISDN…), network operators, data usage consumption, and connection quality logs.

Marketing and profiling data: If you make a purchase of our Services or accept our tracking cookies, we collect data regarding your product interests. We use this data to perform marketing profiling, which helps us understand your preferences and deliver personalized content, tailored eSIM offers, and targeted advertisements that are most relevant to you**.**

Browser and App Based Activity: We can obtain data such as IP addresses, consent logs and associated timestamps, device identifiers, advertising IDs, events, page views, heatmaps, etc. for measurement, attribution, ad personalisation, fraud prevention purposes. This data can be collected via Cookies or similar technologies. You can look at the different cookies and other tracking devices that may be installed on your device visiting our Cookie Banner. Cookies Policy | Holafly

Are we required to process certain data?

All the fields marked with an asterisk (*) in the forms provided throughout the Services be mandatory, the omission of any of them could lead to the impossibility of us being able to provide the services requested. You must provide truthful information, and it is forbidden to impersonate anyone or to use an alias or anonymous name.

You may not, when providing any information that may be requested from you, choose expressions that are offensive, coinciding with brands, tradenames, names or pseudonyms of public figures or celebrities for whose use you are not authorised.

Do I have any obligations when providing my data?

To ensure that the information provided is always up to date and free of errors, you must notify us as soon as possible of any changes to your personal data by sending a request under the terms of ‘Your Rights’ section of this Policy or, where possible, through the configuration settings of your account.

Likewise, By clicking any of the buttons available within the Services before any data is collected (i.e.: buttons available in forms) , you declare that the data provided is accurate and truthful.

What is the source of my data?

We consider that all the data processed has been provided to us freely.

If the personal data provided belongs to a third party, you guarantee that you have informed this party of this Policy and have obtained their authorisation to provide the data to us for the purposes indicated above. You also guarantee that the information provided is accurate and up to date, and you are responsible for any direct or indirect damage or harm that may be caused because of non-compliance with this obligation.

If you have requested our Services, we may have obtained some of your financial and payment data through our third-party payment gateways or banking providers. For the purpose of market analysis as indicated in this Policy, we may also obtain your feedback data on third-party sites.

As part of our B2B services, we may also have obtained your personal data from your employer or from a third-party company that provides us with your data by virtue of the relationship you have with that company. In such cases, please note that you must continue to accept our Terms and Conditions, insofar as they apply to your relationship with us, and this Policy.

If you are a job applicant or contractor willing to join us, we may have obtained your data from other sources such as professional social networks (e.g. LinkedIn) or agencies specialising in recruitment and selection. To exercise your rights in relation to these sources or to obtain additional information on how we process candidate data, visit our Careers Site Privacy Policy.

How will we use your personal information and what services will we provide you?

We may process your personal data for any of the following purposes, and relying on the following legal bases:

Based on the performance of a contract or to take steps prior to entering into a contract with you

a) We will process your identification and contact details, usage and feedback data and payment details and device and service related data to the extent needed to provide you with the Services subject to this Policy or other services requested by you.

b) We will process your identification, contact details and service related technical data to manage your registration as user our Services, as well as allow your access to private areas for users, allow you to manage the configuration of the panel on the Application and allow you to consult the volume of data contracted and the expiry date of the Service.

c) We will process your identification data and contact details to notify you of any updates on our Terms and Conditions, this Policy or any relevant agreement you are part of, if applicable.

d) To evaluate job applications received and manage recruitment processes under the terms of our Careers Site Privacy Policy.

f) We may process your identification data, contact details, usage data, feedback and service related technical data if needed to resolve any questions, complaints, or incidents that you report to us.

h) We will process your identification data, contact details and payment data to prevent fraud in the use of our Services, according to the Terms and Conditions.

i) We will use your identification data, contact details, payment data and transactional data to carry out the necessary procedures to invoice for our services.

h) We may process your identification data, contact details and transactional data to properly execute our Refund Policy.

Based on a legal obligation

a) We may process the needed data to allow you to exercise your data protection rights. For this purpose, you may use the form available at the end of this Policy.

b) We will process your data to the extent needed to comply with all legal obligations applicable to us (tax, accounting, consumers and other that may apply to our business operations)

c) We may process your data to respond to authorities and regulators requests, if legally required to do so. The categories of data to be disclosed will depend on the request received.

**Based on our legitimate interests or those of a third party: **

a) We will use identification data, contact details and marketing and profiling data to send you commercial communications related to our Services, provided that the content of these communications be of interest to you and you have a contractual relationship in force with us, according to Applicable Data Protection Laws.

b) We may process your identification and contact details and transactional data to carry out periodic reviews of our services and carry out satisfaction surveys to evaluate and improve the quality of the service we provide.

c) From time to time, we may process your identification data, contact details, transactional data and usage data to send you specific surveys to investigate issues relating to the Service, such as connectivity problems, slow connection speeds or similar issues, to enable you to provide us with your feedback or to supply us with information we consider necessary. In any case, answering these questions is voluntary, and you are always free to refuse to answer all or some of them. This enables us to gather very accurate feedback on technical issues with our Services. In any case, we may offer a reward in return for your participation in these surveys.

d) We will process your identification and contact details and transactional data for internal reviews and, if necessary, to contact you if a possible fraud or identity theft is detected or there are well-founded suspicions. We do this in your own interests and to safeguard Holafly’s reputation if such misuse or identity theft could cause harm to third parties.

e) We will process browser and app based activity data since we rely on our legitimate interests to install technical cookies and similar technologies to guarantee the proper functioning of the Services. You can find more information in our Cookie Banner.

f) We process usage data to analyse the use of our Services using limited first party data to adapt and improve our Services to optimize our Services, enhance the user experience with our Services and to ensure the seamless delivery and technical performance of our products when legally allowed to do so.

g) We will use identification data, transactional data, payment data browser and app based activity data to ensure the security of our Services and to combat fraud. To this end, we may put in place the necessary controls and measures to ensure compliance with our terms and conditions and to prevent any potentially fraudulent requests for our services.

h) We may process your identification details and feedback data to carry out market analysis activities comprising the analysis of user opinions and feedback on multiple platforms where Holafly has an active account (Trustpilot, Android, App Store, etc.). We do this so that we can gather feedback from users who share their opinions on third-party sites.

i) We may collect identification data (including your voice), contact data, feedback data and transactional data to record the calls you may have with our Customer Service team so we can ensure the proper training is given to our Customer Service agents, detect improvement opportunities and have better traceability and records of the actions taken in the event of claims or complaints.

j) We may process identification data, contact data, browser and app based activity data and transactional data send you abandoned chart communications, in case we detect your purchase or onboarding process has been interrupted. We may also remember the items you introduced in the chart for a couple of hours so that your request can be reinstated, exactly as you left it

However, if you do not want your personal data to be processed for these purposes, you may object at any time by filling the form available at the end of this Policy.

Based on the explicit, free and unequivocal consent that you give us at the time of collecting your data:

a) We may process browser and app based activity data, and marketing data since we use cookies of various types (functional, analytical, or marketing) to, among other things, analyse your browsing, personalize our services, and share information about your browsing with our third-party partners. You can obtain more information about this processing and these third parties in our Cookie Banner.

b) We may process your identification data and contact details to keep you informed about news, articles, products and services of third parties, always sent through us.

However, if you do not wish your data to be processed for any of these purposes, you may withdraw your consent at any time by filling the form available indicated at the end of this Policy, as indicated at the ‘Your rights’ section of this Policy. You can also withdraw your consent to the use of our cookies using our Cookie Banner or by opting out in the footer of the relevant communication**.**

Do we disclose your data to third parties?

All transfers of personal data that we carry out are necessary for the fulfilment of the above-mentioned purposes, or are carried out to fulfil a legal obligation:

a) To competent public administrations and courts of justice, and to law enforcement agencies in compliance with the legal obligations applicable to us.

b) Companies providing payment services (banks, payment gateways, payment processors, etc.), to enable us to process payment requests for our services and to issue invoices.

c) We have engaged with several trusted vendors (data processors) to provide the Services to you. For instance, they provide us with services such as app/platform hosting, data analytics, CRMs, specific accounting or tax reporting platforms, or direct marketing related services, so they need to access certain data belonging to you. We require all its providers to certify that they have adopted adequate technical and organisational measures to comply with our data protection standards.

d) To our programmatic advertising third party vendors listed in our Cookie Banner. We have signed agreements with many of these partners in which we, as a publisher and/or an advertiser, undertake to inform you about the processing of your personal information, including the purposes of the disclosure of your data to these third parties and the possibility of exercising your data protection rights directly with them or through us. If you exercise your rights of erasure, rectification, or restriction of processing or your right to opt-out sending a direct request to us, we will communicate the content of your request to the relevant partners so they can also properly attend your requests. We may use TC-strings or other mechanisms to notify your requests.

e) To our legal advisors, auditors, accountants and any service provider to the extent necessary to exercise or to defend ourselves against legal actions.

f) To telecommunication service providers for the proper performance and provision of our Services. These third parties act as independent data controllers, and therefore you may exercise your rights before these local operators providing you with internet connection and the services in the destination country. Our network operators only process the minimum technical information required for the service to function, such as the IMSI (International Mobile Subscriber Identity), the MSISDN (mobile number identifier) and the IP addresses used to establish the connection. This information is standard across all mobile services worldwide and is necessary to route traffic and enable connectivity. Our network partners only access the technical data required for connectivity and cannot view details such as names, email addresses, payment information or browsing activity. All communications use end-to-end encryption (HTTPS, SFTP, SSH), ensuring that data remains encrypted during transmission. We apply data minimisation principles and maintain strict agreements with partners to prevent internet traffic from being linked to identifiable individuals.

g) To any company owned by Holafly or within our group for the provision of intragroup services and for day-to-day management and administrative tasks.

h) To our B2B customers, to the extent they visualise or access the data consumed by you within the framework of our Corporate or Business Plans.

In this regard, we inform you that any data communication will be made considering all the necessary legal safeguards. We also guarantee that we sign specific contracts with all our service providers as established by Applicable Data Protection Laws, specifically Article 28 of the GDPR regarding data processing agreements.

Nevertheless, our Services may also include links that redirect you to third-party applications, platforms, and websites. In such cases, we are not responsible for the content of their policies or the processing of your personal information. If you click on links that redirect you to these websites, please read their privacy policies carefully.

Do we disclose your data to third parties located outside the European Economic Area?

Some of our partners, vendors and third parties mentioned in the previous section of this Policy may be located outside the European Economic Area and third countries deemed not adequate by the European Commission. In these cases, we and our partners and vendors guarantee that appropriate safeguards are in place to ensure an equivalent level of protection of your personal data, like the European Commission’s Standard Contractual Clauses. Nevertheless, there may be exceptional situations where we may transfer your data relying on any of the derogations established in Applicable Data Protection Laws, although these will be exceptional situations which we will not usually resort to.

Your rights

For users located in the European Union, United Kingdom, Switzerland or anywhere else globally we inform you that you will be able to exercise the following rights:

1. Rights of access to your personal data to know what data is processed by us and how

2. Right to rectify any inaccurate or incomplete personal data.

3. Right to erase your personal data to the extent permitted by Applicable Data Protection Laws.

4. Right to request limitation of the processing of your personal data when the accuracy, legality or necessity of the data processing is in doubt, in which case, we may retain the data for exercise or defence of claims.

5. Right to object to automated decision making, including profiling.

6. Right to object to the processing of your personal data when the legal basis that enables us to process them is the legitimate interest.

7. The right to the portability of your data, when the legal basis that enables us to process them is the existence of a contractual relationship or your consent.

8. Right to withdraw the consent granted to us.

You may request the exercise of any of the previous rights by filling the form available at the end of this Policy. To this end, please try to specify the scope of your request as precisely as possible (type of data, period, etc.). If fulfilling a particular request is likely to entail unreasonable logistical or operational costs, we may notify you that the response time to your request will be extended by up to two additional months.

Complaints

For users in the United Kingdom: You may also lodge a complaint with the Information Commissioner’s Office of the United Kingdom (www.ico.org.uk) if you believe we have committed a breach of our data protection obligations.

For users located in Switzerland: You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (www.edoeb.admin.ch/en/fdpic).

For users in the European Union or located elsewhere globally: We also inform you that you have the right to file a complaint at the Data Protection Commission (DPC) in Ireland (www.dataprotection.ie) if you believe that we have breached the applicable data protection legislation regarding the processing of your personal data.

Retention periods

We will delete your data once you request its deletion or, when you exercise your right to object or withdraw consent, we no longer have any reason to process it. If you have given us your consent to use our Cookies, you may find the retention period applicable to those cookies in our Cookie Banner.

If you are a registered user with an account in our Services or you have had entered into our Terms and Conditions, you can request the deletion of your account, in which case your data will be permanently deleted, unless there is a legal obligation that requires us to retain, or unless retaining data is necessary to defend ourselves against legal and judicial claims. We may retain economic, financial or payment-related information to comply with our accounting or tax obligations; in such cases, this information will be retained for seven years from the end of the relevant period (tax year, financial year, etc.). Some other data may be retained to demonstrate compliance with our data protection obligations, like activity logs or security events.

If necessary to exercise or defend us against legal action, we will keep your data duly blocked and only available to courts and competent public authorities until the matter pending with the authorities or with you has been resolved.

Security and confidentiality

We are dedicated to the security of your information. In order to prevent unauthorized access or unauthorized disclosure of personal data, we have undertaken appropriate technical and physical measures and management processes to safeguard and secure the information we collect from you.

CCPA Privacy Notice

If you are a data subject residing in California, you may exercise the following rights according to CCPA:

• Right to know / access: You can request the specific pieces of personal information we have about you; and broader information about the processing (purposes, sources, disclosures and/or retention periods applicable).

• Right to correct: You can request the correction of inaccurate personal information.

• Right to delete: You can request deletion of your personal information, provided the erasure does not contradict any law or regulation applicable to us.

• Right to opt out of sale or sharing: You can opt out of the sale or sharing of your personal information, including sharing for cross-context behavioural advertising.

• Right to non-discrimination and non-retaliation: You have the right not to be discriminated against or retaliated against for exercising your privacy rights.

Holafly will also honour your opt-out preference signals indicated in globally recognised frameworks and protocols, like Global Privacy Control or Apple’s App Tracking Transparency, as valid requests to opt out of sale and/or sharing, under CCPA.

Policy update

We do our best to keep our Policy fully updated. If we make changes, they will be clearly identifiable in a conspicuous manner (for example: we may communicate changes to you by email).

This Policy has been reviewed and published as of 22 July 2026