Privacy Policy

Last updated: 1 April 2026

1. Introduction

EchoRoam Global Ltd. ("EchoRoam," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you visit our website, use our mobile applications, purchase eSIM plans, or otherwise interact with our services.

We are an Australian company (ABN 12 345 678 901) and we comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We also recognise the privacy rights of our international customers and comply with applicable data protection regulations, including the European General Data Protection Regulation (GDPR) where relevant.

By using our Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Services. We encourage you to read this policy carefully and to contact us if you have any questions about our data practices.

2. Information We Collect

We collect several categories of personal information to provide and improve our eSIM travel services:

Personal Information

• Account details: Your full name, email address, phone number (optional), and password when you create an account.
• Billing information: Your billing name, billing address, and payment method details. Note that we do not store full credit card numbers; these are processed securely by our PCI-DSS compliant payment partners.
• Identity verification: In some cases, we may request identity verification documents to comply with regulatory requirements or prevent fraud, particularly for large or suspicious orders.

Device & Technical Information

• Device information: Device type, model, operating system and version, eSIM capability status, and unique device identifiers. This information is necessary to ensure compatibility with our eSIM profiles and to troubleshoot technical issues.
• Network data: IP address, network type (5G, 4G, 3G), approximate location (country and city level based on IP or network data), and connection timestamps. This data helps us route you to the best available network and monitor service quality.

Usage Data

• Service usage: Data consumption, activation dates, plan details, connection logs, and roaming partner networks used. This information helps us manage your service and ensure fair use across our network.
• Website and app usage: Pages visited, features used, click patterns, session duration, and referral sources. We use this data to understand how customers interact with our platform and to improve our services.
• Communication data: Records of correspondence with our support team, including email content, chat transcripts, and support ticket details.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To process your eSIM purchases, deliver QR codes and activation instructions, activate and manage your eSIM profiles, provide customer support, and ensure the reliable operation of our services.
• Account management: To create and maintain your account, authenticate your identity, process transactions, and communicate account-related updates such as order confirmations, plan expiry reminders, and security alerts.
• Communications: To send you service-related notifications, respond to your enquiries, deliver marketing communications (with your consent), and inform you about new features, plans, or promotions that may be relevant to your travel needs.
• Service improvement: To analyse usage patterns, identify trends, conduct research and analytics, troubleshoot technical issues, detect and prevent fraud, and improve our website, app, and overall service quality.
• Legal compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests, and to protect our rights, privacy, safety, or property, as well as that of our customers and the public.

We will only use your personal information for the purposes for which it was collected, or for a purpose that is directly related and reasonably expected. Where we need to use your information for an unrelated purpose, we will seek your consent or otherwise comply with applicable privacy laws.

4. Data Sharing

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information in the following circumstances:

• Network operators: We share limited device and account information with our partner mobile network operators around the world to provision and activate your eSIM service. This may include your device identifiers, eSIM profile details, and the country of use. These operators are contractually obligated to protect your data.
• Payment processors: We share transaction data with our payment processing partners (such as Stripe) to process your payments securely. These partners are PCI-DSS certified and bound by strict data protection agreements.
• Service providers: We may share information with trusted third-party service providers who assist us in operating our business, such as cloud hosting providers, email service providers, analytics platforms, and customer support tools. These providers are required to process data only as instructed by us and in compliance with applicable privacy laws.
• Legal requirements: We may disclose your information if required to do so by law, in response to a valid legal request (such as a subpoena or court order), or when we believe in good faith that disclosure is necessary to protect our rights or the safety of others.

5. Data Storage & Security

EchoRoam stores your personal information on secure, Australian-hosted servers provided by leading cloud infrastructure providers. We have implemented robust technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction.

Our security measures include industry-standard encryption (AES-256 for data at rest, TLS 1.3 for data in transit), secure access controls with multi-factor authentication for internal systems, regular security audits and penetration testing, network firewalls and intrusion detection systems, and comprehensive logging and monitoring of access to personal data.

While we take every reasonable precaution to protect your information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in serious harm to individuals, we will notify affected users and the relevant regulatory authorities as required by Australian law and applicable international regulations.

6. Cookies & Tracking

Our website and mobile applications use cookies and similar tracking technologies to enhance your browsing experience, analyse traffic, and understand how our services are used. Cookies are small text files placed on your device that help us remember your preferences and improve functionality.

For a detailed explanation of the cookies we use, their purposes, and how you can manage your cookie preferences, please refer to our Cookie Policy. You can control and manage cookies through your browser settings and opt out of non-essential cookies at any time.

7. Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information:

• Right of access: You have the right to request a copy of the personal information we hold about you.
• Right to correction: You have the right to request correction of any inaccurate or incomplete personal information.
• Right to deletion: You may request the deletion of your personal information, subject to legal retention requirements and legitimate business needs.
• Right to data portability: Where technically feasible, you may request your personal data in a structured, commonly used, and machine-readable format.
• Right to withdraw consent: Where we rely on your consent to process your data, you may withdraw that consent at any time.
• Right to object: You may object to certain types of data processing, including direct marketing and profiling.

For customers in the European Economic Area (EEA), we comply with the GDPR. EEA residents have the right to lodge a complaint with their local supervisory authority if they believe our processing of their personal data violates the GDPR. Our designated Data Protection Officer can be reached at [email protected].

To exercise any of these rights, please contact us at [email protected] or through the privacy settings in your account. We will respond to all legitimate requests within 30 days, or within the timeframe required by applicable law.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Specific retention periods include:

• Active account data: Retained for the duration of your account and for up to 2 years after your last interaction with our Services.
• Transaction records: Retained for 7 years to comply with Australian tax and financial record-keeping requirements.
• eSIM usage data: Retained for the duration of the active plan and for up to 12 months after plan expiry for troubleshooting and customer support purposes.
• Support communications: Retained for 3 years after the resolution of your enquiry.
• Marketing data: Retained until you withdraw consent or unsubscribe from marketing communications.

When data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures.

9. Children's Privacy

Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If we discover that we have inadvertently collected personal information from a child under 16, we will take immediate steps to delete that information from our systems.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected] and we will take appropriate action to remove the information.

10. International Data Transfers

As a global eSIM provider, your data may be transferred to and processed in countries other than your own. EchoRoam is based in Australia, and our primary data storage is on Australian servers. However, to deliver our services, your information may be transferred to:

• Partner mobile network operators in the countries where your eSIM is activated, for the purpose of providing connectivity services.
• Service providers located in the United States, European Union, or other jurisdictions for the purposes of cloud hosting, payment processing, analytics, and customer support.

When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission, adherence to the Australia-EU privacy framework, and contractual obligations requiring our partners to maintain data protection standards equivalent to Australian requirements. For transfers from the EEA to countries without an adequacy decision, we rely on standard contractual clauses or other approved transfer mechanisms.

11. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending an email notification or displaying a notice on our website.

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes take effect constitutes your acceptance of the revised policy. If you have questions about a change, please contact our privacy team.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy Email: [email protected]
• General Support: [email protected]
• Contact Form: Contact Page
• Address: Level 12, 123 George Street, Sydney NSW 2000, Australia

We aim to respond to all privacy-related enquiries within 5 business days. For matters requiring a formal response under privacy legislation, we will acknowledge your request within 5 business days and provide a substantive response within 30 days.