Privacy Policy

PRIVACY NOTICE

Roamly UK Ltd.

Version 1.0 | October 2026

1. Introduction

Roamly UK Ltd. (referred to in this notice as “Roamly UK”, "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store and share your personal information when you use our services, visit our website, or interact with us.

This notice is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.

Roamly UK Ltd is registered with the Information Commissioner’s Office (ICO) under registration number ZC214742. The ICO is the UK’s independent supervisory authority for data protection.

2. Who We Are and How to Contact Us

Roamly is the data controller responsible for the personal data it processes as described in this notice. If you have any questions about how we handle your personal data or wish to exercise your data protection rights, please contact:

Data Protection Contact: Dan Severin

Postal address: 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, WA14 2DT

Email: privacy@roamly.co.uk

Telephone: 0800 023 4567

If you have any questions about how we handle your personal data, or wish to exercise your rights, please contact us using the details above.

3. Personal Data We Collect

Depending on the services you use, we may collect and process the following categories of personal data:

• Identity and Contact Information
  • Full name, date of birth, and gender
  • Postal address, email address, and telephone number
  • Proof of identity and address documents where required
• Insurance and Policy Information
  • Details of the vehicle, property, travel, or other item(s) you wish to insure
  • Policy history, claims history, and previous insurers
  • Driving licence details and vehicle registration (where applicable)
  • Details of any previous convictions or motoring offences declared by you
  • Vehicle usage and telematics data transmitted to us by fleet management software providers (such as Wheelbase Pro) where your policy is arranged as an embedded insurance product (see Section 21 for further detail)
• Financial Information
  • Bank account or payment card details (used solely to process premiums and refunds)
  • Credit history and credit score (where required for premium finance or fraud checks)
• Special Categories of Personal Data
  • Where necessary for the insurance services we provide, we may collect health and medical information relevant to underwriting, administering a policy or assessing a claim. This is special category personal data and is subject to additional safeguards under Article 9 of the UK GDPR.
  • We may also collect information about criminal convictions and offences, including relevant motoring convictions. This information is governed separately by Article 10 of the UK GDPR.
  • We process these types of information only where we have an applicable lawful basis and meet the additional legal conditions described in Section 5.
• Website and Technical Data
  • IP address, browser type and version, time zone setting and location, browser plug-in types and versions
  • Pages visited, paths through the website, and search terms used to find us
  • Cookies and similar tracking technologies (see our Cookie Policy for full details)
• Communications Data
  • Records of telephone calls, emails, live chat, and other correspondence with us
  • Enquiries, complaints, and feedback you submit to us

4. How We Collect Your Personal Data

We collect personal data from the following sources:

• Directly from you — when you request a quote, purchase a policy, make a claim, contact us by telephone or email, complete an online form, or register on our website
• Automated technologies — when you browse our website, we may automatically collect technical and usage data via cookies and similar technologies
• Third parties — including insurance comparison websites, credit reference agencies, fraud prevention databases, and publicly available sources, where permitted by law
• Our principal and insurers — Richdale Brokers and Financial Services Ltd (referred to in this notice also as 'Richdale') and the insurers and underwriters on our panel may share relevant information with us in connection with the arrangement of your insurance
• Fleet management and embedded platform partners — where your insurance is arranged as an embedded product integrated with third-party fleet management software (such as Wheelbase Pro), that platform may transmit vehicle, driver, and usage data to us on your behalf in order to arrange and administer your cover

5. The Legal Basis for Processing Your Data

We process your personal data on the following legal bases under Article 6 of the UK GDPR:

• Contract: Where processing is necessary to perform a contract we have with you, or to take steps at your request before entering into a contract, such as preparing a quotation or arranging and administering insurance services.
• Legal obligation: To comply with our legal and regulatory obligations, including those imposed by the Financial Conduct Authority (FCA), HMRC, and applicable law.
• Legitimate interests: Where necessary for our legitimate business interests, such as fraud prevention, improving our services, and managing our business operations, provided those interests are not overridden by your fundamental rights and freedoms. We have conducted a legitimate interests assessment for these processing activities, which is available on request.
• Consent: Where you have given us your specific and informed consent — for example, for certain marketing communications. You may withdraw consent at any time.

Additional conditions for health and criminal offence information

When processing health information, we rely on an Article 6 lawful basis described above and an additional condition under Article 9 of the UK GDPR.

For health information necessary for insurance purposes, we rely on Article 9(2)(g) and the insurance condition in paragraph 20 of Schedule 1 to the Data Protection Act 2018, where the requirements of that condition are met. Where we instead rely on your explicit consent, we will explain the processing and obtain that consent separately.

For criminal conviction and offence information, we comply with Article 10 of the UK GDPR and rely on paragraph 29 of Schedule 1, Part 2 of the Data Protection Act 2018 (the insurance condition), for the purposes of underwriting, claims handling and fraud prevention, together with Article 6(1)(b) (contract performance) and Article 6(1)(f) (legitimate interests).

Where we use special category or criminal offence information for fraud prevention, we rely on paragraph 10 of Schedule 1, Part 2 of the Data Protection Act 2018 (preventing or detecting unlawful acts, including insurance fraud), and paragraph 29 of Schedule 1, Part 2 (the insurance condition).

We maintain an appropriate policy document where required by law, explaining our safeguards and arrangements for retaining and deleting this information.

6. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide you with insurance quotations and to arrange, administer, and renew your insurance policies
• To process and settle claims made under your policy
• To communicate with you about your policy, including important service and administrative notices
• To verify your identity and assess your eligibility for our products and services
• To carry out credit checks and fraud prevention checks where required
• To comply with our legal, regulatory, and compliance obligations
• To improve our products, services, and website
• To send you marketing communications where we have your consent or a legitimate interest to do so, and where you have not opted out
• To handle complaints and disputes

7. Who We Share Your Data With

We may share your personal data with the following categories of recipients:

• Richdale: As our principal, Richdale has oversight of our activities and may receive relevant personal data for regulatory and compliance purposes.
• Insurers and underwriters: We pass your details to insurers and underwriters on your behalf in order to obtain quotations and effect cover.
• Claims handlers and loss adjusters: Where you make a claim, we may share relevant data with third parties involved in the assessment, management, or settlement of that claim.
• Credit reference and fraud prevention agencies: We may share data with credit reference agencies and fraud prevention organisations (such as the Insurance Fraud Bureau and the Claims and Underwriting Exchange). Information held about you by these agencies may be used in assessing applications for credit and insurance.
• Regulatory authorities: We may disclose data to the FCA, the Information Commissioner's Office (ICO), law enforcement agencies, and other regulatory bodies where required by law or regulation.
• Service providers: We use trusted third-party suppliers (such as IT providers, document management services, and communication platforms) who process data on our behalf under strict data processing agreements.
• Fleet management and embedded platform partners: Where your policy has been arranged through an embedded insurance integration with a third-party fleet management platform (such as Wheelbase Pro), we may share relevant policy, vehicle, and telematics data with that platform to enable the seamless administration of your cover within your fleet management system.
• Professional advisers: Including solicitors, auditors, and accountants, where necessary.

We will never sell your personal data to third parties for marketing purposes.

Where a supplier processes personal data on our behalf as a processor, we require it to act on our documented instructions, maintain appropriate security and comply with applicable contractual and legal requirements.

Other recipients, including insurers and certain platform providers, may act as independent controllers for their own processing. Their use of personal data is explained in their respective privacy notices.

8. International Data Transfers

Your personal data is primarily processed within the United Kingdom. Where we or our service providers transfer personal data outside of the UK to a third country or international organisation, we ensure that appropriate safeguards are in place as required by UK data protection law, such as:

• Transfers to countries with an adequacy decision from the UK Secretary of State
• Use of the UK International Data Transfer Agreement (IDTA) or equivalent approved transfer mechanisms
• Binding corporate rules or other approved safeguards

You can contact privacy@roamly.co.uk for information about the countries to which your personal data is transferred and to obtain a copy of the relevant transfer safeguards, subject to any necessary redactions to protect confidential information.

9. How Long We Keep Your Data

We retain personal data for as long as reasonably necessary for the purpose for which it was collected, taking account of applicable legal and regulatory requirements, the handling of complaints and claims, and the establishment, exercise or defence of legal claims. Our standard retention periods are set out below. Different periods may apply where a particular legal requirement or an ongoing claim, complaint or investigation requires us to retain relevant information for longer.

Data Type Retention Period

• Policy and contract records 7 years from policy expiry
• Claims records 7 years from settlement of claim
• Complaint records 5 years from resolution
• Quotation records (policy not taken out) 1 year from quotation date
• General enquiry data 3 months from date of enquiry
• Website and technical data Up to 2 years
• Marketing consent records Until consent is withdrawn, then 3 years

Once personal data is no longer required, we securely delete it or irreversibly anonymise it. If you opt out of marketing, we may retain the minimum information necessary on a suppression list to ensure that we continue to respect your preference.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right to be informed: To receive clear information about how your personal data is used (as set out in this notice).
• Right of access: To request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: To have inaccurate or incomplete personal data corrected.
• Right to erasure: To request deletion of your personal data in certain circumstances (the "right to be forgotten"). Please note that the right to erasure is not absolute and may be subject to exemptions, for example where we need to retain data for legal or regulatory compliance purposes.
• Right to restrict processing: To ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: To receive a copy of data you have provided to us in a structured, machine-readable format.
• Right to object: To object to processing based on legitimate interests, or to processing for direct marketing purposes.
• Rights relating to automated decisions: Where a decision about you is based solely on automated processing and has a legal or similarly significant effect, you have rights to information about the decision, to make representations, to obtain human intervention and to contest the decision. Further information is provided in Section 20.
• Right to withdraw consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details in Section 2. We will respond within one month of receiving your request. In some cases, we may extend this period by up to two further months where requests are complex or numerous. We may need to verify your identity before processing your request.

11. How We Protect Your Data

We take the security of your personal data seriously and have appropriate technical and organisational measures in place to protect it against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit and at rest
• Access controls and user authentication procedures
• Secure server environments in GDPR/UK GDPR compliant locations
• Regular security reviews and staff data protection training
• Data processing agreements with all third-party suppliers

Although no method of transmitting or storing information can be guaranteed to be completely secure, we implement appropriate technical and organisational measures to protect your personal data. This does not limit our responsibilities under applicable data protection law.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform you of the nature of the breach and the steps we are taking to address it.

12. Marketing Communications

Where you have given us your consent, or where we have a legitimate interest to do so, we may contact you about products and services we offer that may be of interest to you.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us directly at privacy@roamly.co.uk
• Opting out of marketing will not affect the communication of important service or policy-related information.

13. Cookies

Our website uses cookies and similar tracking technologies to improve your experience and to collect information about how you use our site. For full details of the cookies we use, the purposes for which we use them, and how to manage your cookie preferences, please refer to our Cookie Policy, available on our website.

14. Complaints

If you have a complaint about how we collect or use your personal data, please contact privacy@roamly.co.uk or write to the address in Section 2. Please describe your concern and provide enough information for us to investigate it. Let us know if you need assistance to submit your complaint.

We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay and keep you informed of progress. We will explain the outcome and any action we have taken without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO). Our internal complaints process does not restrict that right. You can contact the ICO using the following details:

• Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• Website:www.ico.org.uk

15. Changes to This Privacy Notice

We review and update this Privacy Notice periodically to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will notify you by email or by posting a prominent notice on our website.

The version date at the top of this document indicates when this notice was last updated. The previous version of this notice is available on request. We encourage you to review this notice regularly.

16. Data Protection Contact

We have designated Dan Severin as our contact for questions, requests and complaints about our use of personal data. You can contact him using the following details:

• Data Protection Contact: Dan Severin
• Company: Roamly UK Ltd
• Postal address: 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, WA14 2DT
• Email:privacy@roamly.co.uk

If you have any concerns about how your personal data is handled, please contact us at the above address in the first instance. For independent advice about data protection, privacy, and your rights, you can also contact the Information Commissioner's Office (ICO) at www.ico.org.uk.

17. Your Obligation to Provide Personal Data

Where we collect personal data directly from you, we will make clear at the point of collection whether providing that data is a statutory requirement, a contractual requirement, or a requirement necessary to enter into a contract with us.

In the context of obtaining an insurance quotation or arranging a policy, much of the personal data we request is necessary for us to assess risk and provide you with a quote. If you do not provide the required information, we may be unable to provide you with a quotation or arrange cover on your behalf.

Where providing personal data is optional — for example, for marketing communications — we will make this clear and there will be no consequence for declining to provide it.

Where we rely on legitimate interests as the legal basis for processing, we will always carry out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request details of our legitimate interests assessment by contacting us.

18. Fraud Prevention and Industry Databases

In order to prevent and detect insurance fraud, we and the insurers we work with may search and share information with the following fraud prevention and industry databases:

Claims and Underwriting Exchange (CUE): A central database of motor, home, personal injury and travel insurance incidents reported to insurers. We may search and record data on CUE when you obtain a quotation or make a claim.

Insurance Fraud Bureau (IFB): An industry body that facilitates the sharing of information to combat organised and opportunistic insurance fraud.

CIFAS: A not-for-profit fraud prevention membership organisation. We may check and record data with CIFAS where we suspect fraud or need to verify identity.

Motor Insurance Database (MID): A central record of all insured vehicles in the UK. Where we arrange motor insurance, details of your vehicle and policy will be registered on the MID as required by law.

Hunter: An insurance application fraud detection database. We may search Hunter when you apply for a policy to identify and prevent fraudulent applications.

If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies and may be accessed by law enforcement agencies. This information may be used by us and other organisations to prevent fraud and money laundering, and to verify your identity. Your data may also be used for other purposes permitted by law.

A record of any fraud or attempted fraud will be retained for a period of up to six years. If you would like further details on how information held by these agencies may be used, please contact us.

19. Our Relationship with Richdale

Roamly UK Ltd is an appointed representative of Richdale Brokers and Financial Services Ltd (Richdale).

We share relevant personal data with Richdale so that it can supervise our activities, monitor compliance, investigate complaints and meet its legal and regulatory responsibilities.

For these purposes, Roamly and Richdale act as independent controllers, each responsible for its own use of personal data and compliance with applicable data protection law.

Further information about Richdale’s processing and how to exercise your rights in relation to it is available in Richdale’s privacy notice at www.richdale.co.uk. You may also contact us at privacy@roamly.co.uk for assistance in directing your request to the appropriate organisation.

20. Automated Decision-Making and Profiling

Roamly may use automated individual decision-making when handling your personal data. This means decisions may be made solely by automated means, without human involvement. We may also use profiling, which involves the automated processing of personal data to evaluate certain aspects of an individual.

Some insurers and underwriters use automated systems to assess insurance applications, determine eligibility for cover and calculate premiums. These systems may analyse information such as your age, location, vehicle details and claims history and, where relevant to the product, telematics information. Their assessment may affect whether cover is offered and its price or terms.

The relevant insurer’s privacy information explains its processing, including the information used, how its automated assessment works and the likely consequences for you. We will identify the relevant insurer and provide access to that information when arranging your cover.

Where a decision is based solely on automated processing and has a legal or similarly significant effect, you can request information about it, make representations, obtain human intervention and contest the decision.

You may exercise these rights directly with the relevant insurer or contact privacy@roamly.co.uk so that we can assist you.

21. Telematics and Usage-Based Insurance Data

Some of the insurance products we offer may include or be linked to telematics technology — devices or applications that collect data about how a vehicle is used. This section explains how such data is collected and processed where telematics is a feature of your policy.

What Telematics Data We Collect

Where a telematics device or mobile application is used in connection with your policy, the following types of data may be collected:

• Vehicle location (GPS data), journey start and end points, and routes taken
• Speed, acceleration, braking, and cornering behaviour
• Time and distance of journeys
• Device and application usage data
• Vehicle identification data
• Mileage and journey data used to calculate per-mile insurance premiums, where your policy is priced on a pay-as-you-drive or per-mile basis

How Telematics Data Is Used

Telematics data is used for the following purposes:

• To assess driving behaviour and calculate or adjust insurance premiums
• To assess and process claims, including verifying the circumstances of an incident
• To provide you with feedback on your driving
• To detect and prevent fraud
• To comply with legal and regulatory obligations

Legal Basis for Processing Telematics Data

We process telematics data on the basis of contract performance (to administer your policy), legitimate interests (fraud prevention and risk assessment), and where required, your consent. Location data is only collected where it is necessary for the insurance product you have purchased and you have been clearly informed of this at the point of sale.

Sharing of Telematics Data

Telematics data may be shared with the insurer underwriting your policy, claims handlers, and fraud prevention bodies as described in Sections 7 and 18. Where your policy is arranged as an embedded product integrated with a third-party fleet management platform (such as Wheelbase Pro), relevant telematics and usage data may also be shared with that platform to enable the seamless administration of your cover within your fleet management system. It will not be sold to or shared with third parties for marketing purposes. Where a telematics device or fleet management platform is provided by a third-party hardware or software provider, that provider will process data on our behalf, or as an independent controller in respect of its own platform, under an appropriate data processing or data sharing agreement.

Retention of Telematics Data

We apply different retention periods to raw location and journey information and to records needed to administer your insurance.

Raw GPS and detailed journey data are retained for 12 months from the date of the journey, because raw location data is needed for claims verification and fraud prevention during the active policy period but is not required beyond that for routine administration.

Derived information used to calculate premiums or administer your policy, such as mileage totals and driving scores, is retained for 7 years from policy expiry, in line with our standard policy record retention period.

Where particular telematics records are necessary for a claim, complaint, fraud investigation or legal proceedings, we may retain those records for longer, for as long as reasonably necessary for that purpose.

We may retain information for statistical analysis after it has been irreversibly anonymised so that individuals are no longer identifiable. Information that remains identifiable, including identifiable aggregated information, remains subject to our data protection and retention requirements.

22. Change of Business Ownership and Control

We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control. Personal data as well as any other form of data provided by you will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Notice, be permitted to use such data for the purposes it was originally provided to us.

We may also disclose such data to a prospective purchaser of our business or any part of it. In the above instances, we will take steps with the aim of ensuring that your privacy is protected.