Privacy Policy

PRIVACY NOTICE

Roamly UK Ltd.

Version 1.0 | June 2026

1. Introduction

Roamly UK Ltd. (referred to in this notice as “Roamly UK”, "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store and share your personal information when you use our services, visit our website, or interact with us.

This notice is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.

2. Who We Are and How to Contact Us

Roamly UK is the data controller responsible for your personal data.

Roamly UK
Data Protection Contact: Dan Severin
3rd Floor, 1 Ashley Road
Altrincham, Cheshire, WA14 2DT
Email: privacy@roamly.co.uk
Telephone: 0800 023 4567

If you have any questions about how we handle your personal data, or wish to exercise your rights, please contact us using the details above.

3. Personal Data We Collect

Depending on the services you use, we may collect and process the following categories of personal data:

3.1 Identity and Contact Information

• Full name, date of birth, and gender
• Postal address, email address, and telephone number
• Proof of identity and address documents where required

3.2 Insurance and Policy Information

• Details of the vehicle, property, travel, or other item(s) you wish to insure
• Policy history, claims history, and previous insurers
• Driving licence details and vehicle registration (where applicable)
• Details of any previous convictions or motoring offences declared by you
• Vehicle usage and telematics data transmitted to us by fleet management software providers (such as Wheelbase Pro) where your policy is arranged as an embedded insurance product (see Section 21 for further detail)

3.3 Financial Information

• Bank account or payment card details (used solely to process premiums and refunds)
• Credit history and credit score (where required for premium finance or fraud checks)

3.4 Special Categories of Personal Data

In some circumstances we may need to collect special category data as defined under the UK GDPR. This may include:

• Health and medical information (for example, where it is relevant to a claim or to the assessment of risk for a policy)
• Criminal convictions and offences (for the purpose of underwriting assessment)

We will only process such data where we have a lawful basis to do so, as described in Section 5 below.

3.5 Website and Technical Data

• IP address, browser type and version, time zone setting and location, browser plug-in types and versions
• Pages visited, paths through the website, and search terms used to find us
• Cookies and similar tracking technologies (see our Cookie Policy for full details)

3.6 Communications Data

• Records of telephone calls, emails, live chat, and other correspondence with us
• Enquiries, complaints, and feedback you submit to us

4. How We Collect Your Personal Data

We collect personal data from the following sources:

• Directly from you — when you request a quote, purchase a policy, make a claim, contact us by telephone or email, complete an online form, or register on our website
• Automated technologies — when you browse our website, we may automatically collect technical and usage data via cookies and similar technologies
• Third parties — including insurance comparison websites, credit reference agencies, fraud prevention databases, and publicly available sources, where permitted by law
• Our principal and insurers — Richdale Brokers and Financial Services Ltd and the insurers and underwriters on our panel may share relevant information with us in connection with the arrangement of your insurance
• Fleet management and embedded platform partners — where your insurance is arranged as an embedded product integrated with third-party fleet management software (such as Wheelbase Pro), that platform may transmit vehicle, driver, and usage data to us on your behalf in order to arrange and administer your cover

5. The Legal Basis for Processing Your Data

We process your personal data on the following legal bases under Article 6 of the UK GDPR:

• Contract: To perform our contract with you — for example, arranging and administering your insurance policy, handling renewals, and processing claims.
• Legal obligation: To comply with our legal and regulatory obligations, including those imposed by the FCA, HMRC, and applicable law.
• Legitimate interests: Where necessary for our legitimate business interests, such as fraud prevention, improving our services, and managing our business operations, provided those interests are not overridden by your fundamental rights and freedoms. We have conducted a legitimate interests assessment for these processing activities, which is available on request.
• Consent: Where you have given us your specific and informed consent — for example, for certain marketing communications. You may withdraw consent at any time.

Where we process special categories of personal data, we rely on the following additional conditions under Article 9 of the UK GDPR:

• Substantial public interest (Schedule 1 of the Data Protection Act 2018) — for insurance purposes and fraud prevention
• Explicit consent — where we have asked for and received your explicit consent to process such data

6. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide you with insurance quotations and to arrange, administer, and renew your insurance policies
• To process and settle claims made under your policy
• To communicate with you about your policy, including important service and administrative notices
• To verify your identity and assess your eligibility for our products and services
• To carry out credit checks and fraud prevention checks where required
• To comply with our legal, regulatory, and compliance obligations
• To improve our products, services, and website
• To send you marketing communications where we have your consent or a legitimate interest to do so, and where you have not opted out
• To handle complaints and disputes

7. Who We Share Your Data With

We may share your personal data with the following categories of recipients:

• Richdale Brokers and Financial Services Ltd: As our principal, Richdale has oversight of our activities and may receive relevant personal data for regulatory and compliance purposes.
• Insurers and underwriters: We pass your details to insurers and underwriters on your behalf in order to obtain quotations and effect cover.
• Claims handlers and loss adjusters: Where you make a claim, we may share relevant data with third parties involved in the assessment, management, or settlement of that claim.
• Credit reference and fraud prevention agencies: We may share data with credit reference agencies and fraud prevention organisations (such as the Insurance Fraud Bureau and the Claims and Underwriting Exchange). Information held about you by these agencies may be used in assessing applications for credit and insurance.
• Regulatory authorities: We may disclose data to the FCA, the Information Commissioner's Office (ICO), law enforcement agencies, and other regulatory bodies where required by law or regulation.
• Service providers: We use trusted third-party suppliers (such as IT providers, document management services, and communication platforms) who process data on our behalf under strict data processing agreements.
• Fleet management and embedded platform partners: Where your policy has been arranged through an embedded insurance integration with a third-party fleet management platform (such as Wheelbase Pro), we may share relevant policy, vehicle, and telematics data with that platform to enable the seamless administration of your cover within your fleet management system.
• Professional advisers: Including solicitors, auditors, and accountants, where necessary.

We will never sell your personal data to third parties for marketing purposes.

We require all third parties to whom we disclose your personal data to respect its security and to treat it in accordance with applicable law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

8. International Data Transfers

Your personal data is primarily processed within the United Kingdom. Where we or our service providers transfer personal data outside of the UK to a third country or international organisation, we ensure that appropriate safeguards are in place as required by UK data protection law, such as:

• Transfers to countries with an adequacy decision from the UK Secretary of State
• Use of the UK International Data Transfer Agreement (IDTA) or equivalent approved transfer mechanisms
• Binding corporate rules or other approved safeguards

9. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes set out in this notice and to comply with our legal obligations. Our standard retention periods are:

Data Type Retention Period

Policy and contract records 7 years from policy expiry (FCA requirement)

Claims records 7 years from settlement of claim

Complaint records 5 years from resolution (FCA requirement)

Quotation records (policy not taken out) 1 year from quotation date

General enquiry data 3 months from date of enquiry

Website and technical data Up to 2 years

Marketing consent records Until consent is withdrawn, then 3 years

After the applicable retention period, your data will be securely deleted or anonymised.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right to be informed: To receive clear information about how your personal data is used (as set out in this notice).
• Right of access: To request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: To have inaccurate or incomplete personal data corrected.
• Right to erasure: To request deletion of your personal data in certain circumstances (the "right to be forgotten").
• Please note that the right to erasure is not absolute and may be subject to exemptions, for example where we need to retain data for legal or regulatory compliance purposes.
• Right to restrict processing: To ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: To receive a copy of data you have provided to us in a structured, machine-readable format.
• Right to object: To object to processing based on legitimate interests, or to processing for direct marketing purposes.
• Rights related to automated decision-making: Not to be subject to a decision based solely on automated processing where this has a significant effect on you.
• Right to withdraw consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details in Section 2. We will respond within one month of receiving your request. In some cases, we may extend this period by up to two further months where requests are complex or numerous. We may need to verify your identity before processing your request.

11. How We Protect Your Data

We take the security of your personal data seriously and have appropriate technical and organisational measures in place to protect it against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit and at rest
• Access controls and user authentication procedures
• Secure server environments in GDPR/UK GDPR compliant locations
• Regular security reviews and staff data protection training
• Data processing agreements with all third-party suppliers

While we take all reasonable steps to protect your data, no transmission of data over the internet can be guaranteed to be completely secure. You provide data at your own risk, and we cannot guarantee the security of information transmitted to us electronically.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform you of the nature of the breach and the steps we are taking to address it.

12. Marketing Communications

Where you have given us your consent, or where we have a legitimate interest to do so, we may contact you about products and services we offer that may be of interest to you.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us directly at privacy@roamly.co.uk

Opting out of marketing will not affect the communication of important service or policy-related information.

13. Cookies

Our website uses cookies and similar tracking technologies to improve your experience and to collect information about how you use our site. For full details of the cookies we use, the purposes for which we use them, and how to manage your cookie preferences, please refer to our Cookie Policy, available on our website.

14. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us in the first instance using the details in Section 2 so that we can attempt to resolve the matter.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):

Information Commissioner's Office

Wycliffe House, Water Lane,

Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

15. Changes to This Privacy Notice

We review and update this Privacy Notice periodically to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will notify you by email or by posting a prominent notice on our website.

The version date at the top of this document indicates when this notice was last updated. The previous version of this notice is available on request. We encourage you to review this notice regularly.

16. Data Protection Officer

Roamly UK is not currently required under UK GDPR to appoint a Data Protection Officer (DPO). However, we take our data protection obligations seriously and have designated a point of contact for all data protection matters.

Data Protection Contact: Dan Severin

Roamly UK

3rd Floor, 1 Ashley Road,

Altrincham, Cheshire, WA14 2DT

Email: privacy@roamly.co.uk

If you have any concerns about how your personal data is handled, please contact us at the above address in the first instance. For independent advice about data protection, privacy, and your rights, you can also contact the Information Commissioner's Office (ICO) at www.ico.org.uk.

17. Your Obligation to Provide Personal Data

Where we collect personal data directly from you, we will make clear at the point of collection whether providing that data is a statutory requirement, a contractual requirement, or a requirement necessary to enter into a contract with us.

In the context of obtaining an insurance quotation or arranging a policy, much of the personal data we request is necessary for us to assess risk and provide you with a quote. If you do not provide the required information, we may be unable to provide you with a quotation or arrange cover on your behalf.

Where providing personal data is optional — for example, for marketing communications — we will make this clear and there will be no consequence for declining to provide it.

Where we rely on legitimate interests as the legal basis for processing, we will always carry out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request details of our legitimate interests assessment by contacting us.

18. Fraud Prevention and Industry Databases

In order to prevent and detect insurance fraud, we and the insurers we work with may search and share information with the following fraud prevention and industry databases:

• Claims and Underwriting Exchange (CUE): A central database of motor, home, personal injury and travel insurance incidents reported to insurers. We may search and record data on CUE when you obtain a quotation or make a claim.
• Insurance Fraud Bureau (IFB): An industry body that facilitates the sharing of information to combat organised and opportunistic insurance fraud.
• CIFAS: A not-for-profit fraud prevention membership organisation. We may check and record data with CIFAS where we suspect fraud or need to verify identity.
• Motor Insurance Database (MID): A central record of all insured vehicles in the UK. Where we arrange motor insurance, details of your vehicle and policy will be registered on the MID as required by law.
• Hunter: An insurance application fraud detection database. We may search Hunter when you apply for a policy to identify and prevent fraudulent applications.

If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies and may be accessed by law enforcement agencies. This information may be used by us and other organisations to prevent fraud and money laundering, and to verify your identity. Your data may also be used for other purposes permitted by law.

A record of any fraud or attempted fraud will be retained for a period of up to six years. If you would like further details on how information held by these agencies may be used, please contact us.

19. Joint Controller Arrangements

As an Appointed Representative, certain processing activities — particularly those relating to regulatory compliance, oversight, and supervision — are carried out jointly between Roamly UK and Richdale Brokers and Financial Services Ltd. Where this is the case, both parties act as joint controllers under Article 26 of the UK GDPR.

An arrangement is in place between Roamly UK and Richdale Brokers and Financial Services Ltd that sets out the respective responsibilities of each party in relation to joint processing activities, including how data subject rights requests are handled and how individuals are informed about the processing.

You may exercise your UK GDPR rights against either party. Regardless of any internal arrangement, you retain all rights set out in Section 10 of this notice. If you have a question about joint processing, please contact us at privacy@roamly.co.uk.

20. Automated Decision-Making and Profiling

Some of the insurers and underwriters we work with use automated processes to assess risk and determine insurance premiums. This may involve profiling — the automated analysis of your personal data (such as your age, location, claims history, and the item being insured) to evaluate certain aspects of your risk profile.

Where a decision is made solely by automated means and produces a legal or similarly significant effect on you (for example, a refusal of cover or a significant change in premium), you have the right under Article 22 of the UK GDPR to:

• Request human review of the automated decision
• Express your point of view
• Contest the decision

If you believe an automated decision has been made about you and you wish to challenge it, please contact us at privacy@roamly.co.uk. We will liaise with the relevant insurer on your behalf.

21. Telematics and Usage-Based Insurance Data

Some of the insurance products we offer may include or be linked to telematics technology — devices or applications that collect data about how a vehicle is used. This section explains how such data is collected and processed where telematics is a feature of your policy.

21.1 What Telematics Data We Collect

Where a telematics device or mobile application is used in connection with your policy, the following types of data may be collected:

• Vehicle location (GPS data), journey start and end points, and routes taken
• Speed, acceleration, braking, and cornering behaviour
• Time and distance of journeys
• Device and application usage data
• Vehicle identification data
• Mileage and journey data used to calculate per-mile insurance premiums, where your policy is priced on a pay-as-you-drive or per-mile basis

21.2 How Telematics Data Is Used

Telematics data is used for the following purposes:

• To assess driving behaviour and calculate or adjust insurance premiums
• To assess and process claims, including verifying the circumstances of an incident
• To provide you with feedback on your driving
• To detect and prevent fraud
• To comply with legal and regulatory obligations

21.3 Legal Basis for Processing Telematics Data

We process telematics data on the basis of contract performance (to administer your policy), legitimate interests (fraud prevention and risk assessment), and where required, your consent. Location data is only collected where it is necessary for the insurance product you have purchased and you have been clearly informed of this at the point of sale.

21.4 Sharing of Telematics Data

Telematics data may be shared with the insurer underwriting your policy, claims handlers, and fraud prevention bodies as described in Sections 7 and 18. Where your policy is arranged as an embedded product integrated with a third-party fleet management platform (such as Wheelbase Pro), relevant telematics and usage data may also be shared with that platform to enable the seamless administration of your cover within your fleet management system. It will not be sold to or shared with third parties for marketing purposes. Where a telematics device or fleet management platform is provided by a third-party hardware or software provider, that provider will process data on our behalf, or as an independent controller in respect of its own platform, under an appropriate data processing or data sharing agreement.

21.5 Retention of Telematics Data

Telematics data will be retained for the duration of your policy and for a period of up to 7 years thereafter, in line with our standard policy record retention period. Raw journey data may be retained in anonymised or aggregated form for longer periods for statistical analysis.

Roamly UK | Appointed Representative of Richdale Brokers and Financial Services Ltd (FRN: 769876)