Version 1.0 • Effective date: [DATE] • Draft for legal and operational review
This policy explains how Voya handles personal data across the website, eSIM marketplace, mobile applications, support and partner program.
1. Introduction and Scope
This Privacy Policy describes how [FULL REGISTERED UAE LEGAL ENTITY NAME] ("Voya", "Voyaroam", "we", "us") collects, uses, discloses, stores and protects personal data when individuals visit [WEBSITE DOMAIN], use our eSIM marketplace, mobile applications or customer support, or apply for and operate a Voya Partner account. The policy applies to customers, visitors, partner applicants, partner representatives and end users whose details partners provide. The applicable entity, business address, license details and privacy contact must be completed before publication.
2. Roles and Responsibility
Voya may act as a controller of personal data for account administration, marketing, payments, security, compliance and direct customer relationships. In certain partner fulfillment arrangements, Voya and the partner may each be independent controllers or one party may process data on behalf of the other, depending on the actual service and contract. Any processor arrangement must be documented in a separate data processing agreement.
3. Personal Data We Collect
Account and identity: name, email, mobile number, country, account identifiers, authentication credentials stored securely as hashes, login and verification records. Partner application: first and last name, company name, website, industry, country of operation, monthly customer volume, primary customer segment, business contact information and supporting due-diligence documents where required. Transaction data: orders, eSIM plan, price, discounts, payments, refunds, billing and transaction references; we do not claim to store full payment-card numbers. eSIM and service data: ICCID, activation and installation status, plan allocation, usage and consumption, service country, network and technical diagnostics, as available from connectivity providers. Device and usage data: IP address, browser, device identifiers, pages visited, timestamps, cookies and approximate location inferred from IP. Support and communication data: messages, complaints, feedback and correspondence. Where partners upload end-user details for fulfillment, only necessary recipient data should be requested.
4. How We Use Personal Data
We use personal data to create and secure accounts; evaluate and onboard partners; provide eSIM orders, delivery, activation, top-ups and support; process payments and refunds; calculate partner checkout discounts and maintain settlement records; communicate service and security notices; prevent fraud and abuse; comply with applicable legal and regulatory obligations; improve our platform and service quality; and send optional marketing communications where permitted. We do not sell personal data.
5. Legal Grounds and Transparency
Depending on applicable law and context, processing may be necessary to perform a contract, comply with a legal obligation, pursue legitimate business interests where legally available, or rely on consent where required (including certain marketing and non-essential cookies). Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, Voya will identify and document the appropriate lawful basis and any applicable exemptions. Other local laws may apply to customers in other countries.
7. International Data Transfers
Our customers, connectivity suppliers and technology vendors may operate internationally. Where personal data is transferred outside its country of collection, we assess applicable transfer restrictions and use appropriate legal safeguards, contractual protections and security measures as required. Specific transfer mechanisms and locations should be confirmed in the final operational data map.
8. Retention and Deletion
We retain personal data only as long as reasonably necessary for the purposes above, including active accounts, fulfillment, disputes, security, tax, accounting and other legal obligations. Retention periods vary by category and jurisdiction and should be documented in an internal retention schedule. At the end of the applicable period, we delete, anonymize or securely archive data as appropriate. Backups may expire on separate controlled cycles.
9. Security
We use reasonable technical and organizational measures, such as access controls, encryption in transit where appropriate, secure credential storage, monitoring and staff access restrictions. No online system is completely secure. Users should protect their passwords and report suspected account compromise promptly.
10. Your Privacy Rights
Subject to applicable law and exceptions, individuals may request access to their personal data, correction, deletion, restriction or cessation of certain processing, portability where applicable, and withdrawal of consent without affecting prior lawful processing. Individuals may object to marketing at any time. Requests may require identity verification and may be limited where retention is legally necessary. Submit requests to [PRIVACY CONTACT EMAIL].
11. Marketing Preferences
We may send transactional and service messages required to operate your account. Promotional messages are sent where permitted by law and with consent where required. Marketing emails should contain an unsubscribe method; opting out of marketing does not stop essential service notices.
13. Children
Our platform and partner registration are intended for adults and businesses. We do not knowingly solicit personal data directly from children. Where a service involves minors, appropriate parental or guardian authorization and other legally required protections must be implemented.
14. Third-Party Sites and Services
Links to third-party websites and integrations are governed by those third parties’ own notices and terms. We encourage users to review them before sharing information.
15. Changes to this Policy
We may update this Policy to reflect changes in services, technology or law. The updated version will be posted with a revised effective date. Where required, we will give additional notice or obtain consent.
16. Contact and Complaints
Privacy contact: [PRIVACY CONTACT EMAIL]. Registered entity: [FULL LEGAL NAME]. Address: [REGISTERED UAE BUSINESS ADDRESS]. Website: [WEBSITE DOMAIN]. Individuals may also raise complaints with a competent data protection authority where permitted under applicable law.