Privacy Policy

1. Who we are

Roamr Work Limited ("Roamr", "we", "us") is a company incorporated in Ireland with company number 744333 and registered office at Tanavalla House, Newtown, Cahir, Co. Tipperary, E21 NV34, Ireland. We are the data controller for the processing described in this notice, except where we say otherwise.

Roamr operates a platform through which people travelling for work arrange and pay for accommodation with hosts they invite, instead of staying in a hotel.

This notice explains what personal data we collect, why we collect it, who we share it with, and the rights you have. It applies to our website, our platform, and the emails and messages we send.

Data protection contact: privacy@roamr.com
General enquiries: support@roamr.com
Postal: Data Protection Lead, Roamr Work Limited, Tanavalla House, Newtown, Cahir, Co. Tipperary, E21 NV34, Ireland
‍

2. Who this notice is about

We process personal data about four groups of people. Your rights are the same in each case, but what we hold and why differs.

Travellers. Employees, contractors and other people authorised by an employer to use Roamr for work travel. Where your employer has a contract with us, your employer decides that you may use Roamr and for what purpose — in data protection terms your employer is the controller and we act as its processor. For your Roamr account itself, and for the rewards we pay you, we are the controller.

Hosts. People who accept an invitation to provide accommodation. For Host personal data we are the controller in our own right, not a processor acting for anyone's employer.

Visitors to our website. Including people who use the savings calculator or request a demonstration.

Business contacts. People at current and prospective customer organisations, and administrators who manage an employer's Roamr account.
‍

3. What we collect

3.1 Everyone with an account

• Name, email address and phone number, including a WhatsApp number where you give us one
• Job title and the employer you are associated with
• Account credentials and authentication data, including sign-in through Google or LinkedIn, or through your employer's single sign-on
• Profile details you choose to add, including a home address and your country and city of residence

3.2 Travellers

• Travel dates, destinations and the accommodation booked, including its full address
• Who you invited to host, and the status of that invitation
• Accommodation preferences and the number of guests
• The accommodation rate applied to your trip, your employer's savings, and the reward paid to you
• Approval and expense routing information, where your employer uses those features
• Messages you send through the platform about a booking, and your support conversations with us

3.3 Hosts

• Name, email address and phone number
• The address of the property, and its description, photographs and capacity
• Bank and payout details, which are collected and held by Stripe (see 3.4)
• The bookings you have hosted and the amounts paid to you

3.4 Payment information

We do not collect or store card numbers. Card details are entered directly into Stripe, our payment processor, and are handled by Stripe. We receive a payment reference, the amount, the currency, the outcome, and a label such as "card" so that we can show you a receipt.

3.5 Technical and usage data

• IP address, browser type and version, operating system and device identifiers
• Pages visited, features used and actions taken
• Session records, including session recordings and interaction heatmaps, where you have consented to analytics cookies (see 11)
• Records of the emails we send you, and whether they were delivered and opened
• Records of accommodation price searches, including the destination, the dates and the prices returned

3.6 What we do not collect

We do not ask for, and do not intentionally process, special category data — data about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, or sexual orientation.

We do not knowingly collect personal data about children (see 13).
‍

4. Why we process your data, and our legal basis

Where we rely on legitimate interests, we have considered the effect on you and balanced it against those interests. You can object at any time — see section 10.
‍

5. What your employer sees, and what your host sees

This section matters most to travellers and hosts, so we have set it out plainly.

If you are a traveller, your employer can see: your bookings, including the dates and the destination; the address of the accommodation; the name and contact details of your host; and the cost of the trip and the saving made. Your line manager or an approver may be notified where your employer uses approval workflows. Your employer does not see your card details or your bank details.

Travel safety providers. Some employers use a travel risk and medical assistance provider, such as Healix or International SOS, so that their people can be located and helped in an emergency.

We share your travel information with such a provider only where your employer has set up that integration with us. If your employer has not set one up, we share nothing with any travel safety provider.

Where an employer has set up an integration, we provide that provider with the traveller's name, business email address and telephone number, and the dates, city and country of each booking. We do not provide the street address of the accommodation. The provider is chosen and appointed by your employer, not by us, and your employer is responsible for the arrangements covering it.

You can ask your employer, or us, whether an integration is in place for your organisation.

If you are a host, the traveller's employer can see: your name, your contact details, the address of the property and the dates of the stay. We tell you this when you accept an invitation, and you may decline. Where the employer has set up a travel safety integration as described above, the provider also receives the city and country of the stay.
‍

6. Automated processing and artificial intelligence

To work out what comparable accommodation would have cost for a trip, we send the destination and the travel dates to an AI service, which returns an indicative market price. We use OpenRouter, Inc. as a gateway and Anthropic, PBC as the model provider. We do not send your name or your contact details for this purpose.

We do not make decisions about you by automated means alone that have a legal effect on you or that otherwise significantly affect you.
‍

7. Who we share your data with

7.1 Your employer

If you use Roamr through an employer, we share your data with that employer as described in section 5.

7.2 Your host, or your traveller

We share what is needed for the stay to happen: the traveller's name and the dates with the host; the host's name, contact details and the property address with the traveller.

7.3 Our service providers

We use the providers below to run Roamr. Each processes personal data only on our instructions and under a written contract that requires it to keep the data confidential and secure. We maintain a current register of these providers, which we will give you on request.

‍

‍

7.4 Others

We may share personal data with our professional advisers, auditors and insurers; with authorities, regulators and law enforcement where the law requires it; and with a buyer or investor in connection with a sale or reorganisation of our business, in each case under appropriate confidentiality obligations.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
‍

8. Sending data outside Europe

Some of our providers process personal data outside the European Economic Area and the United Kingdom, most significantly in the United States, where our application compute runs.

Where we transfer personal data outside the EEA or the UK to a country that is not covered by an adequacy decision, we rely on the Standard Contractual Clauses approved by the European Commission, and on the International Data Transfer Addendum issued by the UK Information Commissioner's Office, together with additional safeguards where these are needed. Transfers to the United Kingdom rely on the European Commission's adequacy decision for the UK.

You can ask us for a copy of the safeguards in place for any particular transfer by writing to privacy@roamr.com.

Where your employer has set up an integration with a travel safety provider located outside the EEA or the UK, that provider is appointed by your employer, and your employer is responsible for the transfer arrangements covering it. Where no such integration is in place, no transfer to any travel safety provider takes place.
‍

9. How long we keep your data

‍

‍

Where we are dealing with an unresolved matter, or where the law requires us to keep something for longer, we will keep it for as long as is necessary for that purpose and no longer.

Our payment provider keeps records of payments under its own legal obligations, which we do not control.
‍

10. Your rights

You can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is inaccurate or incomplete
• delete your data, where we do not need to keep it
• restrict how we use it while a question is being resolved
• transfer it to you or to another provider in a portable format
• stop processing that is based on our legitimate interests, by objecting to it
• withdraw your consent, where we relied on consent — this does not affect processing that already took place

To exercise any of these rights, write to privacy@roamr.com. We will respond within one month. We may ask you to confirm your identity first.

If you use Roamr through an employer, some of your data is held on that employer's instructions. In that case we will pass your request to your employer and help them to answer it.

You can also complain to a data protection authority. In Ireland this is the Data Protection Commission (dataprotection.ie). In the United Kingdom it is the Information Commissioner's Office (ico.org.uk). You may also complain to the authority in the country where you live or work.
‍

11. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, to remember your preferences, to understand how our website and platform are used, and to record sessions so that we can find and fix problems.

Essential cookies are necessary for the site to work and cannot be switched off. Analytics and performance technologies — including Microsoft Clarity, which records sessions and interaction heatmaps, and Google Tag Manager on our website and platform, and PostHog on our marketing site — are non-essential and are used on the basis of your consent.

You can change or withdraw your choices at any time through Cookie Preferences in our Privacy Center, and you can block or delete cookies through your browser settings. Blocking some cookies may affect how parts of the site work.

Our separate Cookie Policy describes the cookies we use in more detail.
‍

12. Keeping your data safe

We encrypt personal data in transit and at rest, restrict access to those who need it, require multi-factor authentication for administrative access, log administrative actions, and keep encrypted backups.

Our hosting and database providers hold SOC 2 Type II certification. We are working towards ISO 27001 and SOC 2 Type II certification ourselves, supported by our compliance partner Scrut Automation, and we carry out penetration testing as part of that programme.

No system can be made completely secure. If a personal data breach affects you and is likely to present a high risk to your rights, we will tell you without undue delay.
‍

13. Children

Roamr is intended for people in work and is not directed at anyone under 18. We do not knowingly collect personal data about children. If you believe that we have, contact privacy@roamr.com and we will delete it.
‍

14. Changes to this notice

We will update this notice when our practices change. Where a change materially affects you, we will tell you by email or through the platform. The date at the top of this notice shows when it was last updated.
‍

15. Contact us

privacy@roamr.com for data protection questions and to exercise your rights

support@roamr.com for general enquiries

Data Protection Lead, Roamr Work Limited, Tanavalla House, Newtown, Cahir, Co. Tipperary, E21 NV34, Ireland

We have not appointed a Data Protection Officer, as we are not required to do so. The contact above is responsible for data protection at Roamr.