1. Information We Collect
   We follow a strict data minimization approach. We only collect the information necessary to operate and improve our Services, and we do not monitor or log your online activity.

1.1 Website Usage Data
When you visit our Website, certain technical data may be collected automatically, such as your IP address, browser type, and operating system. This information is used to maintain system security, detect threats, and ensure reliable performance.

Legal basis: Legitimate interest in maintaining and securing our platform.

1.2 Account Information
When you create an account, we may collect:

Name
Email address
Payment-related information
This data is used to manage your account, process transactions, and provide customer support.

Legal basis: Performance of a contract and compliance with legal obligations.

1.3 Service Performance Data
To maintain service quality, we may collect limited diagnostic and usage data such as connection duration, server selection, and application performance reports.

Importantly, VIPVPN does NOT collect or store:

Browsing history
IP addresses used during sessions
Connection timestamps
DNS queries
Traffic content
Legal basis: Legitimate interest in improving service performance.

1.4 Communication Data
If you contact us via email, chat, or other support channels, we may process your contact details and message content to respond to your request and provide assistance.

Legal basis: Legitimate interest and user consent.

1.5 Social Media Interactions
If you engage with us through social platforms, we may process publicly available information that you voluntarily provide.

Legal basis: Consent.

1.6 Technical and Device Data
We may collect anonymized technical data such as device type or connection status to improve functionality and prevent misuse.

1.7 Cookies and Tracking Technologies
We use cookies and similar technologies to enhance user experience, analyze traffic, and support marketing efforts. You can manage or disable cookies through your browser settings.

1. How We Use Your Information
   We use the limited information we collect strictly for the purposes outlined below. We do not sell your personal data, and we do not use it for behavioral advertising.

Service delivery: to operate, maintain, and provide our VPN Services across all supported platforms.
Account management: to create and manage your account, authenticate logins, and process subscription payments.
Customer support: to respond to inquiries, troubleshoot issues, and provide technical assistance.
Service improvement: to analyze aggregated, non-identifying performance metrics and improve reliability, speed, and feature quality.
Security and abuse prevention: to detect, investigate, and prevent fraudulent activity, abuse of our network, or violations of our Terms of Service.
Legal compliance: to comply with applicable laws, respond to lawful requests, and enforce our agreements.
Communications: to send service-related notices, security alerts, and (only with your consent) marketing or product updates, which you can unsubscribe from at any time.
3. Legal Grounds for Processing
Where the General Data Protection Regulation (GDPR) or similar privacy laws apply, we process your personal data only when we have a valid legal basis to do so. Depending on the activity, our legal basis is one of the following:

Performance of a contract: when processing is necessary to provide the Services you have subscribed to (for example, account creation, authentication, and billing).
Legitimate interests: when processing supports the security, stability, and improvement of our Services, provided your rights and freedoms do not override those interests.
Legal obligation: when we are required to process data to comply with applicable laws, regulations, or lawful requests from competent authorities.
Consent: when you have given clear, affirmative permission, such as for marketing communications, optional cookies, or social media interactions. You may withdraw your consent at any time.
If you have questions about the legal basis for any specific processing activity, you may contact us using the details in Section 11.

1. Data Retention
   We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specific retention periods include:

Account information: retained for the duration of your active subscription. After account closure, data is deleted within 30 days, except where retention is required by law (for example, tax or accounting records).
Payment records: retained for the period required by applicable financial and tax regulations, typically up to 7 years.
Support correspondence: retained for up to 24 months to assist with follow-up inquiries and quality assurance.
Aggregated and anonymized data: may be retained indefinitely, as it cannot be used to identify any individual.
Once retention periods expire, data is securely deleted or irreversibly anonymized.

1. Your Privacy Rights
   Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access: to request confirmation of whether we process your data and obtain a copy of it.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of your personal data, subject to legal retention obligations.
Right to restrict processing: to request that we limit the processing of your data in certain circumstances.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: at any time, where processing is based on consent.
Right to lodge a complaint: with your local data protection authority if you believe your rights have been violated.
To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframes required by applicable law (typically 30 days).

1. Data Sharing and Transfers
   We do not sell, rent, or trade your personal data. We share information only in the limited circumstances described below:

Service providers: trusted third parties who process data on our behalf, such as payment processors, cloud infrastructure providers, and customer support platforms. These providers are contractually bound to protect your data and use it only for the purposes we specify.
Legal requirements: when disclosure is required to comply with a valid legal obligation, court order, or lawful request from a competent authority. Because we do not log browsing activity, IP addresses, or traffic content, we are unable to provide such information even when requested.
Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections.
With your consent: in any other case where you have given explicit permission.
International transfers: Your data may be processed in countries outside your country of residence. Where required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives an equivalent level of protection.

1. Security Measures
   We implement appropriate technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Industry-standard encryption (AES-256) for data in transit and at rest.
Strict access controls, with personal data accessible only to authorized personnel on a need-to-know basis.
Regular security audits, vulnerability scanning, and penetration testing.
Secure software development practices and ongoing employee security training.
Incident response procedures to detect, contain, and notify affected users of any data breach in accordance with applicable law.
While we take security seriously, no method of transmission or storage is completely secure. We encourage you to use strong, unique passwords and to keep your account credentials confidential.

1. Children’s Privacy
   Our Services are not intended for, nor directed at, children under the age of 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children.

If you believe that a child has provided us with personal data, please contact us immediately using the details in Section 11, and we will take prompt steps to delete the information.

1. Third-Party Services
   Our Website and applications may contain links to, or integrations with, third-party services such as payment processors, social media platforms, or analytics providers. These third parties operate independently and have their own privacy policies, which we encourage you to review.

We are not responsible for the privacy practices of any third party. The inclusion of a link or integration does not imply endorsement of the third party’s policies or practices.

1. Updates to This Policy
   We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

Update the “Last updated” date at the top of this Policy.
Provide notice through the Website, the application, or via email where appropriate.
Where required by law, obtain your renewed consent.
We encourage you to review this Privacy Policy periodically. Continued use of our Services after any update constitutes acceptance of the revised Policy.

1. Contact Information
   If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Email: privacy@vipvpn.net
Support: support@vipvpn.net
Website: www.vipvpn.net
We will respond to your inquiry as soon as reasonably possible, and within the timeframes required by applicable law.