This policy is issued by Surfshark B.V. of Amsterdam, the Netherlands. It covers how Surfshark processes your personal data through its website, its online hosted services, and any related application, software or functionality it offers. Surfshark says it acts as a data controller under privacy laws including the GDPR.
Supporting quotations
This Privacy Policy explains how Surfshark B.V, address Kabelweg 57, 1014BA Amsterdam, the Netherlands (“Surfshark”, “we”, “us”, or “our”), processes your personal data through our website (the “Website”), online hosted services and any related application, software or functionality offered by Surfshark (the “Services”).
Surfshark processes your personal data and acts as a data controller in accordance with privacy laws, including the General Data Protection Regulation (“GDPR”).
Qualifications & exceptions
The policy covers the Website and the "Services" as defined in the policy: online hosted services and related applications, software or functionality offered by Surfshark.
Surfshark names the GDPR as one of the privacy laws it follows; the text does not say which other laws apply.
Not stated here
Which other privacy laws, beyond the GDPR, Surfshark treats as applying to a given user is not stated here.
Use & Processing · Permission or license
Alert service: entering your email authorizes Surfshark to look up more leaked details
When you enter your email in the Alert service, you authorize Surfshark to find and provide you with additional leak-related details, for example usernames, passwords, full names, country, physical address and IP addresses. For credit card or social security number leaks, Surfshark says it shows you only the categories of data involved (such as credit card details, name, address, password, nationality), not the specific compromised data, for security reasons.
Supporting quotations
When you enter your email, you authorize us to find and provide you with additional leaks-related details, for example, usernames, passwords, full names, country, physical address, IP addresses.
For credit card or social security number leaks, we'll only show you data categories (e.g., credit card details, name, address, password, nationality) for security reasons, rather than the specific compromised data.
Qualifications & exceptions
The authorization is triggered by entering your email address.
The examples ("for example") are not a complete list of the details Surfshark may look up.
For credit card and social security number leaks, only data categories are shown.
Not stated here
The text does not say where Surfshark obtains the additional leak details.
Use & Processing · Company practice
Antivirus: malware statistics processed, fully anonymized after 1 year
To provide statistics on what malware was detected, Surfshark processes the malware name and type, country, operating system and user ID. It says this information will be fully anonymized after one year from receiving the data.
Supporting quotations
To provide statistics on what malware was detected, we will process malware name and type, country, OS, and user ID.
Information about malware name and type, country, OS, and user ID will be fully anonymized after 1 year from our receipt of the data.
Qualifications & exceptions
Anonymization is stated for this malware information after 1 year from receipt, while the general retention line for the Antivirus service runs for the subscription plus 2 years after last login.
Not stated here
The text does not say how the anonymization is done, or whether the 1-year anonymization and the 2-year-after-last-login retention line apply to the same records.
Use & Processing · Company practice
Email scam checker: your data used in anonymized form to improve it
To improve the email scam checker, Surfshark says it will use your data in a completely anonymized format, relying on its legitimate interest in enhancing its services. It also says the collected data other than the sender's email address is stored only for the brief period needed to perform the scan and give you results.
Supporting quotations
The collected data will only be stored for the brief period necessary to perform the scan and provide you with the results.
The collected data (except sender’s email address) will only be stored for the brief period necessary to perform the scan and provide you with the results.
Please note that in order to improve our email scam checker, we will use your data in a completely anonymized format, based on our legitimate interest in enhancing our services.
Qualifications & exceptions
The basis for the improvement use is legitimate interest, different from the necessity basis stated for the scan itself.
Use for improvement is described as completely anonymized.
Not stated here
The text does not say how the data is anonymized or whether you can object to this use.
Cross-references
contrast (model-proposed): Email scam checker: no access to private content and no use of your data to train AI — contrast: One paragraph says user data is used in anonymized form to improve the email scam checker; the next says Surfshark does not use any of your data to train its AI models. The policy does not say how improving the checker differs from training.
Use & Processing · Company commitment
Email scam checker: no access to private content and no use of your data to train AI
Surfshark says it respects your privacy and does not access any of your private content or use any of your data to train its AI models. For how personal data is processed for email scam checker diagnostics, the policy refers to paragraph 2.3.9: the diagnostics collection there includes the email sender's name and email address, the receiver's email address, the subject, the content of the email, and metadata of any attachments.
Supporting quotations
we respect your privacy and do not access any of your private content or use any of your data to train our AI models.
You can find information about how your personal data is processed for email scam checker diagnostics in paragraph 2.3.9 of this privacy policy.
In the case of email scam checker diagnostics, we will collect a minimal amount of necessary personal data. This includes the email sender's name and email address, the receiver's email address, the email subject, the content of the email, and metadata of any attachments.
we will use your data in a completely anonymized format, based on our legitimate interest in enhancing our services.
Qualifications & exceptions
This statement sits beside the earlier statement that anonymized data is used to improve the email scam checker; the policy does not explain how improving the checker differs from training AI models.
Diagnostics processing for the scam checker is covered separately in paragraph 2.3.9.
Not stated here
The text does not define "train our AI models" or say how "access" to private content is limited, given that the scam checker scans email content.
Use & Processing · Company practice
Message protection: needs permission to read texts; content scanned but not stored
The message protection service automatically screens all future incoming messages for threats in real time. To do this it requires permission to read your text messages, and by enabling it you agree to allow future messages to be scanned. Surfshark processes the sender's phone number, message content, any links in it and metadata. Where necessary it engages trusted data processors. It says message content is scanned instantly and never stored or retained, though it may keep anonymized metadata for statistical purposes, and that the sender's number and related data shown in the app are stored locally on your device only.
Supporting quotations
To protect you from scam, our message protection service automatically screens all future incoming messages for potential threats in real time.
To do this, the feature requires permission to read your text messages. By enabling it, you agree to allow future messages to be scanned.
Where necessary, we engage trusted data processors to support message protection services.
Message content is scanned instantly for potential threats and is never stored or retained (though we may keep anonymized metadata for statistical purposes).
Please note that the sender’s phone number and related data displayed in the app are stored locally on your device only.
Qualifications & exceptions
Applies once you enable the feature; enabling counts as agreeing to scan future messages.
Never stored or retained is stated for message content; anonymized metadata may be kept for statistics.
Trusted data processors may support the service "where necessary".
Not stated here
The data processors are not named.
How long anonymized metadata is kept is not stated.
Cross-references
contrast (model-proposed): Scam, message and call diagnostics: content and numbers collected, kept up to 30 days — contrast: The message protection paragraph says message content is never stored or retained, while the diagnostics section lists the content of the SMS as collected and kept up to 30 days (with consent). The policy treats them as separate but does not explain how they fit together.
Use & Processing · Company practice
Call protection: needs permission to scan calls and read call logs; no listening or recording
The call protection service automatically screens incoming calls for threats in real time. It requires permission to scan your phone calls and access your call logs. Surfshark processes call data such as the caller's number, call classification and metadata, and where necessary engages trusted data processors. It says this data is analyzed instantly and never stored or retained on its servers, though it may keep anonymized metadata for statistical purposes, and that caller details and call history shown in the app are stored locally on your device only. It also says it never accesses, listens to, or records your phone calls under any circumstances.
Supporting quotations
our call protection service automatically screens incoming calls for potential threats in real time. To provide this protection, the feature requires permission to scan your phone calls and access your call logs.
Where necessary, we engage trusted data processors to support these services.
The above mentioned data is analyzed instantly for potential threats and is never stored or retained on our servers (though we may keep anonymized metadata for statistical purposes).
Any caller details and call history displayed in the app are stored locally on your device only.
We respect your privacy and never access, listen to, or record your phone calls under any circumstances.
Qualifications & exceptions
Applies once you grant the permission to scan calls and access call logs.
Never stored on Surfshark's servers is stated for the call data; anonymized metadata may be kept.
The no listening or recording statement is "under any circumstances".
Not stated here
The data processors are not named.
How long anonymized metadata is kept is not stated.
Use & Processing · Context
Data is also processed for security, operations, improvement and legal duties
Surfshark says it generally uses your data to provide the services, but also processes some of it for other legal reasons. These may not be a direct part of the services you use, but Surfshark says they matter for keeping things secure, running smoothly, making its offers better and meeting its legal duties. The details follow in the subsections of section 2.3.
Supporting quotations
2.3 Other personal data processing purposes
Nevertheless, we also process some of it for other legal reasons. These might not be a direct part of the Services you use, but they're also important for keeping things secure, running smoothly, making our offers better, and meeting our legal duties.
Qualifications & exceptions
These purposes are separate from the service-delivery processing described earlier.
Use & Processing · Company practice
Marketing emails: processed on consent or legitimate interest until you opt out
To send you offers, surveys and other marketing content, Surfshark collects your email address, the content of the email and the date and time it was sent. Its legal basis is your consent or its legitimate interest in conducting marketing activities, and it processes your information until it receives your opt-out request. It may contact you by email for this purpose, but also encourages you to use its online contact form to get the best VPN offer.
Supporting quotations
2.3.5 To send you offers, surveys, and other marketing content
Your email address, the content of the email letter, the date and time of the email letter sent.
Legal basis for the processing of personal data is your consent or our legitimate interest to conduct marketing activities.
We will process your information until we receive your opt-out request.
We may contact you via email for this purpose, but we also encourage you to contact us via our online contact form to get the best VPN offer for you.
Qualifications & exceptions
The basis is stated as "consent or legitimate interest", without saying which applies when.
Processing continues until you opt out.
Not stated here
The text does not say when consent is the basis and when legitimate interest is.
Use & Processing · Permission or license
Unfinished-order emails may be sent on legitimate interest
To help with your order, Surfshark says it might email you to let you know if a purchase was not completed. It bases this on its legitimate interest in improving your experience and helping with order issues.
Supporting quotations
to help you with your order, we might send an email letting you know if a purchase wasn't completed (unfinished order). This is based on our legitimate interest in improving your experience with us and assisting you with any issues related to your orders.
Qualifications & exceptions
Stated as something Surfshark "might" do.
The basis is legitimate interest, not consent.
Not stated here
The text does not say whether the opt-out below stops these unfinished-order emails.
Use & Processing · Company practice
App engagement data is used to measure campaigns and improve the experience
Surfshark says the limited technical and engagement data it collects through the app helps it measure campaign effectiveness and enhance user experience.
Supporting quotations
This information helps us measure campaign effectiveness and enhance user experience.
Qualifications & exceptions
This describes the purpose of the app technical and engagement data covered in the previous section.
Use & Processing · Company practice
Market research uses aggregated, anonymized data, kept indefinitely
To carry out market research and internal analytics, Surfshark says it aggregates and anonymizes the data it collects for this purpose, and then maintains and uses the data only in anonymized form. Its legal basis for processing this deidentified data is its legitimate interest. Because the data is anonymized, it says it will process it indefinitely. It uses the aggregated statistical data to understand customer needs, analyze sales and identify business trends, using aggregated and/or inferred non-personal information.
Supporting quotations
2.3.12 To carry out market research and perform internal analytics
We aggregate and anonymize the data we collect for this purpose. We then maintain and use this data only in its anonymized form.
Legal basis for the processing of this deidentified data is our legitimate interest.
Since the data is anonymized we will process it indefinitely.
We create aggregated statistical data and conduct market research and analysis to understand customer needs, analyze sales, and identify other business trends.
Qualifications & exceptions
Indefinite processing is stated only for data that has been anonymized.
Surfshark describes the data as aggregated and/or inferred non-personal information.
Not stated here
How the anonymization is done is not stated, and the text does not say which collected data feeds this analysis.
Use & Processing · Company practice
Data may be stored and processed in any country with Surfshark facilities or providers
Surfshark says your data, as specified in the policy, may be stored and processed in any country where it has facilities or where it engages service providers. It says it carefully assesses all international transfers and implements appropriate safeguards so your personal data remains protected as outlined in the policy, and that wherever your data needs to be sent it takes extra care to keep it safe.
Supporting quotations
Wherever your personal data needs to be sent, we always take extra care to keep it safe and sound.
Your data, as specified in this Privacy Policy, may be stored and processed in any country where we have facilities or in which we engage service providers. We carefully assess all international data transfers and implement appropriate safeguards to ensure your personal data remains protected as outlined in this Privacy Policy.
Qualifications & exceptions
The scope is any country where Surfshark has facilities or engages service providers; no list of countries is given.
Only data "as specified in this Privacy Policy" is covered.
Not stated here
The countries involved are not named, and the "appropriate safeguards" are described only for transfers out of the EEA.
Use & Processing · Company practice
Discount eligibility: subscription information used, kept while subscribed plus 2 years
To decide eligibility for subscription discounts, Surfshark uses information related to your subscription. Its legal basis is its legitimate interest in enhancing your experience, and it keeps the data for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.3.8 To determine eligibility for subscription discounts through automated decision-making, including profiling
Information related to your subscription.
We use your personal data because it's in our legitimate interest to enhance your experience.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Qualifications & exceptions
The stated basis is legitimate interest in enhancing your experience.
Not stated here
Which subscription details are used is not listed; the text says only "information related to your subscription".
Use & Processing · Company practice
Analytics and advertising: cookie and device IDs processed on consent
To improve its analytics and optimize advertising, Surfshark processes cookie ID, mobile device ID, device specification and advertising IDs. Its basis is your consent to deliver relevant ads and promotional messages and to attribute sales, and it processes the data until you withdraw consent. On the website it collects information about your activity through technologies like cookies if you have given permission. It may receive information about you from certain advertisers and advertising partners for analytical and advertising purposes, and says its partners help it attribute sales and deliver more relevant ads, which may include interest-based and account-based advertising.
Supporting quotations
2.3.11 To improve our analytics and optimize advertising
Cookie ID, mobile device ID, device specification, advertising IDs.
Legal basis for the processing of personal data is your consent to deliver relevant ads and promotional messages to you, and to attribute sales.
We will process your personal data until you withdraw your consent.
we automatically collect information about your activity through technologies like cookies if you've given us permission.
We may receive information about you from certain advertisers and advertising partners for analytical and advertising purposes.
Qualifications & exceptions
Cookie-based collection on the website is stated as happening if you have given permission.
Information may also come to Surfshark from advertisers and advertising partners.
Not stated here
The advertisers and advertising partners are not named in this part.