Payment partners collect their own, possibly broader, payment details
To handle payments and refunds, Surfshark says its trusted payment partners collect necessary details like the transaction date, the payer's IP address, the credit card number and the cardholder's full name. Depending on your location, the partners may also need extra details like a personal ID, passport or address. For what these providers collect and store, Surfshark points you to their own terms of service and privacy policies.
Supporting quotations
our trusted payment partners collect necessary details like the transaction date, payer’s IP address, credit card number, and the cardholder's full name. Depending on your location, our payment partners may also need additional details like a personal ID, passport, or your address.
To learn what personal data these payment providers collect and store, please refer to their individual terms of service and privacy policies.
Qualifications & exceptions
The extra details (personal ID, passport, address) depend on your location.
The list of partner-collected details is introduced with "like", so it is not stated as complete.
Not stated here
Which payment partners are used, and what each collects and keeps, is not stated here; it is in their own policies, which are not part of this source.
Sharing & Disclosure · Company practice
Advertising partners help deliver ads, including interest-based and account-based advertising
Surfshark says its advertising partners help it attribute sales and deliver more relevant ads and promotional messages to you, which may include interest-based advertising and account-based advertising.
Supporting quotations
Our advertising partners help us attribute sales, deliver more relevant ads and promotional messages to you, which may include interest-based advertising and account-based advertising.
Qualifications & exceptions
"May include" means interest-based and account-based advertising are examples, not stated as the full list.
Not stated here
The advertising partners are not named here, and the text does not say which data they receive.
Sharing & Disclosure · Company practice
Sharing: only with authorized parties, as necessary and allowed by law
Surfshark says it needs third-party tools and services for things like marketing, payments and live chat, and encourages you to read their terms and policies since they do not belong to Surfshark. It says it shares personal data with authorized parties only where necessary for the purposes described in the policy and allowed under applicable laws. It then lists the categories of third parties to which, in the preceding 12 months, it disclosed strictly necessary personal data for an operational purpose, with each category's purpose and the recipient countries.
Supporting quotations
It takes a village to keep our Website and Services up and running and we want to be transparent about what types of personal data we've shared and with whom, all for legitimate business reasons.We need third- party tools and services for things like marketing, payments, live chat, and so forth. Since these don’t belong to us, we urge you to read their terms and policies on their sites.
Surfshark shares personal data with the authorized parties only in cases where necessary for the purposes described in this Privacy Policy and allowed in accordance with applicable laws.
5.1 In the preceding 12 months, we have disclosed strictly necessary personal data for an operational purpose to the following categories of third parties:
Qualifications & exceptions
Sharing is limited to authorized parties, to what is necessary for the purposes in the policy and to what applicable laws allow.
The disclosure list covers the preceding 12 months and data disclosed for an operational purpose.
Not stated here
The list does not say which categories of personal data go to each recipient category; it states recipient categories, purposes and countries.
The 12-month period is measured from the time the policy was written, which is not stated beyond the last-updated date.
Sharing & Disclosure · Company practice
Marketing and app analytics providers (Iterable, Firebase Analytics, Purchasely, Appsflyer)
Surfshark discloses data to marketing and application analytics service providers such as Iterable, Firebase Analytics (by Google), Purchasely and Appsflyer. It uses them to manage its contacts, automate its marketing and gather analytics. The stated recipient countries are the United States, Sweden, France, Ireland and the United Kingdom. In the app-data section it adds that technical and engagement data goes to such providers for performance attribution, marketing engagement and subscription flow management.
Supporting quotations
Marketing and application analytics service providers, such as Iterable, Firebase Analytics (by Google), Purchasely and Appsflyer.
We use them to manage our contacts, automate our marketing, gather analytics.
United States, Sweden, France, Ireland, United Kingdom.
This data is shared with trusted service providers, such as AppsFlyer and Firebase Analytics for performance attribution, Iterable for marketing engagement, and Purchasely for subscription flows management and optimization.
Qualifications & exceptions
Providers are listed with "such as", so the list is not stated as complete.
Not stated here
Which personal data each provider receives is not itemized here.
Surfshark discloses data to performance marketing service providers such as Hasoffers (Tune Inc.), which it uses to calculate its conversion attribution. The stated recipient country is the United States.
Supporting quotations
Performance marketing service providers, such as Hasoffers (Tune Inc.).
We use them to calculate our conversion attribution.
United States
Qualifications & exceptions
Provider listed as an example ("such as").
Not stated here
Which personal data is shared is not itemized here.
Sharing & Disclosure · Company practice
Payment providers (Stripe, Adyen, Checkout, Coingate and similar)
Surfshark discloses data to third-party payment providers such as Stripe, Adyen, Checkout, Coingate and similar. They help it process payments together with its own authorized payment processing companies. The stated recipient countries are the United States, Ireland and the British Virgin Islands. In the account-data section Surfshark adds that payment partners collect details like the transaction date, payer IP address, credit card number and cardholder name, and sometimes a personal ID, passport or address depending on location.
Supporting quotations
Third-party payment providers, such as Stripe, Adyen, Checkout, Coingate and similar.
They help us to process payments together with our own authorized payment processing companies.
United States, Ireland, British Virgin Islands.
our trusted payment partners collect necessary details like the transaction date, payer’s IP address, credit card number, and the cardholder's full name.
Qualifications & exceptions
Providers are listed with "such as" and "and similar".
What payment partners collect and keep is governed by their own terms and privacy policies.
Not stated here
The identity and role of Surfshark's "own authorized payment processing companies" is not stated.
Sharing & Disclosure · Company practice
Storage and infrastructure providers (BigQuery by Google)
Surfshark discloses data to storage and infrastructure service providers such as BigQuery (by Google), which help it store, analyze and manage data. The stated recipient country is the United States.
Supporting quotations
Storage and infrastructure service providers, such as BigQuery (by Google).
They help us to store, analyze, and manage data.
United States
Qualifications & exceptions
Provider listed as an example ("such as").
Not stated here
Which personal data is stored there is not itemized here.
Sharing & Disclosure · Company practice
Live chat and support providers (Zendesk)
Surfshark discloses data to live chat and support service providers such as Zendesk, which it uses to provide live chat technology and support to users. The stated recipient country is the United States.
Supporting quotations
Live chat and support service providers, such as Zendesk.
We use them to provide live chat technology and provide support to our users.
United States
Qualifications & exceptions
Provider listed as an example ("such as").
Not stated here
Which personal data these providers receive is not itemized here.
Sharing & Disclosure · Company practice
Security providers (Cloudflare)
Surfshark discloses data to security service providers such as Cloudflare, with which it works to provide improved security and performance. The stated recipient country is the United States.
Supporting quotations
Security service providers, such as Cloudflare.
We work with them to provide improved security and performance.
United States
Qualifications & exceptions
Provider listed as an example ("such as").
Not stated here
Which personal data is disclosed is not itemized here.
Sharing & Disclosure · Company practice
Alternative ID providers (Telnyx)
Surfshark discloses data to providers that help deliver the Alternative ID service, such as Telnyx, to provide Alternative ID services such as Alternative Number. The stated recipient country is the United States.
Supporting quotations
Providers that help us deliver the Alternative ID service, such as Telnyx.
We work with them to provide you with Alternative ID services (such as Alternative Number).
United States
Qualifications & exceptions
Provider listed as an example ("such as").
Not stated here
Which personal data is disclosed, for example whether call and SMS content, is not itemized here.
Sharing & Disclosure · Company practice
Group companies
Surfshark shares data with its group companies to support its daily operations and ensure it can continue providing services. The stated recipient countries are the EEA, the United States and the United Kingdom.
Supporting quotations
Group companies.
We share data with our group companies to support our daily operations and ensure Surfshark can continue providing you with Services.
EEA, United States, United Kingdom.
Qualifications & exceptions
The text does not name the group companies.
Not stated here
Which group companies receive data, and which personal data, is not stated.
Sharing & Disclosure · Company practice
Distribution, reseller and app store partners as independent controllers
Surfshark shares personal data with its distribution, reseller and app store partners, each of which is an independent controller of your personal data. The stated recipient country is the United States.
Supporting quotations
Other Surfshark’s partners.
We share your personal data with our distribution, reseller, and app store partners, each of which is an independent controller of your personal data.
United States
Qualifications & exceptions
These partners are independent controllers, so their handling of your data is under their own policies.
Not stated here
Which personal data these partners receive is not itemized here.
Sharing & Disclosure · Company practice
Third parties whose services you buy through Surfshark
Surfshark may provide your personal data to third parties that deliver services you buy through Surfshark. It says it shares only the minimum amount of data necessary, for example your email address, so you can receive the services you requested, and that each of these companies acts as an independent controller of your personal data. The stated recipient countries are the EEA and the United States.
Supporting quotations
Third parties whose services you buy through us.
We may provide your personal data to the third parties that deliver the services you buy through us. We only share the minimum amount of data necessary (e.g. your email address) to enable you to receive the services you have requested. Each of these companies acts as an independent controller of your personal data.
EEA, United States
Qualifications & exceptions
Sharing is limited to the minimum necessary, with your email address given as an example.
Each such company is an independent controller.
Not stated here
The third parties are not named.
Sharing & Disclosure · Company practice
Corporate reorganization: data may be shared with the buyer, agents and advisors
If Surfshark undergoes a corporate reorganization such as a merger, acquisition or sale of its business, it may share personal data with the involved third parties, for example the buyer, their agents and advisors, to help complete the transaction. The policy also names bankruptcy or liquidation proceedings in the recipient category. Where EU or UK data protection laws apply, its legal basis is its legitimate interest in conducting business, or your consent if required by law.
Supporting quotations
5.2 There are a few more cases in which we can share your information with other authorized parties:
Third parties (in case of corporate reorganization, bankruptcy or liquidation proceedings).
If we undergo a corporate reorganization (like a merger, acquisition, or sale of our business), we may share personal data with the involved third parties (e.g., the buyer, their agents, and advisors) to help complete the transaction.
When EU or UK data protection laws apply, our legal basis for this is our legitimate interest in conducting business, or your consent if required by law.
Qualifications & exceptions
Sharing is "to help complete the transaction".
The stated legal basis applies when EU or UK data protection laws apply.
Not stated here
The text does not say what the legal basis is where EU or UK laws do not apply, or what happens to your data after the transaction.
Sharing & Disclosure · Company commitment
Law enforcement and courts: disclosure only when asked and legally obliged
Surfshark says it discloses personal data to law enforcement authorities or courts of competent jurisdiction only when it is asked and legally obliged to do so. Its Transparency report page will display if it is ever asked.
Supporting quotations
Authorities
We only disclose personal data to law enforcement authorities or courts of competent jurisdiction when we are asked and legally obliged to do so
Qualifications & exceptions
Disclosure requires both a request and a legal obligation.
The Transparency report page is a linked page not included in this source.
Not stated here
What the Transparency report shows, and whether it has recorded any requests, is not stated here.
Sharing & Disclosure · Company commitment
Other parties: disclosure only with your permission or for a legal reason
Surfshark says it will disclose your personal data to others only if you give permission or if there is a legal reason, for example sharing it with a legal representative. The stated legal ground is legal obligation, legitimate interest or your consent.
Supporting quotations
Other parties
We'll only disclose your personal data with others if you give us permission or if there's a legal reason to do so (e.g., we might share it with a legal representative).
Legal obligation, legitimate interest, or your consent.
Qualifications & exceptions
Disclosure requires your permission or a legal reason; the legal representative is an example ("e.g.").
The legal ground is stated as one of three alternatives without saying which applies when.
Not stated here
What other legal reasons count is not listed.
Sharing & Disclosure · User right or choice
CCPA opt out of sale or sharing; Surfshark says it does not sell data
Under the CCPA you have the right to opt out of the sale or sharing of your personal information to third parties. Surfshark says it does not sell, rent, lease or trade your personal data with anyone, and does not plan to in the future.
Supporting quotations
Right to Opt Out of Sale/Sharing You have the right to opt out of the sale or sharing of your personal information to third parties. However, we would like to inform you that we do not sell, rent, lease, or trade your personal data with anyone, nor do we plan to do so in the future.
Qualifications & exceptions
The opt-out right applies to individuals covered by the CCPA.
The no-sale statement is Surfshark's own description; sharing with providers and partners is described in section 5.
Not stated here
The text does not say how it distinguishes "sale or sharing" under the CCPA from the disclosures to marketing, analytics and advertising partners described in section 5.
Cross-references
contrast (model-proposed): Advertising partners help deliver ads, including interest-based and account-based advertising — contrast: Surfshark says it does not sell, rent, lease or trade personal data, while the policy describes advertising and marketing partners that help deliver ads and receive data for analytics and attribution. The policy does not say whether those disclosures count as sale or sharing under the CCPA.
Sharing & Disclosure · Company practice
App technical and engagement data shared with named analytics and marketing providers
Surfshark says it may also collect limited technical and engagement data through the app, for example device model, operating system version, device language and randomized identifiers, to measure campaign effectiveness and improve user experience. It says this data is shared with trusted service providers such as AppsFlyer and Firebase Analytics (performance attribution), Iterable (marketing engagement) and Purchasely (subscription flow management and optimization). You may manage or withdraw your consent at any time by contacting support@surfshark.com. The surrounding table says this processing continues until you withdraw consent.
Supporting quotations
We will process your personal data until you withdraw your consent.
we may collect limited technical and engagement data through the app, for example, device model, operating system version, device language, randomized identifiers.
This data is shared with trusted service providers, such as AppsFlyer and Firebase Analytics for performance attribution, Iterable for marketing engagement, and Purchasely for subscription flows management and optimization.
You may manage or withdraw your consent at any time by contacting us at support@surfshark.com.
Qualifications & exceptions
The data types are examples ("for example") and the provider list is introduced with "such as", so neither is stated as complete.
Withdrawal of consent is by contacting support@surfshark.com.