Privacy Policy

Use & Processing · Company practice

Who processes your data and for which services

This policy is issued by Surfshark B.V. of Amsterdam, the Netherlands. It covers how Surfshark processes your personal data through its website, its online hosted services, and any related application, software or functionality it offers. Surfshark says it acts as a data controller under privacy laws including the GDPR.

Supporting quotations

This Privacy Policy explains how Surfshark B.V, address Kabelweg 57, 1014BA Amsterdam, the Netherlands (“Surfshark”, “we”, “us”, or “our”), processes your personal data through our website (the “Website”), online hosted services and any related application, software or functionality offered by Surfshark (the “Services”).

Surfshark processes your personal data and acts as a data controller in accordance with privacy laws, including the General Data Protection Regulation (“GDPR”).

Qualifications & exceptions

• The policy covers the Website and the "Services" as defined in the policy: online hosted services and related applications, software or functionality offered by Surfshark.
• Surfshark names the GDPR as one of the privacy laws it follows; the text does not say which other laws apply.

Not stated here

• Which other privacy laws, beyond the GDPR, Surfshark treats as applying to a given user is not stated here.

Legal Rights & Agreement Rules · Context

Privacy Policy and Terms of Service form one agreement

The policy asks you to read it together with the Terms of Service. Surfshark says the two documents together are a single, legally binding agreement between you and Surfshark.

Supporting quotations

This Privacy Policy should be read alongside our Terms of Service. Together, these two documents create a single, legally binding agreement between you and Surfshark.

Qualifications & exceptions

• The Terms of Service are only linked; their text is not part of this document.

Not stated here

• What the linked Terms of Service say, and whether anything in them changes how this policy applies, is not shown in this source.

Legal Rights & Agreement Rules · Context

Highlighted summaries are only helpful guides

Surfshark says the policy is lengthy, so it added highlighted short breakdowns. It describes them as helpful guides that make the legal language easier to understand.

Details not recorded for this card

Supporting quotations

These highlighted bits will do precisely that! Think of them as helpful guides — they'll make the legal language easier to understand.

Qualifications & exceptions

• The text calls the highlights guides; it does not say whether they have legal effect separate from the full text.

Not stated here

• Whether the highlighted breakdowns are binding, or only the full policy text, is not stated.

Legal Rights & Agreement Rules · Company practice

Continued use counts as agreeing to the policy

By continuing to use the website or the services you agree to the current Privacy Policy. Surfshark asks you not to use its services and website if you do not agree with the policy or any of its provisions.

Supporting quotations

By continuing to use our Website and / or Services, you agree to the terms of the current Privacy Policy.

We kindly request that you refrain from using our Services and Websites if you do not agree with this Privacy Policy or any of its provisions.

Qualifications & exceptions

• Agreement is tied to the current version of the policy.
• The wording is a request ("We kindly request") that you refrain from using the services if you disagree.

Legal Rights & Agreement Rules · Company commitment

Surfshark may change the policy; only significant updates get advance notice

Surfshark may amend the policy from time to time. For significant updates it says it will tell you ahead of time through the website or by email. The date of the latest update is shown at the top of the policy; this version says it was last updated on 2026.10.12.

Supporting quotations

We may need to amend the Privacy Policy from time to time. If there are any significant updates, we'll let you know ahead of time through our Website or by email. You'll always find the date of the latest update at the top of the Privacy Policy.

Last updated: 2026.10.12

Qualifications & exceptions

• Advance notice is promised only for "significant" updates, not for every change.
• Notice goes through the Website or by email.

Not stated here

• What counts as a significant update, and how far ahead notice is given, are not defined.
• Whether less significant changes take effect without any notice is not stated; the policy only says the latest update date is shown at the top.

Data Access & Collection · Company commitment

Surfshark says it keeps no logs of your online activity

Surfshark says its VPN service is logs-free and that it does not store information that could show your online activities. It says it is committed not to process information about users' online activity, and that it does not collect visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, network traffic or similar information. It points to Netherlands jurisdiction, which it says does not require information storage or reporting.

Supporting quotations

No-logs Policy is one of the most important features of our VPN service and we keep our VPN service logs-free. We don’t store any information that could lead us to see your online activities.

we do not collect your visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, network traffic or any other similar information

Surfshark is based in the Netherlands jurisdiction, which does not require information storage or reporting.

Qualifications & exceptions

• The commitment is framed around online activity: what you do online while using the VPN.
• The list says connection time stamps are not collected; a later paragraph in this section describes temporary connection details that include connection time stamps, see the connection-details card.

Not stated here

• The text does not say how or by whom the no-logs claim is verified.

Cross-references

• contrast (model-proposed): Connection details are kept temporarily, deleted within 15 minutes after the session ends — The no-logs paragraph says connection time stamps are not collected, while the next paragraph (and section 2.2.1) says servers temporarily keep connection details including time stamps, deleted within 15 minutes after the session ends. The policy presents both without explaining the difference.
• contrast (model-proposed): Dedicated IP: email and assigned IP kept; some online activity can be linked to your account — The Dedicated IP paragraph says certain online activities could be linked back to your account, while the connection data section says Surfshark keeps a no-logs policy and does not collect information about what you do online.

Retention & Deletion · Company practice

Connection details are kept temporarily, deleted within 15 minutes after the session ends

To make the VPN work, Surfshark servers temporarily keep details about your connection to a specific VPN server, such as your user ID and/or IP address and connection time stamps. Surfshark says this information is automatically deleted within 15 minutes after your session ends, and that it does not store information about the websites you visit.

Supporting quotations

our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection to VPN server time stamps. However, this information is automatically deleted within 15 minutes after your session ends.

we do not store any information about the websites you visit

Qualifications & exceptions

• Retention applies to details about the connection to a VPN server, not to the sites you visit.
• Deletion is stated as automatic within 15 minutes after the session ends.
• "such as" means the examples listed (user ID, IP address, time stamps) are not stated as the full list.

Not stated here

• The full list of connection details kept temporarily is not given; only examples are listed.

Cross-references

• contrast (model-proposed): Surfshark says it keeps no logs of your online activity — The no-logs paragraph says connection time stamps are not collected, while the next paragraph (and section 2.2.1) says servers temporarily keep connection details including time stamps, deleted within 15 minutes after the session ends. The policy presents both without explaining the difference.

Data Access & Collection · Company practice

Surfshark says it collects limited personal data and why

Surfshark says it collects limited personal data, meaning data that can directly or indirectly identify you when you use its services. It says this data helps it provide the services, enhance your experience, improve the services and comply with legal obligations. The policy then breaks down what is collected, why, on what basis and for how long, subsection by subsection.

Supporting quotations

Surfshark collects limited personal data, which includes any data that can directly or indirectly identify you when you use our Services.

Personal data helps us to provide you Services, enhance your experience, improve our Services, and ensure compliance with legal obligations.

Here's a breakdown of the personal data we gather and what we use it for:

Qualifications & exceptions

• "Limited" is Surfshark's own description; the breakdown that follows is the operative list.
• Personal data is defined to include data that identifies you directly or indirectly.

Not stated here

• The text does not say what is not collected beyond the specific statements in later subsections.

Data Access & Collection · Company practice

Account creation: email, encrypted password, registration date and coupon code

To let you create a Surfshark account, Surfshark collects your email address, encrypted password, account registration date and any coupon code. It uses this information to create the account so you can use the services. Surfshark gives its basis as processing that is essential to provide you a service and carry out the terms of its service agreement.

Supporting quotations

2.1.1 For you to be able to create a Surfshark account

Email address, encrypted password, account registration date, coupon code (if any).

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We use this information to create your account so that you can use our Services.

Qualifications & exceptions

• Coupon code is collected only if you have one.
• The stated basis is that processing is essential to provide the service and carry out the service agreement.

Data Access & Collection · Company practice

Service delivery: user ID, subscription, payment and partial card details

To provide the services, Surfshark collects your user ID and subscription information (plan name, term, ID, frequency, amount, currency, status, auto-renewal status and whether two-factor authentication is on or off). It also collects payment details: date of payment, amount paid, currency, payment status, payer residence country (and state), coupon used if any, part of the credit card number and the card expiry date. The stated basis is that processing is essential to provide the service and carry out the service agreement.

Supporting quotations

2.1.2 To provide you with Surfshark Services

User ID, information about subscription (subscription plan name, subscription term, subscription ID, subscription frequency, amount, currency, status, auto-renewal status, and information about 2FA (on/off)), date of the payment, amount paid, currency, payment status, payer residence country (and state), coupon used (if any), part of the credit card number, credit card expiry date.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

Qualifications & exceptions

• Only part of the credit card number is listed as collected by Surfshark itself.
• Coupon is listed only "if any".

Not stated here

• The text does not say which part of the credit card number is kept.

Sharing & Disclosure · Company practice

Payment partners collect their own, possibly broader, payment details

To handle payments and refunds, Surfshark says its trusted payment partners collect necessary details like the transaction date, the payer's IP address, the credit card number and the cardholder's full name. Depending on your location, the partners may also need extra details like a personal ID, passport or address. For what these providers collect and store, Surfshark points you to their own terms of service and privacy policies.

Supporting quotations

our trusted payment partners collect necessary details like the transaction date, payer’s IP address, credit card number, and the cardholder's full name. Depending on your location, our payment partners may also need additional details like a personal ID, passport, or your address.

To learn what personal data these payment providers collect and store, please refer to their individual terms of service and privacy policies.

Qualifications & exceptions

• The extra details (personal ID, passport, address) depend on your location.
• The list of partner-collected details is introduced with "like", so it is not stated as complete.

Not stated here

• Which payment partners are used, and what each collects and keeps, is not stated here; it is in their own policies, which are not part of this source.

Retention & Deletion · Company practice

Account and service data kept while subscribed plus 2 years after last login

For account data, subscription and payment data, search-tool counts, Alternative ID persona data and Alternative email data, Surfshark says it keeps the data for as long as your subscription is active and for 2 years after your last login. Some data has a shorter stated period: VPN connection details are deleted within 15 minutes after the session ends, and forwarded emails are deleted as soon as they are forwarded.

Supporting quotations

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Connection information is automatically deleted within 15 minutes after your session ends.

The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.

Qualifications & exceptions

• The stated period is the subscription term plus 2 years after the last login.
• Different periods apply to VPN connection information and to forwarded email content, in their own subsections.

Not stated here

• The text does not say what happens to a subscription that lapses without any login; the clock is measured from the last login.

Cross-references

• qualified by (model-proposed): Stated retention periods can be exceeded or governed by this general rule — The general retention rule says data may be stored beyond the stated timeframes for legal obligations and legal claims, which qualifies the account-level retention period of subscription plus 2 years.

Data Access & Collection · Context

Extra data is collected for each specific service you use

Beyond the account and general service data, Surfshark says it collects additional data specific to the individual service you use. It describes this data as essential for the particular service to function correctly.

Details not recorded for this card

Supporting quotations

2.2 Personal data needed for specific Surfshark Services

In addition to the personal data needed for account setup and general service delivery, we'll also collect additional data specific to the individual service you use. This personal data is essential for the particular Surfshark Service to function correctly:

Qualifications & exceptions

• The additional data varies by service; each service has its own subsection.

Data Access & Collection · Company practice

VPN: no browsing history stored, temporary connection details kept

For the VPN service, Surfshark says it does not store any information about the websites you visit. Its servers temporarily keep details about your connection to a specific VPN server, such as your user ID and/or IP address and connection time stamps. Surfshark gives its basis as processing that is essential to provide the service and carry out the service agreement, and says the connection information is automatically deleted within 15 minutes after the session ends.

Supporting quotations

2.2.1 Provision of the VPN service

We do not store any information about the websites you visit while using our VPN.

Our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection time stamps.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

Connection information is automatically deleted within 15 minutes after your session ends.

Qualifications & exceptions

• The retained details are examples ("such as"), not stated as a complete list.
• Deletion is automatic, within 15 minutes after the session ends.

Not stated here

• The full list of connection details kept temporarily is not given.

Data Access & Collection · Company practice

Search tool: searches stay private; only an aggregated search count is kept

For the Search tool service, Surfshark says what you search for stays private and it does not collect that information. It collects only the aggregated number of searches you perform. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.2.2 Provision of the Search tool service

What you search for stays private. We don't collect such information.

Aggregated number of your performed searches.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• What is collected is an aggregated count, not the search content.
• Retention follows the subscription-plus-2-years rule.

Data Access & Collection · Company practice

Alternative ID: alternative persona details are stored

For the Alternative ID service, Surfshark collects the details of your alternative persona: name, middle name, surname, date of birth, gender, country, city, address and postal code. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.2.3 Provision of the Alternative ID service

Alternative persona

Your alternative persona’s name, middle name, surname, date of birth, gender, country, city, address, postal code.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• This covers the alternative persona record, listed separately from the alternative email data.

Not stated here

• The text does not say whether the persona details are generated by Surfshark or entered by you.

Data Access & Collection · Company practice

Alternative email: email content and metadata handled for forwarding

For the Alternative email service, Surfshark collects your email address, the email mask and its description, the subject line, the content of the email letter (only for technical reasons, that is, to forward it), the email sender and receiver, forwarding status, user profile data and metadata associated with the email. You must verify the email address that emails are forwarded to. Emails received through the service, along with the sender and recipient server IP address, sender email address and timestamps, are deleted as soon as they are forwarded, and Surfshark uses a trusted email service provider to provide the service. The stated basis is that processing is essential to provide the service and carry out the service agreement. A separate line also says the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

Alternative email

Your email address, email mask and its description, subject line of the email letter, the content of the email letter (only for technical reasons, i.e., to forward it), email sender and receiver, email forwarding status, user profile data, metadata associated with the email.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

To be able to use Alternative email service, you will have to verify your email address to which emails are forwarded.

We use a trusted email service provider to facilitate this service.

Qualifications & exceptions

• Email content is collected "only for technical reasons, i.e., to forward it".
• Deletion as soon as forwarded is stated for the received emails with sender and recipient server IP, sender address and timestamps.
• A third-party email service provider is used.

Not stated here

• The text does not say how the 2-year-after-last-login retention line and the delete-once-forwarded statement fit together for items such as the subject line, sender and receiver and metadata; the two statements are listed in different places.
• The email service provider is not named.

Cross-references

• contrast (model-proposed): Alternative email: verify your address; forwarded emails deleted once sent on — The data table says Alternative email data, including the email content, subject line, sender and receiver, is kept while the subscription is active plus 2 years after last login, while the later paragraph says received emails and listed sender and recipient details are deleted as soon as they are forwarded. The policy does not reconcile them.

Retention & Deletion · Company practice

Alternative email: verify your address; forwarded emails deleted once sent on

To use the Alternative email service you must verify the email address that emails are forwarded to. Emails you receive through the service, along with the sender and recipient email server IP addresses, the sender email address and timestamps, are deleted as soon as they are forwarded to your address. Surfshark uses a trusted email service provider to provide this service.

Supporting quotations

To be able to use Alternative email service, you will have to verify your email address to which emails are forwarded.

The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.

We use a trusted email service provider to facilitate this service.

Qualifications & exceptions

• Deletion as soon as forwarded is stated for the received emails and the listed sender and recipient details.
• The provider is described only as "trusted"; it is not named.

Not stated here

• The retention line for this service in the data table says data is kept for as long as the subscription is active and for 2 years after last login; the text does not reconcile that with delete-on-forward for items such as the subject line, sender and receiver, and metadata.

Cross-references

• contrast (model-proposed): Alternative email: email content and metadata handled for forwarding — The data table says Alternative email data, including the email content, subject line, sender and receiver, is kept while the subscription is active plus 2 years after last login, while the later paragraph says received emails and listed sender and recipient details are deleted as soon as they are forwarded. The policy does not reconcile them.

Data Access & Collection · Company practice

Alternative number: assigned number plus your call and SMS logs and content

For the Alternative number service, Surfshark collects the telephone number it assigns to you, as well as your call and SMS log and content. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login. Surfshark uses trusted VoIP service providers to run the service, and says it respects your privacy and does not access your private content.

Supporting quotations

Alternative number

The telephone number that has been assigned to you by Surfshark, as well as your call, SMS log and content.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

In addition, to facilitate the Alternative Number service, we use trusted VoIP service providers. We respect your privacy and we do not access your private content.

Qualifications & exceptions

• "Call, SMS log and content" is listed as collected, while the text also says Surfshark does not access private content.
• Third-party VoIP providers are involved.

Not stated here

• The text does not say whether the call and SMS content is stored by Surfshark, by the VoIP providers, or both, or what "does not access" means technically.
• The VoIP providers are not named.

Data Access & Collection · Company practice

Alert service: email, ID or card numbers you submit are kept, with some encrypted

For the Alert service, which checks for personal data leaks, you can submit your email address, personal identity number (or social security number) or credit card number for monitoring. Surfshark says it securely retains this information and encrypts personal identity and credit card numbers. It also collects information about leaks it finds. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.2.4 Provision of the Alert service

Email address and / or personal identity number (or a social security number), and / or credit card number, information related to data leaks found.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

To use our Alert service for detecting personal data leaks, you can submit your email address, personal identity number (or a social security number), or credit card number for monitoring.

We'll securely retain this information, encrypting personal identity and credit card numbers.

Qualifications & exceptions

• Encryption is stated for personal identity and credit card numbers, not for the email address.
• The data you submit is your choice; you "can" submit any of these.

Cross-references

• contrast (model-proposed): CCPA right to limit sensitive information; Surfshark says it does not trigger this right — Surfshark says it does not process personal information in a way that triggers the right to limit use of sensitive personal information, while the Alert service lets you submit a social security number or credit card number, which Surfshark retains (encrypted). The policy does not explain how these fit together.

Use & Processing · Permission or license

Alert service: entering your email authorizes Surfshark to look up more leaked details

When you enter your email in the Alert service, you authorize Surfshark to find and provide you with additional leak-related details, for example usernames, passwords, full names, country, physical address and IP addresses. For credit card or social security number leaks, Surfshark says it shows you only the categories of data involved (such as credit card details, name, address, password, nationality), not the specific compromised data, for security reasons.

Supporting quotations

When you enter your email, you authorize us to find and provide you with additional leaks-related details, for example, usernames, passwords, full names, country, physical address, IP addresses.

For credit card or social security number leaks, we'll only show you data categories (e.g., credit card details, name, address, password, nationality) for security reasons, rather than the specific compromised data.

Qualifications & exceptions

• The authorization is triggered by entering your email address.
• The examples ("for example") are not a complete list of the details Surfshark may look up.
• For credit card and social security number leaks, only data categories are shown.

Not stated here

• The text does not say where Surfshark obtains the additional leak details.

Data Access & Collection · Company practice

Data Leak Checker: consent basis, email address and results not stored

For the Data Leak Checker, Surfshark collects your email address and the data leaks it was involved in, and says its legal basis is your consent. It says it does not retain your personal data and does not store your email address or information related to data leaks. You enter the email address voluntarily to find out whether your information has been exposed.

Supporting quotations

2.2.5 Provision of the Data Leak Checker service

Email address, data leaks your email address was involved in.

Legal basis for the processing of personal data is your consent.

We do not retain your personal data.

Please note that we do not store your email address or information related to data leaks.

Qualifications & exceptions

• The stated basis here is consent, unlike most other services in this section, which cite necessity to provide the service.
• The tool works on an email address you choose to enter.

Linking & Identification · Company practice

Dedicated IP: email and assigned IP kept; some online activity can be linked to your account

For the Dedicated IP service, Surfshark collects your email address and your dedicated IP address. It says that if you opt for the service, certain online activities could be linked back to your account. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.2.6 Provision of Dedicated IP service

Your email address, your dedicated IP address.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

If you opt for our Dedicated IP service, certain online activities could be linked back to your account.

Qualifications & exceptions

• The linking warning applies if you opt for the Dedicated IP service.
• The text says "could be linked", not that they will be or by whom.

Not stated here

• Which online activities could be linked, and by whom, is not stated.

Cross-references

• contrast (model-proposed): Surfshark says it keeps no logs of your online activity — The Dedicated IP paragraph says certain online activities could be linked back to your account, while the connection data section says Surfshark keeps a no-logs policy and does not collect information about what you do online.

Data Access & Collection · Company practice

Antivirus: device information and webcam protection usage statistics

For the Antivirus service on Windows, MacOS and Android, Surfshark collects information about the devices on which you use it, to enforce the limit on the number of devices one client may use under its Terms of Service. To improve user experience it also retains usage statistics for the webcam protection feature: how many times you received a request to access your camera or microphone, which preference you chose, whether the feature is on or off, and how many apps are on your exclusion list. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.2.7 Provision of the Antivirus service for Windows, MacOS, and Android users

We will collect information about your devices on which you use the Antivirus service. This information is needed to ensure the compliance with the limitation for the number of devices that one client may use for the Antivirus service as provided in our Terms of Service.

Also, to improve user experience we will retain statistical information about the usage of the webcam protection feature, including the number of times you received a request to access your camera or microphone, which preference you selected, whether this feature is turned on or off, how many apps you have included in the exclusion list.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• Applies to the Antivirus service for Windows, MacOS and Android users.
• The device limit comes from the Terms of Service, which are not part of this source.

Not stated here

• The device limit number is not stated here.

Use & Processing · Company practice

Antivirus: malware statistics processed, fully anonymized after 1 year

To provide statistics on what malware was detected, Surfshark processes the malware name and type, country, operating system and user ID. It says this information will be fully anonymized after one year from receiving the data.

Supporting quotations

To provide statistics on what malware was detected, we will process malware name and type, country, OS, and user ID.

Information about malware name and type, country, OS, and user ID will be fully anonymized after 1 year from our receipt of the data.

Qualifications & exceptions

• Anonymization is stated for this malware information after 1 year from receipt, while the general retention line for the Antivirus service runs for the subscription plus 2 years after last login.

Not stated here

• The text does not say how the anonymization is done, or whether the 1-year anonymization and the 2-year-after-last-login retention line apply to the same records.

Data Access & Collection · Company practice

Email scam checker: sender, subject and content collected for the scan

For the email scam checker, Surfshark collects the sender's email address, the email subject and the content of the email, including any website address in it. You choose which emails to scan, and your permission is required to collect this information. The stated basis is that processing is essential to provide the service and carry out the service agreement. The data is stored only for the brief period needed to run the scan and give you the results; the sender's email address is kept for 30 days to improve the services.

Supporting quotations

2.2.8 Provision of email scam checker service

The sender's email address, the email subject, and the content of the email, including any website address indicated therein.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

The collected data will only be stored for the brief period necessary to perform the scan and provide you with the results. Sender’s email address will be kept for 30 days to improve our services.

Your permission will be required to collect this information, as you will actively select which emails from your inbox to scan.

Qualifications & exceptions

• Collection covers emails you actively choose to scan.
• The sender's email address is kept for 30 days to improve services; the other collected data is kept only briefly for the scan.

Not stated here

• "Brief period" is not defined.

Use & Processing · Company practice

Email scam checker: your data used in anonymized form to improve it

To improve the email scam checker, Surfshark says it will use your data in a completely anonymized format, relying on its legitimate interest in enhancing its services. It also says the collected data other than the sender's email address is stored only for the brief period needed to perform the scan and give you results.

Supporting quotations

The collected data will only be stored for the brief period necessary to perform the scan and provide you with the results.

The collected data (except sender’s email address) will only be stored for the brief period necessary to perform the scan and provide you with the results.

Please note that in order to improve our email scam checker, we will use your data in a completely anonymized format, based on our legitimate interest in enhancing our services.

Qualifications & exceptions

• The basis for the improvement use is legitimate interest, different from the necessity basis stated for the scan itself.
• Use for improvement is described as completely anonymized.

Not stated here

• The text does not say how the data is anonymized or whether you can object to this use.

Cross-references

• contrast (model-proposed): Email scam checker: no access to private content and no use of your data to train AI — One paragraph says user data is used in anonymized form to improve the email scam checker; the next says Surfshark does not use any of your data to train its AI models. The policy does not say how improving the checker differs from training.

Retention & Deletion · Restriction or exception

Stated retention periods can be exceeded or governed by this general rule

The policy gives specific retention periods per service, but its general retention rule says that unless the policy specifies differently, Surfshark keeps personal data until it is no longer necessary for the reasons it was collected, or until it receives a valid request to remove it, with some exceptions. It also says there may be cases where it needs to use and store personal data beyond the stated timeframes, for example to comply with legal obligations and/or to exercise and defend legal claims.

Supporting quotations

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.

there may be instances where we need to use and store your personal data beyond the timeframes mentioned above for purposes such as compliance with our legal obligations and / or exercising and defending legal claims.

Qualifications & exceptions

• The general rule applies unless the policy specifies differently, so the per-service periods in section 2 come first.
• Longer storage is tied to legal obligations and exercising or defending legal claims; the word "for example" shows other reasons may exist.

Not stated here

• What the "some exceptions" to deletion on request are is not listed in this passage.
• The length of any extended storage is not stated.

Cross-references

• qualifies (model-proposed): Account and service data kept while subscribed plus 2 years after last login — The general retention rule says data may be stored beyond the stated timeframes for legal obligations and legal claims, which qualifies the account-level retention period of subscription plus 2 years.

Use & Processing · Company commitment

Email scam checker: no access to private content and no use of your data to train AI

Surfshark says it respects your privacy and does not access any of your private content or use any of your data to train its AI models. For how personal data is processed for email scam checker diagnostics, the policy refers to paragraph 2.3.9: the diagnostics collection there includes the email sender's name and email address, the receiver's email address, the subject, the content of the email, and metadata of any attachments.

Supporting quotations

we respect your privacy and do not access any of your private content or use any of your data to train our AI models.

You can find information about how your personal data is processed for email scam checker diagnostics in paragraph 2.3.9 of this privacy policy.

In the case of email scam checker diagnostics, we will collect a minimal amount of necessary personal data. This includes the email sender's name and email address, the receiver's email address, the email subject, the content of the email, and metadata of any attachments.

we will use your data in a completely anonymized format, based on our legitimate interest in enhancing our services.

Qualifications & exceptions

• This statement sits beside the earlier statement that anonymized data is used to improve the email scam checker; the policy does not explain how improving the checker differs from training AI models.
• Diagnostics processing for the scam checker is covered separately in paragraph 2.3.9.

Not stated here

• The text does not define "train our AI models" or say how "access" to private content is limited, given that the scam checker scans email content.

Cross-references

• contrast (model-proposed): Email scam checker: your data used in anonymized form to improve it — One paragraph says user data is used in anonymized form to improve the email scam checker; the next says Surfshark does not use any of your data to train its AI models. The policy does not say how improving the checker differs from training.

Data Access & Collection · Company practice

Message protection: sender number, SMS content, URLs and metadata scanned

For the message protection service, Surfshark collects the sender's phone number and the content of the SMS, including any URLs in it, plus metadata such as scan duration, total URL count and timestamp. The stated basis is that processing is essential to provide the service and carry out the service agreement. It says the collected data is only accessed for the brief period needed to perform the scan and give you the results. For message protection diagnostics it collects information such as user ID, sender's ID, sender's phone number, the SMS content and metadata such as scan duration; the policy refers to paragraph 2.3.9 for that.

Supporting quotations

2.2.9 Provision of message protection service

The sender's phone number and the content of the SMS, including any URL addresses indicated therein, metadata (e.g. scan duration, total URLs count, timestamp).

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

The collected data will only be accessed for the brief period necessary to perform the scan and provide you with the results.

You can find information about how your personal data is processed for message protection diagnostics in paragraph 2.3.9 of this privacy policy.

In the case of message protection diagnostics, we will collect information such as user ID, sender’s ID, sender's phone number, the content of the SMS, metadata (e.g. scan duration).

Qualifications & exceptions

• "Accessed" for a brief period is the wording used for retention in the table; the longer paragraph says message content is never stored or retained.
• Diagnostics collection for message protection is a separate, additional collection.

Not stated here

• "Brief period" is not defined.

Use & Processing · Company practice

Message protection: needs permission to read texts; content scanned but not stored

The message protection service automatically screens all future incoming messages for threats in real time. To do this it requires permission to read your text messages, and by enabling it you agree to allow future messages to be scanned. Surfshark processes the sender's phone number, message content, any links in it and metadata. Where necessary it engages trusted data processors. It says message content is scanned instantly and never stored or retained, though it may keep anonymized metadata for statistical purposes, and that the sender's number and related data shown in the app are stored locally on your device only.

Supporting quotations

To protect you from scam, our message protection service automatically screens all future incoming messages for potential threats in real time.

To do this, the feature requires permission to read your text messages. By enabling it, you agree to allow future messages to be scanned.

Where necessary, we engage trusted data processors to support message protection services.

Message content is scanned instantly for potential threats and is never stored or retained (though we may keep anonymized metadata for statistical purposes).

Please note that the sender’s phone number and related data displayed in the app are stored locally on your device only.

Qualifications & exceptions

• Applies once you enable the feature; enabling counts as agreeing to scan future messages.
• Never stored or retained is stated for message content; anonymized metadata may be kept for statistics.
• Trusted data processors may support the service "where necessary".

Not stated here

• The data processors are not named.
• How long anonymized metadata is kept is not stated.

Cross-references

• contrast (model-proposed): Scam, message and call diagnostics: content and numbers collected, kept up to 30 days — The message protection paragraph says message content is never stored or retained, while the diagnostics section lists the content of the SMS as collected and kept up to 30 days (with consent). The policy treats them as separate but does not explain how they fit together.

Data Access & Collection · Company practice

Call protection: caller number, classification and metadata

For the call protection service, Surfshark collects the caller's number, call classification and metadata such as scan duration and timestamp. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the collected data is only accessed for the brief period needed to run the scan and give you the results. For call protection diagnostics it collects the user ID, caller's number, call classification and metadata; the policy points to paragraph 2.3.9 for that.

Supporting quotations

2.2.10 Provision of call protection service

Caller’s number, call classification, metadata (e.g. scan duration, timestamp).

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

The collected data will only be accessed for the brief period necessary to perform the scan and provide you with the results.

You can find information about how your personal data is processed for call protection diagnostics in paragraph 2.3.9 of this privacy policy.

Additionally, in the case of call protection diagnostics, we will collect information such as the user ID, caller’s number, call classification, and metadata (e.g., scan duration, timestamp).

Qualifications & exceptions

• The retention wording is "accessed" for a brief period; the longer paragraph says the data is never stored on Surfshark's servers.
• Diagnostics collection is a separate, additional collection.

Not stated here

• "Brief period" is not defined.

Use & Processing · Company practice

Call protection: needs permission to scan calls and read call logs; no listening or recording

The call protection service automatically screens incoming calls for threats in real time. It requires permission to scan your phone calls and access your call logs. Surfshark processes call data such as the caller's number, call classification and metadata, and where necessary engages trusted data processors. It says this data is analyzed instantly and never stored or retained on its servers, though it may keep anonymized metadata for statistical purposes, and that caller details and call history shown in the app are stored locally on your device only. It also says it never accesses, listens to, or records your phone calls under any circumstances.

Supporting quotations

our call protection service automatically screens incoming calls for potential threats in real time. To provide this protection, the feature requires permission to scan your phone calls and access your call logs.

Where necessary, we engage trusted data processors to support these services.

The above mentioned data is analyzed instantly for potential threats and is never stored or retained on our servers (though we may keep anonymized metadata for statistical purposes).

Any caller details and call history displayed in the app are stored locally on your device only.

We respect your privacy and never access, listen to, or record your phone calls under any circumstances.

Qualifications & exceptions

• Applies once you grant the permission to scan calls and access call logs.
• Never stored on Surfshark's servers is stated for the call data; anonymized metadata may be kept.
• The no listening or recording statement is "under any circumstances".

Not stated here

• The data processors are not named.
• How long anonymized metadata is kept is not stated.

Use & Processing · Context

Data is also processed for security, operations, improvement and legal duties

Surfshark says it generally uses your data to provide the services, but also processes some of it for other legal reasons. These may not be a direct part of the services you use, but Surfshark says they matter for keeping things secure, running smoothly, making its offers better and meeting its legal duties. The details follow in the subsections of section 2.3.

Details not recorded for this card

Supporting quotations

2.3 Other personal data processing purposes

Nevertheless, we also process some of it for other legal reasons. These might not be a direct part of the Services you use, but they're also important for keeping things secure, running smoothly, making our offers better, and meeting our legal duties.

Qualifications & exceptions

• These purposes are separate from the service-delivery processing described earlier.

Data Access & Collection · Company practice

Account security: device details and last login kept; new-device login email

To ensure the security of your account, when you log in to the app Surfshark collects the device name, operating system, Surfshark app version and last login date. It says this helps it recognize your trusted devices and give better account security, and that it will email you if you log in from a new device that differs from your last-used devices. The email gives the login details; Surfshark urges you to change your password immediately if you did not log in, and encourages two-factor authentication. The legal basis stated is Surfshark's legitimate interest in the security of your account, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.3.1 To ensure the security of your account

Device name, operating system, Surfshark app version installed, last login date.

Legal basis for the processing of personal data is our legitimate interest to ensure the security of your account.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

when you log in to the Surfshark app, we collect the information indicated above. This helps us recognize your trusted devices and allows us to provide better security for your account. As part of this, we'll notify you by email if you log in from a new device that differs from your last-used devices.

This email will provide you with the login details. If you did not log in from this new device, it is crucial to change your password immediately to secure your account.

Qualifications & exceptions

• Collection happens when you log in to the Surfshark app.
• The notification is sent only for a login from a new device that differs from your last-used devices.
• The basis here is legitimate interest, not necessity for the service.

Security & Safeguards · Procedure

New-device login email: change your password if it was not you

The new-device login email gives you the login details. Surfshark says that if you did not log in from the new device, it is crucial to change your password immediately, and it strongly encourages you to enable two-factor authentication. It says prompt notice of logins from unfamiliar devices lets you act quickly if something looks suspicious.

Supporting quotations

This email will provide you with the login details. If you did not log in from this new device, it is crucial to change your password immediately to secure your account. We also strongly encourage you to enable two-factor authentication for enhanced protection.

Qualifications & exceptions

• This relates to the email sent when you log in from a device that differs from your last-used devices.
• The advice is guidance to you; the text does not say Surfshark will take any account action itself.

Data Access & Collection · Company practice

Customer support: your email and inquiry content kept up to 6 years

To let you submit an inquiry and communicate with customer support, Surfshark collects your email address, the content of your inquiry (including any information you share that is necessary to resolve the query) and the date and time of the inquiry. Its legal basis is your consent or its legitimate interest in giving you the necessary information. It keeps personal data related to customer support communications for up to 6 years after receiving your message.

Supporting quotations

2.3.2 To enable you to submit an inquiry and communicate with customer support

Your email address, the content of inquiry, including any information that you share with our customer support team that is necessary to resolve the query, date and time of inquiry.

We process your personal data with your consent or in our legitimate interest to provide you with the necessary information.

We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.

Qualifications & exceptions

• The basis is stated as "consent or legitimate interest", without saying which applies when.
• Retention is "up to 6 years" following receipt of your message.

Not stated here

• The text does not say when consent is the basis and when legitimate interest is.

Account & Service Control · Procedure

Customer support: identity verification is required before help

To protect the security and privacy of your account, Surfshark says it requires identity verification before it can assist with a customer support inquiry. It says this helps it protect your data and give you accurate and personalized support.

Supporting quotations

Surfshark requires identity verification before we can assist with your customer support inquiry.

Qualifications & exceptions

• Verification comes before Surfshark assists with the inquiry.

Not stated here

• What information or documents the identity verification requires is not stated.

Data Access & Collection · Company practice

Live chatbot: name, email and inquiry time kept up to 6 years

To let you interact with the live chatbot, Surfshark collects your name, email address and the date and time of your inquiry. Its stated basis is that processing is essential to provide the service and carry out the service agreement and/or its legitimate interest. It keeps personal data related to customer support communications for up to 6 years after receiving your message.

Supporting quotations

2.3.3 To enable you to interact with the live chatbot

Your name, email address, date and time of inquiry.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement and / or our legitimate interest.

We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.

Qualifications & exceptions

• The basis is given as "and / or", so the text does not say which applies to which processing.

Not stated here

• The text does not say whether chat message content is kept; only name, email and date and time are listed, but the retention line refers to customer support communications.

Data Access & Collection · Company practice

Transactional emails: your address and the email content kept while subscribed plus 2 years

To email you about important updates and announcements related to your use of the services and website, Surfshark collects your email address, the content of the email and the date and time it was sent. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.3.4 To contact you via email about important updates and announcements related to your use of the Services and Website (transactional communications)

Your email address, the content of the email address, date and time of email sent.

Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• These are service-related (transactional) communications, separate from marketing.

Use & Processing · Company practice

Marketing emails: processed on consent or legitimate interest until you opt out

To send you offers, surveys and other marketing content, Surfshark collects your email address, the content of the email and the date and time it was sent. Its legal basis is your consent or its legitimate interest in conducting marketing activities, and it processes your information until it receives your opt-out request. It may contact you by email for this purpose, but also encourages you to use its online contact form to get the best VPN offer.

Supporting quotations

2.3.5 To send you offers, surveys, and other marketing content

Your email address, the content of the email letter, the date and time of the email letter sent.

Legal basis for the processing of personal data is your consent or our legitimate interest to conduct marketing activities.

We will process your information until we receive your opt-out request.

We may contact you via email for this purpose, but we also encourage you to contact us via our online contact form to get the best VPN offer for you.

Qualifications & exceptions

• The basis is stated as "consent or legitimate interest", without saying which applies when.
• Processing continues until you opt out.

Not stated here

• The text does not say when consent is the basis and when legitimate interest is.

Use & Processing · Permission or license

Unfinished-order emails may be sent on legitimate interest

To help with your order, Surfshark says it might email you to let you know if a purchase was not completed. It bases this on its legitimate interest in improving your experience and helping with order issues.

Supporting quotations

to help you with your order, we might send an email letting you know if a purchase wasn't completed (unfinished order). This is based on our legitimate interest in improving your experience with us and assisting you with any issues related to your orders.

Qualifications & exceptions

• Stated as something Surfshark "might" do.
• The basis is legitimate interest, not consent.

Not stated here

• The text does not say whether the opt-out below stops these unfinished-order emails.

Account & Service Control · User right or choice

Opting out of marketing: per address, essential emails continue, other parties may still email

If you do not want emails from Surfshark, you can opt out by contacting support@surfshark.com or clicking unsubscribe at the bottom of any correspondence. If you have several email addresses you must opt out for each address to be removed from the active database. Surfshark will still contact you for essential service delivery, to answer your inquiries and to send transactional product or service-related updates. It also notes that you may still receive information about its services from other parties who use their own mailing lists.

Supporting quotations

If you do not wish to receive emails from us, you can opt out by contacting support@surfshark.com or by clicking “unsubscribe” at the bottom of any correspondence.

If you have multiple email addresses, you will need to opt out for each address to be removed from our active database.

However, we will continue to communicate with you for essential service delivery, to address your inquiries, and to provide transactional product or service-related updates.

you may still receive information about our Services from other parties who use their own mailing lists.

Qualifications & exceptions

• Opt-out is per email address.
• Essential service, inquiry and transactional communications continue after opt-out.
• Other parties' mailing lists are outside Surfshark's opt-out.

Not stated here

• Which parties use their own mailing lists is not stated.

Charges & Financial Obligations · Company practice

Referral program: referral link, rewards and your PayPal account details

To let you take part in the referral program, Surfshark collects your unique referral link, your rewards (the amount of money or months earned) and your PayPal account details. Its stated basis is that processing is essential to carry out the terms of its service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.3.6 To enable your participation in our referral program

Your unique referral link, your rewards (the amount of money or months earned), your Paypal account details.

Processing your personal data is essential for us to carry out the terms of our service agreement.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• PayPal account details are listed as collected for the referral program.

Data Access & Collection · Company practice

Social media accounts: your interactions kept until you delete them

To manage and administer its social network accounts, Surfshark collects interaction data such as likes, comments, full name, pseudonym, social network profile name and pictures. Its legal basis is its legitimate interest in engaging with the community and managing the accounts. It processes the information you provide until you delete your posted content or your social network account. Surfshark adds that when you share information on social networks such as Facebook or X, it does not control how those companies use or store it; they process it for their own reasons, including marketing, and you should check each platform's privacy policy.

Supporting quotations

2.3.7 To manage and administer our accounts on social networks

Your interaction data, e.g., likes, comments, full name, pseudonym, social network profile name, pictures.

Legal basis for the processing of personal data is our legitimate interest to engage with the community and to manage our social networks accounts.

We will process your provided information until you delete your posted content or social networks account.

when you share information on social network accounts, e.g., Facebook, X, we don't control how they use or store that data.

Qualifications & exceptions

• Retention ends when you delete your posted content or your social network account.
• The platforms' own processing is outside Surfshark's control.

Data Access & Collection · User right or choice

Cookies: control them in your browser; the Cookie Policy is part of this policy

You can control the use of cookies at the individual browser level on your device, and the policy points to section 7 for more on cookies and how to disable them. Section 7 says Surfshark and most sites use cookies, pixels, web beacons and similar technologies to help provide, protect and improve the services and website; you can reject them, but some things may not work completely or as well as they should. It says you can see which cookies Surfshark uses in its Cookie Policy, which it calls an integral part of this Privacy Policy.

Supporting quotations

You can control the use of cookies at the individual browser level on your device. More information about cookies and how to disable them can be found in Section 7 of this Privacy Policy.

7. How do we use cookies and other tracking technologies?

If you want to, you can reject those, but some things may not work completely or as well as they should.

You can check what cookies we use in our Cookie Policy which is an integral part of this Privacy Policy.

Qualifications & exceptions

• Cookie control is described at the browser level on your device.
• Rejecting cookies may mean some things do not work completely or as well as they should.
• The Cookie Policy is a separate linked document; its text is not part of this source.

Not stated here

• Which cookies Surfshark uses is not listed in this source; the Cookie Policy is linked but not supplied here.

Sharing & Disclosure · Company practice

Advertising partners help deliver ads, including interest-based and account-based advertising

Surfshark says its advertising partners help it attribute sales and deliver more relevant ads and promotional messages to you, which may include interest-based advertising and account-based advertising.

Supporting quotations

Our advertising partners help us attribute sales, deliver more relevant ads and promotional messages to you, which may include interest-based advertising and account-based advertising.

Qualifications & exceptions

• "May include" means interest-based and account-based advertising are examples, not stated as the full list.

Not stated here

• The advertising partners are not named here, and the text does not say which data they receive.

Cross-references

• contrast (model-proposed): CCPA opt out of sale or sharing; Surfshark says it does not sell data — Surfshark says it does not sell, rent, lease or trade personal data, while the policy describes advertising and marketing partners that help deliver ads and receive data for analytics and attribution. The policy does not say whether those disclosures count as sale or sharing under the CCPA.

Use & Processing · Company practice

App engagement data is used to measure campaigns and improve the experience

Surfshark says the limited technical and engagement data it collects through the app helps it measure campaign effectiveness and enhance user experience.

Supporting quotations

This information helps us measure campaign effectiveness and enhance user experience.

Qualifications & exceptions

• This describes the purpose of the app technical and engagement data covered in the previous section.

Use & Processing · Company practice

Market research uses aggregated, anonymized data, kept indefinitely

To carry out market research and internal analytics, Surfshark says it aggregates and anonymizes the data it collects for this purpose, and then maintains and uses the data only in anonymized form. Its legal basis for processing this deidentified data is its legitimate interest. Because the data is anonymized, it says it will process it indefinitely. It uses the aggregated statistical data to understand customer needs, analyze sales and identify business trends, using aggregated and/or inferred non-personal information.

Supporting quotations

2.3.12 To carry out market research and perform internal analytics

We aggregate and anonymize the data we collect for this purpose. We then maintain and use this data only in its anonymized form.

Legal basis for the processing of this deidentified data is our legitimate interest.

Since the data is anonymized we will process it indefinitely.

We create aggregated statistical data and conduct market research and analysis to understand customer needs, analyze sales, and identify other business trends.

Qualifications & exceptions

• Indefinite processing is stated only for data that has been anonymized.
• Surfshark describes the data as aggregated and/or inferred non-personal information.

Not stated here

• How the anonymization is done is not stated, and the text does not say which collected data feeds this analysis.

Retention & Deletion · Company practice

Legal compliance and claims: email, subscription and payment information kept as the law requires

To comply with legal requirements and to exercise or defend legal claims, Surfshark may collect your email address, subscription information, payment-related information, other necessary information and/or legal documents. Its basis is a legal obligation where it must collect data by law, and its legitimate interest in defending its rights and interests in other legal processes related to you. It retains the data for as long as the specific law indicates. It says it is subject to tax and other statutory requirements and may have to protect its legitimate interests and legal rights, in which case it may need to collect and store a limited amount of the listed data.

Supporting quotations

2.3.13 To comply with legal requirements, exercise or defend legal claims

Email address, subscription information, payment-related information, other necessary information and / or legal documents.

Legal basis for the processing of personal data is a legal obligation to which we are subject (in case we need to collect your data statutorily) and our legitimate interest to defend our rights and interests (in case of other legal processes related to you, if any).

We retain this data for as long as it is indicated in the specific law.

We may have to protect our legitimate interests and legal rights. In these cases, we may be required to collect and store a limited amount of your personal data indicated above

Qualifications & exceptions

• Two bases are given: legal obligation (statutory collection) and legitimate interest (other legal processes related to you, if any).
• The listed data is described as a limited amount, but includes "other necessary information and / or legal documents".

Not stated here

• What "other necessary information" and "legal documents" cover is not specified.

Cross-references

• qualifies (model-proposed): Right to erasure: deletion of data in Clause 2, unless legally required or another legal basis — The right to deletion does not apply where Surfshark is legally required or has a legal basis to keep data; the legal compliance section lists such data retained as the law requires.

Retention & Deletion · Restriction or exception

Data may be kept longer to meet legal duties, respond to governments or enforce contracts

Surfshark says it may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce its contracts and Terms of Service, including investigating potential violations.

Supporting quotations

We may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce our contracts and Terms of Service, including investigating potential violations.

Qualifications & exceptions

• Applies to longer retention beyond the usual period.
• "Including investigating potential violations" is an example of enforcement, not stated as the only one.

Not stated here

• No maximum length for this longer retention is stated, and the text does not say whether it covers data the policy elsewhere says is deleted within minutes or never stored.

Cross-references

• qualifies (model-proposed): Default retention: until no longer necessary or a valid removal request — Longer retention to comply with legal obligations, respond to government requests or enforce contracts qualifies the default rule of keeping data until it is no longer necessary.

Retention & Deletion · Company practice

Tax, payment issues, fraud and accounting: payment data kept 10 years

To collect applicable tax, solve payment related issues, prevent fraud and ensure accounting, Surfshark collects part of the credit card number, payment amount, currency, date of payment, card expiry date, and residence country and state. Its basis is a legal obligation, and it retains payment-related information for 10 years from receiving it. To calculate VAT or sales tax it collects your country and, where applicable, state of residence. If you choose to receive an invoice, it may also retain the necessary data to generate and issue the invoice.

Supporting quotations

2.3.14 To collect applicable tax, solve payment related issues, prevent fraud, and ensure accounting

Part of the credit card number, payment amount, currency, date of payment and card expiry date, residence country, state.

Legal basis for the processing of personal data is a legal obligation to which we are subject.

We will retain payment-related information for 10 years from the receipt of this information.

To calculate applicable VAT/sales tax, we collect your country and, where applicable, state of residence. Should you opt to receive an invoice for the services rendered, we may also retain the necessary data to generate and issue that invoice.

Qualifications & exceptions

• Retention is 10 years from receipt of the payment-related information.
• Invoice data is retained only if you opt to receive an invoice.

Data Access & Collection · Company commitment

Audited no-logs policy and only the minimum data needed to provide the services

Surfshark says having an audited No-logs Policy is one of its core principles, referring to its Terms of Service, and that it therefore collects only the minimum amount of data about you that is required to provide you with its services.

Supporting quotations

having an audited No-logs Policy is one of our core principles (see more in our Terms of Service), therefore we collect only the minimum amount of data about you, which is required to provide you with our Services.

Qualifications & exceptions

• The audited no-logs claim refers to the Terms of Service, which are not part of this source.

Not stated here

• Who audits the no-logs policy, and what the audit covers, are not stated in this source.

Retention & Deletion · Company practice

Default retention: until no longer necessary or a valid removal request

Unless the policy specifies differently, Surfshark says it retains your personal data until it is no longer necessary for the reasons it originally collected it, or until it receives a valid request to remove it, with some exceptions.

Supporting quotations

unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.

Qualifications & exceptions

• This is the default; the per-service periods in section 2 apply where they are specified.
• The rule is subject to "some exceptions", and the next sentence of the policy adds storage beyond the stated timeframes for legal reasons.

Not stated here

• What the "some exceptions" to removal on request are is not listed in this passage.

Cross-references

• qualified by (model-proposed): Data may be kept longer to meet legal duties, respond to governments or enforce contracts — Longer retention to comply with legal obligations, respond to government requests or enforce contracts qualifies the default rule of keeping data until it is no longer necessary.

Use & Processing · Company practice

Data may be stored and processed in any country with Surfshark facilities or providers

Surfshark says your data, as specified in the policy, may be stored and processed in any country where it has facilities or where it engages service providers. It says it carefully assesses all international transfers and implements appropriate safeguards so your personal data remains protected as outlined in the policy, and that wherever your data needs to be sent it takes extra care to keep it safe.

Supporting quotations

Wherever your personal data needs to be sent, we always take extra care to keep it safe and sound.

Your data, as specified in this Privacy Policy, may be stored and processed in any country where we have facilities or in which we engage service providers. We carefully assess all international data transfers and implement appropriate safeguards to ensure your personal data remains protected as outlined in this Privacy Policy.

Qualifications & exceptions

• The scope is any country where Surfshark has facilities or engages service providers; no list of countries is given.
• Only data "as specified in this Privacy Policy" is covered.

Not stated here

• The countries involved are not named, and the "appropriate safeguards" are described only for transfers out of the EEA.

Legal Rights & Agreement Rules · Company practice

EEA transfers rely on Standard Contractual Clauses or adequacy decisions

Surfshark says it uses Standard Contractual Clauses approved by the European Commission to transfer personal data from the EEA to countries outside the EEA, for example the USA, or it transfers personal data to countries the European Commission has recognized as ensuring an adequate level of data protection. The policy links to the Commission pages describing these.

Supporting quotations

we use Standard Contractual Clauses approved by the European Commission (you can access it here) to transfer your personal data from the EEA to other countries outside the EEA territory (e.g., the USA) or we transfer personal data to countries that the European Commission has recognized as ensuring an adequate level of data protection

Qualifications & exceptions

• The mechanisms named are for transfers from the EEA.
• The USA is given as an example of a destination outside the EEA.

Not stated here

• The text does not say what safeguards apply to transfers that do not originate in the EEA.
• The linked Commission pages are not part of this source.

Sharing & Disclosure · Company practice

Sharing: only with authorized parties, as necessary and allowed by law

Surfshark says it needs third-party tools and services for things like marketing, payments and live chat, and encourages you to read their terms and policies since they do not belong to Surfshark. It says it shares personal data with authorized parties only where necessary for the purposes described in the policy and allowed under applicable laws. It then lists the categories of third parties to which, in the preceding 12 months, it disclosed strictly necessary personal data for an operational purpose, with each category's purpose and the recipient countries.

Supporting quotations

It takes a village to keep our Website and Services up and running and we want to be transparent about what types of personal data we've shared and with whom, all for legitimate business reasons.We need third- party tools and services for things like marketing, payments, live chat, and so forth. Since these don’t belong to us, we urge you to read their terms and policies on their sites.

Surfshark shares personal data with the authorized parties only in cases where necessary for the purposes described in this Privacy Policy and allowed in accordance with applicable laws.

5.1 In the preceding 12 months, we have disclosed strictly necessary personal data for an operational purpose to the following categories of third parties:

Qualifications & exceptions

• Sharing is limited to authorized parties, to what is necessary for the purposes in the policy and to what applicable laws allow.
• The disclosure list covers the preceding 12 months and data disclosed for an operational purpose.

Not stated here

• The list does not say which categories of personal data go to each recipient category; it states recipient categories, purposes and countries.
• The 12-month period is measured from the time the policy was written, which is not stated beyond the last-updated date.

Sharing & Disclosure · Company practice

Marketing and app analytics providers (Iterable, Firebase Analytics, Purchasely, Appsflyer)

Surfshark discloses data to marketing and application analytics service providers such as Iterable, Firebase Analytics (by Google), Purchasely and Appsflyer. It uses them to manage its contacts, automate its marketing and gather analytics. The stated recipient countries are the United States, Sweden, France, Ireland and the United Kingdom. In the app-data section it adds that technical and engagement data goes to such providers for performance attribution, marketing engagement and subscription flow management.

Supporting quotations

Marketing and application analytics service providers, such as Iterable, Firebase Analytics (by Google), Purchasely and Appsflyer.

We use them to manage our contacts, automate our marketing, gather analytics.

United States, Sweden, France, Ireland, United Kingdom.

This data is shared with trusted service providers, such as AppsFlyer and Firebase Analytics for performance attribution, Iterable for marketing engagement, and Purchasely for subscription flows management and optimization.

Qualifications & exceptions

• Providers are listed with "such as", so the list is not stated as complete.

Not stated here

• Which personal data each provider receives is not itemized here.

Sharing & Disclosure · Company practice

Performance marketing providers (Hasoffers / Tune Inc.)

Surfshark discloses data to performance marketing service providers such as Hasoffers (Tune Inc.), which it uses to calculate its conversion attribution. The stated recipient country is the United States.

Supporting quotations

Performance marketing service providers, such as Hasoffers (Tune Inc.).

We use them to calculate our conversion attribution.

United States

Qualifications & exceptions

• Provider listed as an example ("such as").

Not stated here

• Which personal data is shared is not itemized here.

Sharing & Disclosure · Company practice

Payment providers (Stripe, Adyen, Checkout, Coingate and similar)

Surfshark discloses data to third-party payment providers such as Stripe, Adyen, Checkout, Coingate and similar. They help it process payments together with its own authorized payment processing companies. The stated recipient countries are the United States, Ireland and the British Virgin Islands. In the account-data section Surfshark adds that payment partners collect details like the transaction date, payer IP address, credit card number and cardholder name, and sometimes a personal ID, passport or address depending on location.

Supporting quotations

Third-party payment providers, such as Stripe, Adyen, Checkout, Coingate and similar.

They help us to process payments together with our own authorized payment processing companies.

United States, Ireland, British Virgin Islands.

our trusted payment partners collect necessary details like the transaction date, payer’s IP address, credit card number, and the cardholder's full name.

Qualifications & exceptions

• Providers are listed with "such as" and "and similar".
• What payment partners collect and keep is governed by their own terms and privacy policies.

Not stated here

• The identity and role of Surfshark's "own authorized payment processing companies" is not stated.

Sharing & Disclosure · Company practice

Storage and infrastructure providers (BigQuery by Google)

Surfshark discloses data to storage and infrastructure service providers such as BigQuery (by Google), which help it store, analyze and manage data. The stated recipient country is the United States.

Supporting quotations

Storage and infrastructure service providers, such as BigQuery (by Google).

They help us to store, analyze, and manage data.

United States

Qualifications & exceptions

• Provider listed as an example ("such as").

Not stated here

• Which personal data is stored there is not itemized here.

Sharing & Disclosure · Company practice

Live chat and support providers (Zendesk)

Surfshark discloses data to live chat and support service providers such as Zendesk, which it uses to provide live chat technology and support to users. The stated recipient country is the United States.

Supporting quotations

Live chat and support service providers, such as Zendesk.

We use them to provide live chat technology and provide support to our users.

United States

Qualifications & exceptions

• Provider listed as an example ("such as").

Not stated here

• Which personal data these providers receive is not itemized here.

Sharing & Disclosure · Company practice

Security providers (Cloudflare)

Surfshark discloses data to security service providers such as Cloudflare, with which it works to provide improved security and performance. The stated recipient country is the United States.

Supporting quotations

Security service providers, such as Cloudflare.

We work with them to provide improved security and performance.

United States

Qualifications & exceptions

• Provider listed as an example ("such as").

Not stated here

• Which personal data is disclosed is not itemized here.

Sharing & Disclosure · Company practice

Alternative ID providers (Telnyx)

Surfshark discloses data to providers that help deliver the Alternative ID service, such as Telnyx, to provide Alternative ID services such as Alternative Number. The stated recipient country is the United States.

Supporting quotations

Providers that help us deliver the Alternative ID service, such as Telnyx.

We work with them to provide you with Alternative ID services (such as Alternative Number).

United States

Qualifications & exceptions

• Provider listed as an example ("such as").

Not stated here

• Which personal data is disclosed, for example whether call and SMS content, is not itemized here.

Sharing & Disclosure · Company practice

Group companies

Surfshark shares data with its group companies to support its daily operations and ensure it can continue providing services. The stated recipient countries are the EEA, the United States and the United Kingdom.

Supporting quotations

Group companies.

We share data with our group companies to support our daily operations and ensure Surfshark can continue providing you with Services.

EEA, United States, United Kingdom.

Qualifications & exceptions

• The text does not name the group companies.

Not stated here

• Which group companies receive data, and which personal data, is not stated.

Sharing & Disclosure · Company practice

Distribution, reseller and app store partners as independent controllers

Surfshark shares personal data with its distribution, reseller and app store partners, each of which is an independent controller of your personal data. The stated recipient country is the United States.

Supporting quotations

Other Surfshark’s partners.

We share your personal data with our distribution, reseller, and app store partners, each of which is an independent controller of your personal data.

United States

Qualifications & exceptions

• These partners are independent controllers, so their handling of your data is under their own policies.

Not stated here

• Which personal data these partners receive is not itemized here.

Sharing & Disclosure · Company practice

Third parties whose services you buy through Surfshark

Surfshark may provide your personal data to third parties that deliver services you buy through Surfshark. It says it shares only the minimum amount of data necessary, for example your email address, so you can receive the services you requested, and that each of these companies acts as an independent controller of your personal data. The stated recipient countries are the EEA and the United States.

Supporting quotations

Third parties whose services you buy through us.

We may provide your personal data to the third parties that deliver the services you buy through us. We only share the minimum amount of data necessary (e.g. your email address) to enable you to receive the services you have requested. Each of these companies acts as an independent controller of your personal data.

EEA, United States

Qualifications & exceptions

• Sharing is limited to the minimum necessary, with your email address given as an example.
• Each such company is an independent controller.

Not stated here

• The third parties are not named.

Sharing & Disclosure · Company practice

Corporate reorganization: data may be shared with the buyer, agents and advisors

If Surfshark undergoes a corporate reorganization such as a merger, acquisition or sale of its business, it may share personal data with the involved third parties, for example the buyer, their agents and advisors, to help complete the transaction. The policy also names bankruptcy or liquidation proceedings in the recipient category. Where EU or UK data protection laws apply, its legal basis is its legitimate interest in conducting business, or your consent if required by law.

Supporting quotations

5.2 There are a few more cases in which we can share your information with other authorized parties:

Third parties (in case of corporate reorganization, bankruptcy or liquidation proceedings).

If we undergo a corporate reorganization (like a merger, acquisition, or sale of our business), we may share personal data with the involved third parties (e.g., the buyer, their agents, and advisors) to help complete the transaction.

When EU or UK data protection laws apply, our legal basis for this is our legitimate interest in conducting business, or your consent if required by law.

Qualifications & exceptions

• Sharing is "to help complete the transaction".
• The stated legal basis applies when EU or UK data protection laws apply.

Not stated here

• The text does not say what the legal basis is where EU or UK laws do not apply, or what happens to your data after the transaction.

Sharing & Disclosure · Company commitment

Law enforcement and courts: disclosure only when asked and legally obliged

Surfshark says it discloses personal data to law enforcement authorities or courts of competent jurisdiction only when it is asked and legally obliged to do so. Its Transparency report page will display if it is ever asked.

Supporting quotations

Authorities

We only disclose personal data to law enforcement authorities or courts of competent jurisdiction when we are asked and legally obliged to do so

Qualifications & exceptions

• Disclosure requires both a request and a legal obligation.
• The Transparency report page is a linked page not included in this source.

Not stated here

• What the Transparency report shows, and whether it has recorded any requests, is not stated here.

Legal Rights & Agreement Rules · Company commitment

Law enforcement disclosures: legal obligation, and a Transparency report page

For disclosures to law enforcement authorities or courts, the policy gives the legal ground as legal obligation. Surfshark says its Transparency report page will display if it is ever asked to make such a disclosure.

Supporting quotations

(our Transparency report page will display if we’re ever asked to do so)

Legal ground

Legal obligation

Qualifications & exceptions

• The ground stated for this category is a legal obligation.

Not stated here

• The text does not say how quickly or in what detail the Transparency report is updated.

Sharing & Disclosure · Company commitment

Other parties: disclosure only with your permission or for a legal reason

Surfshark says it will disclose your personal data to others only if you give permission or if there is a legal reason, for example sharing it with a legal representative. The stated legal ground is legal obligation, legitimate interest or your consent.

Supporting quotations

Other parties

We'll only disclose your personal data with others if you give us permission or if there's a legal reason to do so (e.g., we might share it with a legal representative).

Legal obligation, legitimate interest, or your consent.

Qualifications & exceptions

• Disclosure requires your permission or a legal reason; the legal representative is an example ("e.g.").
• The legal ground is stated as one of three alternatives without saying which applies when.

Not stated here

• What other legal reasons count is not listed.

Account & Service Control · User right or choice

Privacy rights: ask by emailing support, available except as limited by law

Surfshark says it respects the GDPR, CCPA and other privacy laws, and that you can ask it to delete your personal data or exercise other rights by emailing support@surfshark.com. It says the rights described below are available "as available and except as limited under applicable law", and that it has added transparency to help users use those rights.

Supporting quotations

We respect GDPR, CCPA, and other privacy legislation, and you can ask us to delete your personal data or implement other rights by emailing us at support@surfshark.com.

You may be aware that the GDPR, CCPA, and other privacy laws give certain rights to individuals in relation to their personal data. Accordingly, we have implemented additional transparency to help users take advantage of those rights.

As available and except as limited under applicable law, individuals have the rights described below:

Qualifications & exceptions

• The rights are available as available and except as limited under applicable law.
• The way to exercise them is by emailing support@surfshark.com.

Not stated here

• No response time or identity-verification step is stated in this section.

Account & Service Control · User right or choice

Right to access: get your data or a copy by contacting Surfshark

You can access your personal data or receive a copy of it by contacting Surfshark.

Supporting quotations

Right to access You can access your personal data or receive a copy of it by contacting us.

Qualifications & exceptions

• Subject to the general limit that rights are available as available and except as limited under applicable law.

Account & Service Control · User right or choice

Right to portability: structured copy, only for consent-based automated processing

You can ask Surfshark for a copy of your personal data in a structured, commonly used and machine-readable format or, where technically feasible, ask it to transmit the data directly to another controller. This applies only where its processing, carried out by automated means, is based on your consent.

Supporting quotations

Right to portability You can ask us to provide you with a copy of your personal data in a structured, commonly used, and machine-readable format or, where it is technically feasible, to transmit that data directly to another controller. This right applies only where our processing, carried out by automated means, is based on your consent.

Qualifications & exceptions

• Applies only where the processing is carried out by automated means and based on your consent.
• Direct transmission to another controller is only where technically feasible.

Not stated here

• The text does not say which of Surfshark's processing activities are consent-based for this right, beyond the legal basis listed per activity.

Account & Service Control · User right or choice

Right to rectification: correct inaccurate data and complete incomplete data

You can ask for inaccurate personal data to be corrected and, subject to the nature of the collection and use, for incomplete personal data to be completed.

Supporting quotations

Right to rectification You can ask for the correction of inaccurate personal data and, subject to the nature of the collection and use, the completion of incomplete personal data.

Qualifications & exceptions

• Completion of incomplete data is subject to the nature of the collection and use.

Account & Service Control · User right or choice

Right to erasure: deletion of data in Clause 2, unless legally required or another legal basis

You have the right to deletion of your personal data specified in Clause 2, unless Surfshark is legally required, or has a legal basis, to maintain certain personal data.

Supporting quotations

Right to erasure Right to deletion of your personal data specified in Clause 2, unless we are legally required or we have a legal basis to maintain certain personal data.

Qualifications & exceptions

• Applies to personal data specified in Clause 2 (the section describing what is collected).
• Does not apply to data Surfshark is legally required or has a legal basis to keep, for example the 10-year payment record retention described in section 2.3.14.

Not stated here

• Which data Surfshark treats as covered by a legal basis to keep is not listed in this section.

Cross-references

• qualified by (model-proposed): Legal compliance and claims: email, subscription and payment information kept as the law requires — The right to deletion does not apply where Surfshark is legally required or has a legal basis to keep data; the legal compliance section lists such data retained as the law requires.

Account & Service Control · User right or choice

Right to withdraw consent at any time, with no effect on earlier processing

If Surfshark collected and processed your personal data with your consent, you can withdraw consent at any time. Withdrawing does not affect the lawfulness of processing before the withdrawal, or processing based on lawful grounds other than consent.

Supporting quotations

Right to withdraw consent If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

Qualifications & exceptions

• Applies to processing based on consent.
• Earlier processing and processing under other lawful grounds are unaffected.

Account & Service Control · User right or choice

Right to object to processing based on legitimate interests

You can object to Surfshark processing your personal data when it does so based on its legitimate interests.

Supporting quotations

Right to object You can object to us processing your personal data when we do so based on our legitimate interests.

Qualifications & exceptions

• Applies only to processing based on legitimate interests.

Not stated here

• The text does not say what happens after an objection.

Legal Rights & Agreement Rules · User right or choice

Right to complain to the UK ICO or an EU supervisory authority

If you are located in the UK you have the right to lodge a complaint with the Information Commissioner's Office. If you are located in the EU, you have the right to lodge a complaint with the relevant Supervisory Authority.

Supporting quotations

Right to lodge a complaint If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner’s Office. If you are located in the EU, you have the right to lodge a complaint with the relevant Supervisory Authority.

Qualifications & exceptions

• Depends on whether you are located in the UK or the EU.

Not stated here

• The text does not say what complaint route applies elsewhere.

Account & Service Control · User right or choice

Additional rights for individuals covered by the CCPA

In addition to the rights above, further rights, which may be subject to certain exemptions or derogations, also apply to individuals covered by the CCPA.

Supporting quotations

In addition to the above rights, the following rights (which may be subject to certain exemptions or derogations) shall also apply to individuals covered by the CCPA:

Qualifications & exceptions

• Applies to individuals covered by the CCPA and may be subject to exemptions or derogations.

Sharing & Disclosure · User right or choice

CCPA opt out of sale or sharing; Surfshark says it does not sell data

Under the CCPA you have the right to opt out of the sale or sharing of your personal information to third parties. Surfshark says it does not sell, rent, lease or trade your personal data with anyone, and does not plan to in the future.

Supporting quotations

Right to Opt Out of Sale/Sharing You have the right to opt out of the sale or sharing of your personal information to third parties. However, we would like to inform you that we do not sell, rent, lease, or trade your personal data with anyone, nor do we plan to do so in the future.

Qualifications & exceptions

• The opt-out right applies to individuals covered by the CCPA.
• The no-sale statement is Surfshark's own description; sharing with providers and partners is described in section 5.

Not stated here

• The text does not say how it distinguishes "sale or sharing" under the CCPA from the disclosures to marketing, analytics and advertising partners described in section 5.

Cross-references

• contrast (model-proposed): Advertising partners help deliver ads, including interest-based and account-based advertising — Surfshark says it does not sell, rent, lease or trade personal data, while the policy describes advertising and marketing partners that help deliver ads and receive data for analytics and attribution. The policy does not say whether those disclosures count as sale or sharing under the CCPA.

Account & Service Control · User right or choice

CCPA non-discrimination for exercising privacy rights

Under the CCPA you have the right not to receive discriminatory treatment if and when you exercise your privacy rights.

Supporting quotations

Right to Non-Discrimination You have the right to not receive discriminatory treatment if and when you exercise your privacy rights under the CCPA.

Qualifications & exceptions

• Applies to individuals covered by the CCPA.

Account & Service Control · User right or choice

CCPA right to limit sensitive information; Surfshark says it does not trigger this right

Under the CCPA you have the right to limit the use of your sensitive personal information when its use goes beyond what is necessary to provide the services or certain other permissible purposes such as fraud prevention. Surfshark says it does not process personal information in a manner that gives rise to this right.

Supporting quotations

Right to Limit Use of Sensitive Personal Information. You have the right to limit the use of your sensitive personal information when such use goes beyond that which is necessary for providing the Services or certain other permissible purposes (e.g., fraud prevention). However, Surfshark does not process personal information in a manner that gives rise to this right.

Qualifications & exceptions

• Applies to individuals covered by the CCPA.
• The statement that no processing gives rise to this right is Surfshark's own.

Not stated here

• The text does not say how that statement fits with the Alert service, which can retain personal identity or social security numbers and credit card numbers you submit.

Cross-references

• contrast (model-proposed): Alert service: email, ID or card numbers you submit are kept, with some encrypted — Surfshark says it does not process personal information in a way that triggers the right to limit use of sensitive personal information, while the Alert service lets you submit a social security number or credit card number, which Surfshark retains (encrypted). The policy does not explain how these fit together.

Data Access & Collection · Company practice

Cookies, pixels and web beacons are used to provide, protect and improve services; you can reject them

Surfshark says it, like most sites, uses cookies, pixels, web beacons and similar technologies (collectively "cookies") to help provide, protect and improve its services and website. You can reject them if you want, but some things may not work completely or as well as they should.

Supporting quotations

Most sites on the internet, including Surfshark’s, use cookies, pixels, web beacons, and other similar technologies (collectively called “cookies”), as they’re pretty convenient to help provide, protect, and improve our Services and Website. If you want to, you can reject those, but some things may not work completely or as well as they should.

Qualifications & exceptions

• "Cookies" is defined to include pixels, web beacons and other similar technologies.
• Rejecting cookies may reduce how well some things work.

Not stated here

• The specific cookies and their purposes are in the Cookie Policy, which is not part of this source.

Legal Rights & Agreement Rules · Context

The Cookie Policy is an integral part of this Privacy Policy

Surfshark says you can check which cookies it uses in its Cookie Policy, and that the Cookie Policy is an integral part of this Privacy Policy.

Supporting quotations

You can check what cookies we use in our Cookie Policy which is an integral part of this Privacy Policy.

Qualifications & exceptions

• The Cookie Policy is a separate linked document whose text is not part of this source.

Not stated here

• The linked Cookie Policy's text is not supplied here, so this card cannot say what it contains or whether it changes anything stated in this document.

Security & Safeguards · Company commitment

Security measures: encryption in transit, hashed passwords, firewalls and regular audits

Surfshark says it has implemented appropriate organizational, physical and technical security measures, including SSL/TLS encryption for data transfers, hashed passwords, firewalls and regular audits, and that it takes all reasonably necessary steps to ensure your personal data is treated securely. It also says no one can honestly promise 100% anything-proof security.

Supporting quotations

anyone who tells you that 100% anything-proof security is possible either doesn’t know much about it or is trying to mislead you.

We have implemented appropriate organizational, physical and technical security measures, including SSL/TLS encryption for data transfers, hashed passwords, firewalls, and regular audits. We take all the reasonably necessary steps to ensure that your personal data is treated securely.

Qualifications & exceptions

• The measures are described as "appropriate" and "including" the listed examples, so the list is not stated as complete.
• The commitment is to reasonably necessary steps, not a guarantee.

Not stated here

• Who carries out the regular audits and what they cover is not stated here.

Security & Safeguards · Restriction or exception

Surfshark cannot guarantee 100% security; you accept information is provided at your own responsibility

Surfshark says 100% security is not always possible, that giving out information online carries a risk that a third party may intercept and use it, and that it cannot guarantee 100% security of any information you disclose online. By using the services you expressly acknowledge and agree that it cannot guarantee the security of information provided to or received by it through the services, and that information received from you through the website or services is provided under your own responsibility.

Supporting quotations

we cannot guarantee 100% security of any information you disclose online. By using the Services, you expressly acknowledge and agree that we cannot guarantee the security of any information provided to or received by us through the Services and that any general information, other information, or information received from you through the Website or our Services is provided under your own responsibility.

Qualifications & exceptions

• The acknowledgment applies to using the services.
• The wording covers information provided to or received by Surfshark through the Services.

Not stated here

• The text does not say how this acknowledgment affects Surfshark's responsibility for its own security failures; the legal effect is not explained here.

Data Access & Collection · Company commitment

No services or knowing data collection for anyone under 18; data found is deleted right away

Surfshark says it does not knowingly collect or solicit personal data from anyone under 18 and does not offer its services to them. It asks anyone under 18 not to send personal data. If it finds it has received personal data from someone under 18, it says it will delete it right away. If you believe it might have such data, you can contact support@surfshark.com.

Supporting quotations

We do not knowingly collect or solicit personal data from anyone under the age of 18.

We don't offer services to anyone under 18 and don't knowingly collect personal data from them. If you're under 18, please don't send us any personal data. If we find out that we have received personal data from someone under 18, we will delete it right away.

Qualifications & exceptions

• The commitment is about knowing collection; "if we find out" triggers deletion.
• The age threshold stated is 18.

Not stated here

• The text does not describe any age verification.

Account & Service Control · Procedure

Contact: 24/7 support by email or website chat

Surfshark says its 24/7 Customer Support Team will help as soon as it can. For questions, concerns or complaints about the policy or its services, or to exercise your privacy rights, you can email support@surfshark.com or chat with Surfshark on the website.

Supporting quotations

Our 24/7 Customer Support Team will help you out as soon as they can.

If you have any questions, concerns or complaints relating to this Privacy Policy and / or Surfshark Services, or you would like to exercise your privacy rights, please feel free to contact us at the following email address support@surfshark.com or chat with us on the Website.

Qualifications & exceptions

• The 24/7 availability is stated for the Customer Support Team; the response time is "as soon as they can".

Not stated here

• No response deadline is stated.

Legal Rights & Agreement Rules · Restriction or exception

The English version prevails over translations

Surfshark says the English version of the policy prevails. Translations may be provided but may not be fully up to date or comprehensive, and if the English and a translated version conflict, the English version always takes precedence.

Supporting quotations

The English version of this Privacy Policy prevails.

While translations of this Privacy Policy may be provided in other languages, they may not be fully up-to-date or comprehensive. Thus, in case of any conflict between the English version and the translated versions of this Privacy Policy, the English version shall always take precedence.

Qualifications & exceptions

• Applies to conflicts between the English version and translations.

Use & Processing · Company practice

Discount eligibility: subscription information used, kept while subscribed plus 2 years

To decide eligibility for subscription discounts, Surfshark uses information related to your subscription. Its legal basis is its legitimate interest in enhancing your experience, and it keeps the data for as long as your subscription is active and for 2 years after the last login.

Supporting quotations

2.3.8 To determine eligibility for subscription discounts through automated decision-making, including profiling

Information related to your subscription.

We use your personal data because it's in our legitimate interest to enhance your experience.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Qualifications & exceptions

• The stated basis is legitimate interest in enhancing your experience.

Not stated here

• Which subscription details are used is not listed; the text says only "information related to your subscription".

Inference & Profiling · Company practice

Automated decision-making and profiling may decide whether you get a discount

Surfshark may use automated decision-making, including profiling, to evaluate whether to apply a discount to the price of a subscription you purchase, and says this will not increase the price. It explains that profiling means automated use of personal data to evaluate personal aspects of a person, and automated decision-making means deciding by automated means with no human involvement. It says its system may generate decisions using a very limited amount of your personal data, for example information related to your subscription.

Supporting quotations

We may use an automated decision-making, including profiling, process to evaluate whether to apply a discount to the price of the subscription a user purchases. This will not increase the price of the subscription you want to purchase.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person. Automated decision-making is the process of deciding by automated means without any human involvement.

Our system may automatically generate decisions using a very limited amount of your personal data (for example, information related to your subscription).

Qualifications & exceptions

• The automated evaluation is about whether to apply a discount; Surfshark says it will not increase the price you want to purchase.
• Surfshark says it uses a "very limited amount" of personal data.

Not stated here

• What factors the system uses, and what makes a user eligible for a discount, are not stated.

Account & Service Control · User right or choice

You can challenge a solely automated decision and ask for human review

If a decision based solely on automated processing produces legal consequences for you or otherwise significantly affects you, you keep the right to challenge it, express your viewpoint and request human involvement. You do this by contacting support@surfshark.com. Surfshark says it will assess your request and provide a human examination of the decision.

Supporting quotations

In instances where a decision based solely on automated processing produces legal consequences for you, or otherwise significantly affects you, you retain the right to challenge the decision, express your viewpoint, and request human involvement.

You can achieve this by contacting us at support@surfshark.com. We will assess your request and provide a human examination of the decision

Qualifications & exceptions

• The right applies where a decision based solely on automated processing has legal consequences or otherwise significantly affects you.
• You exercise it by contacting support@surfshark.com.

Not stated here

• No response time is stated.
• The text does not say whether the discount decisions described above fall in the category that significantly affects you.

Data Access & Collection · Company practice

Diagnostics and crash reports: collected on consent, kept up to 7 days

To maintain and improve the quality of its services and support, Surfshark collects diagnostics information and monitors crash reports on its apps and extensions. This includes aggregated performance information, how often you use the services, unsuccessful connection attempts, device information and similar information. Its legal basis is your consent, and it keeps the data until you withdraw consent but no longer than 7 days from receipt. Surfshark says diagnostics information does not contain uniquely identifiable information, except for the email scam checker and message protection diagnostics described separately. If you have problems, it may need your device information, and says it will access that only if you give a separate consent.

Supporting quotations

2.3.9 To maintain and improve the quality of our Services and provide effective support (diagnostics and crash reporting)

Aggregated performance information, the frequency of use of Services, unsuccessful connection attempts, device information, and other similar information.

Legal basis for such processing is your consent.

We keep your personal data until you withdraw your consent, but no longer than 7 days from its receipt.

we collect diagnostics information and monitor crash reports on our apps and extensions. Please note that diagnostics information does not contain uniquely identifiable information (except as provided below regarding email scam checker service, message protection service).

However, if you face some problems when using our apps, we may require your device information to solve these problems. We will access this information only if you provide a separate consent for that.

Qualifications & exceptions

• Consent is the stated basis and the maximum keep time is 7 days from receipt.
• The no uniquely identifiable information statement has stated exceptions.
• Device information for troubleshooting needs a separate consent.

Not stated here

• "Other similar information" is not defined.
• The exception to the no uniquely identifiable information statement names the email scam checker and message protection only, although the call protection diagnostics also list the user ID and the caller's number.

Data Access & Collection · Company practice

Scam, message and call diagnostics: content and numbers collected, kept up to 30 days

For diagnostics of the email scam checker, Surfshark collects the sender's name and email address, the receiver's email address, the subject, the content of the email and attachment metadata (file name and type). For message protection diagnostics it collects the user ID, sender's ID, sender's phone number, the SMS content and metadata such as scan duration. For call protection diagnostics it collects the user ID, caller's number, call classification and metadata such as scan duration and timestamp. The basis is your consent. For message protection and call protection diagnostics, it keeps the data until you withdraw consent but no longer than 30 days from receipt. For the email scam checker diagnostics it says the amount of personal data collected is minimal and necessary.

Supporting quotations

In the case of email scam checker diagnostics, we will collect information including the sender's name and email address, the receiver's email address, the email subject, the content of the email, and any attachments metadata (file name, file type).

In the case of message protection diagnostics, we will collect information such as user ID, sender’s ID, sender's phone number, the content of the SMS, metadata (e.g. scan duration).

In the case of call protection diagnostics, we will collect information such as user ID, caller’s number, call classification, metadata (e.g. scan duration, timestamp).

In the case of message protection, call protection diagnostics, we keep your personal data until you withdraw your consent, but no longer than 30 days from its receipt.

In the case of email scam checker diagnostics, we will collect a minimal amount of necessary personal data.

Qualifications & exceptions

• Collection is based on your consent.
• The 30-day maximum is stated for message protection and call protection diagnostics; for the email scam checker diagnostics the text points to the general diagnostics line (up to 7 days), without saying so directly.
• This is a separate collection from the scan itself, which the earlier sections say does not store message or call content.

Not stated here

• The text does not say which retention period applies to email scam checker diagnostics.
• How these diagnostics collections fit with the earlier statements that message content is scanned instantly and never stored or retained is not explained.

Cross-references

• contrast (model-proposed): Message protection: needs permission to read texts; content scanned but not stored — The message protection paragraph says message content is never stored or retained, while the diagnostics section lists the content of the SMS as collected and kept up to 30 days (with consent). The policy treats them as separate but does not explain how they fit together.

Data Access & Collection · Company practice

Trusted Wi-Fi auto-connect: Wi-Fi name read with your consent, kept on your device

To enable auto-connect for a trusted Wi-Fi network, Surfshark processes location data, specifically the Wi-Fi name (SSID). Its basis is your consent, and it processes the data until you withdraw consent. With your permission it accesses your device's location data strictly to identify the Wi-Fi network name. Surfshark says this data remains solely on your device and is never sent to its servers or shared with third parties, and that no physical location data is stored or shared.

Supporting quotations

2.3.10 To enable the auto-connect feature for the trusted Wi-Fi network

Location data (i.e specifically Wi-Fi name or Service Set Identifier).

Legal basis for such processing is your consent.

We will process your personal data until you withdraw your consent.

With your permission, we access your device's location data strictly to identify the Wi-Fi network name (SSID). This enables auto-connect and trusted network features. This data remains solely on your device and it is never transmitted to our servers or shared with third parties. No physical location data is stored or shared.

Qualifications & exceptions

• Access to location data is with your permission and only to identify the Wi-Fi name.
• The data stays on your device.

Use & Processing · Company practice

Analytics and advertising: cookie and device IDs processed on consent

To improve its analytics and optimize advertising, Surfshark processes cookie ID, mobile device ID, device specification and advertising IDs. Its basis is your consent to deliver relevant ads and promotional messages and to attribute sales, and it processes the data until you withdraw consent. On the website it collects information about your activity through technologies like cookies if you have given permission. It may receive information about you from certain advertisers and advertising partners for analytical and advertising purposes, and says its partners help it attribute sales and deliver more relevant ads, which may include interest-based and account-based advertising.

Supporting quotations

2.3.11 To improve our analytics and optimize advertising

Cookie ID, mobile device ID, device specification, advertising IDs.

Legal basis for the processing of personal data is your consent to deliver relevant ads and promotional messages to you, and to attribute sales.

We will process your personal data until you withdraw your consent.

we automatically collect information about your activity through technologies like cookies if you've given us permission.

We may receive information about you from certain advertisers and advertising partners for analytical and advertising purposes.

Qualifications & exceptions

• Cookie-based collection on the website is stated as happening if you have given permission.
• Information may also come to Surfshark from advertisers and advertising partners.

Not stated here

• The advertisers and advertising partners are not named in this part.

Sharing & Disclosure · Company practice

App technical and engagement data shared with named analytics and marketing providers

Surfshark says it may also collect limited technical and engagement data through the app, for example device model, operating system version, device language and randomized identifiers, to measure campaign effectiveness and improve user experience. It says this data is shared with trusted service providers such as AppsFlyer and Firebase Analytics (performance attribution), Iterable (marketing engagement) and Purchasely (subscription flow management and optimization). You may manage or withdraw your consent at any time by contacting support@surfshark.com. The surrounding table says this processing continues until you withdraw consent.

Supporting quotations

We will process your personal data until you withdraw your consent.

we may collect limited technical and engagement data through the app, for example, device model, operating system version, device language, randomized identifiers.

This data is shared with trusted service providers, such as AppsFlyer and Firebase Analytics for performance attribution, Iterable for marketing engagement, and Purchasely for subscription flows management and optimization.

You may manage or withdraw your consent at any time by contacting us at support@surfshark.com.

Qualifications & exceptions

• The data types are examples ("for example") and the provider list is introduced with "such as", so neither is stated as complete.
• Withdrawal of consent is by contacting support@surfshark.com.

Not stated here

• The full list of service providers is not stated.