General Privacy Policy

This document (“Privacy Policy”) explains how nordvpn S.A. (“Nord”, “we”, “us”, or “our”) collects, uses, protects, discloses, and deletes your personal data when you access or use our Services and Websites where this Privacy Policy is posted, regardless of the device you're using (such as a computer, mobile phone, tablet, or TV).

Please note that we only collect and use the bare minimum of information needed. For example, NordVPN follows a no-logs policy: it does not track your online activity. For details on which information may be collected (and which is never collected), please see the “Service-specific privacy notices” section.

Unless explained here, any capitalized terms have the same meaning as in our General Terms.

1. Introduction

   Please read this Privacy Policy carefully to understand our policies and practices regarding your personal data. By using our Services and/or visiting our Websites, you confirm that you have read this Privacy Policy and agree to be bound by it. If you do not agree with any part of this Privacy Policy, please refrain from accessing/using our Services and Websites.

   The company responsible for handling your personal data is nordvpn S.A. (PH F&F TOWER, 50th Street & 56th Street, Suite #32-D, Floor 32, Panama City, Republic of Panama). We are the "data controller" as specified under many privacy laws, like the European Union's General Data Protection Regulation ("GDPR") and the United Kingdom's Data Protection Act 2018.

   PLEASE NOTE: To help you understand this Privacy Policy, we've included a short summary at the beginning of each section. While these summaries are not legally binding, they highlight the key points of the text using clear everyday language. For the full details, be sure to read the actual text of the Privacy Policy.

2. Service-specific privacy notices

   Summary:

   Different Nord Services may process different types of personal data based on your needs.

   Our Services are designed to meet diverse user needs. Therefore, they may process different types of personal data depending on their specific functionalities. Additional information on our data processing for specific Services can be found here:

   • NordVPN Privacy Notice
   • NordPass Privacy Notice
   • NordLocker Privacy Notice
   • NordLabs Privacy Notice

   For information about how we use cookies and similar technologies on our Websites, please see:

   • Nord's Cookie policy

   Contractual terms, supplemental privacy statements, or notices may also provide more information on your personal data.

3. Personal data we process

   Summary:

   We do collect personal data like your email address and payment details to provide our Services. You may also voluntarily give us your data in situations that don't involve using our products, such as when you agree to accept cookies on our Website or participate in a promotional campaign. In all cases, we only collect and use the bare minimum of information needed.

   To provide our Services and operate our Websites, we need to process certain information that can identify you, such as your email address or payment details (referred to as “personal information,” “personal data,” or simply “data”). The specific types of data we collect depend on how you interact with us, our Services, and Websites, as well as the applicable legal requirements.

   Your personal data may be collected by us in several ways:

   • Through information you provide directly (e.g., when creating your Nord Account).
   • Automatically while you use our Services and/or Websites (e.g., through cookies).
   • From third-party sources (e.g., when you subscribe to our Services through external platforms), as detailed below.

   3.1. When you create your Account

   3.2. When we provide our Services and communicate with you

   3.3. When we handle your payments

   3.4. When you interact with our Services

   3.5. When we provide you customer support

   3.6. When we improve our Services

   3.7. When we carry out our marketing and advertising activities

   3.8. When we administer our social media accounts

   3.9. When we maintain security of your Account and our Services

4. Sharing your personal data

   Summary:

   In some cases, we may need to share personal data with certain third parties, such as trusted service providers, partners, and other Nord group companies. In all cases, we make sure to handle your data safely and respect your privacy — even when it needs to be processed outside of your country.

   Nord shares your personal data in the following instances:

   With our Service providers. We use third-party service providers to help us with various operations, such as payment processing, email automation, Website and app diagnostics, analytics, and others. As a result, some of these service providers may process personal data.

   Some of our main long-term service providers are:

   • Customer support services that help us deliver customer support and service-related communications (e.g., Zendesk Inc. (USA), spectra tech, UAB (Lithuania), Microsoft Ireland Operations Limited (Ireland), and Qualitista OÜ (Estonia).
   • Communication services that help us send you transactional notifications and, subject to your preferences, marketing communications (e.g., Braze, Inc. (USA) and Twilio Inc. (USA).
   • Analytics and diagnostics services that help us understand how our Services/Websites are used, monitor performance, detect technical issues, and improve the overall functionality and user experience (e.g., Google Analytics/Firebase Analytics (USA), Amazon group (USA), Atlassian Pty Ltd (USA), SmartBear Software Inc. (USA), Microsoft Corporation (USA), and Tune Inc. (HasOffers) (USA). The tools and data involved may vary depending on the Service or application you use.
   • Advertising and marketing services that help us measure the effectiveness of our marketing campaigns and deliver more relevant promotional content (e.g., AppsFlyer Ltd. (USA), Tune Inc. (HasOffers) (USA), Google Analytics/Firebase Analytics (USA), Braze, Inc. (USA). The tools and data involved may vary depending on the Service or applications you use.
   • Payments processing services that support secure payment transactions, recurring billing, refunds, and financial operations (e.g., Stripe (USA), Adyen (the Netherlands), PayPal (USA), Coingate (Lithuania), and Checkout Ltd (UK).
   • Security features providers that help us enhance security and performance (e.g., Cloudflare, Inc. (USA).

   Within Nord. We share your personal data with other Nord group companies to carry out our daily business operations and to maintain and provide Nord Services to you. We may also share the contact information of Nord business customers (i.e., customers who want to use our products as a tool for their business) with other Nord group companies for B2B product sales purposes (business customers have the right to object to such transfers at any time).

   With our partners. Sometimes our partners (such as distributors, resellers, and app store partners) will act as independent data controllers of your personal data. In such cases, your relationship will be governed by the procedures they have established (e.g., their terms of use and privacy policies). In other cases, we may collaborate with partners as joint controllers, meaning that we will jointly define the purpose and means of data processing. Both joint controllers are then responsible for the data processing and its compliance with the applicable privacy laws.

   With providers of Third Party Services that you have acquired through Nord (Bundled Subscriptions or standalone services). When you purchase Third Party Services through Nord (such as Incogni, Saily, or NordProtect), you agree that certain information (e.g., your email address, Subscription term, payment amount, and Subscription ID) will be shared with the provider of Third Party Services for the purpose of activating, administering, providing you with, and communicating to you about their services, as well as for improving your experience. When you use Third Party Services, your personal data is processed by the provider of Third Party Services in accordance with their established procedures and privacy policies.

   Nord may also share your personal data in the following cases:

   Business transfers. We may share your personal data with relevant third parties (and their agents or advisors) when we sell or negotiate to sell our business, or go through a corporate merger, acquisition, consolidation, asset sale, reorganization, liquidation, or similar event. In the course of such proceedings, Nord will take all reasonable measures to ensure the confidentiality of your personal data.

   Protection of our rights. We may need to disclose personal data to establish or exercise our legal rights, or to defend ourselves against any legal claims or other complaints. We may also need to share such information if we believe it is necessary in order to investigate, prevent, or take action with respect to illegal activities, suspected fraud, and violations of our General Terms.

   Requests for data. The law may require us to disclose limited personal data to law enforcement authorities. In most cases, we have no data to share. In accordance with our strict no-logs policy, we do not record our users' internet activity or their IP addresses when using our NordVPN services. As a result, there is no link between IP addresses, websites visited, and individual users. If we receive a legally valid request that includes specific identifiers (such as an email address) enabling us to identify a particular user, we may be required to disclose the requested data (to the limited extent it is available to us and in accordance with this Privacy Policy). All such requests are carefully reviewed to ensure they are legally binding — among other things, they must follow the appropriate legal process set out under the laws of the Republic of Panama (such as being submitted through a mutual legal assistance treaty or via letters rogatory) and must meet all applicable legal standards. Law enforcement authorities may contact us by using the following information: nordvpn S.A., address PH F&F TOWER, 50th Street & 56th Street, Suite #32-D, Floor 32, Panama City, Republic of Panama, email inquiries@nordvpn.com.

   With your consent. In addition to the reasons identified above, we may request your permission to share your personal information for specific purposes. In these cases, we will notify you of the fact in advance and ask for your consent before you provide the personal data (or before the personal data you have already provided is shared). You may revoke your consent at any time by contacting us via email at privacy@nordaccount.com (but keep in mind that this will only affect future operations, not any data processing that has already been carried out).

   Cross-border transfers

   As a global company, we may process your personal data outside of your country of residence to deliver our Services and operate our Websites effectively. For example, your personal data may be transferred internationally, including to countries where Nord operates or where our trusted third-party service providers are located (such as the United States). Some of these countries may not offer the same level of data protection as your home country, but in all cases, we have implemented appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Policy and all applicable data protection laws. These safeguards may include:

   • Relying on adequacy decisions issued by the European Commission or other relevant authorities.
   • Using Standard Contractual Clauses ("SCCs") approved by the European Commission (or other relevant authorities) together with any additional legal, technical, and organizational measures required.

   These measures help ensure that your personal data receives an adequate level of protection regardless of where it is processed.

5. Your privacy rights

   Summary:

   You have certain rights regarding the processing of your personal data. You can contact our customer support team at any time if you want to exercise your rights.

   Please note that there are various data protection laws across different jurisdictions that provide privacy rights to you as an individual. Subject to the applicable data protection laws and any other applicable factors, you may have the following rights:

   • Right to access. You have the right to know about your personal data being processed for the purposes listed in this Privacy Policy. You can ask us about your personal data that we process and have us send you a copy of it.
   • Right to rectification. You have the right to ask us to rectify personal data you think is inaccurate or incomplete. If you'd like to edit your Nord Account information, please contact our support team at support@nordaccount.com.
   • Right to deletion. You have the right to request the deletion of personal data that we have collected from or about you (also known as the right to be forgotten). However, please note that this right isn't absolute — for example, it does not cover situations where data is needed for us to comply with a legal obligation.
   • Right to restrict processing. If you believe that your personal data is inaccurate or that we are processing it without valid legal reason, you have the right to request that we restrict the processing of such personal data.
   • Right to object to processing. In cases where we are processing your personal data in pursuit of our legitimate interests, you have the right to object to this processing by referencing your personal circumstances.
   • Rights related to automated decision-making. You have the right not to be subjected to a decision based solely on automated processing (including profiling) if such a decision could have a legal or otherwise significant impact on you.
   • Right to data portability. You have the right to ask us to transfer the personal information you gave us to you or another organization. However, you only have this right when: (i) you have provided your personal information to us; (ii) the legal basis for the processing was your consent or the performance of a contract; and (iii) the processing was carried out by automated means.
   • Right to withdraw consent. Even if you had previously given your consent to the processing of your data for a specific purpose, you have the right to withdraw that consent.
   • Right to lodge a complaint. You can always exercise your rights by contacting us directly or, if all else fails, by lodging a complaint with a supervisory authority.

   Rights requests

   To exercise your rights, ask questions, or submit complaints regarding our privacy practices, or to appeal our decisions on your privacy rights requests, please contact us using the details provided in the "Contact us" section.

   PLEASE NOTE: You will be required to complete the Account verification process at a level appropriate to the request to verify you are the rightful owner of the Account in question. Only you (or an individual authorized by you) may make a request regarding your personal data. If you are an authorized representative acting on someone else's behalf, you may be asked to provide proof that the individual gave you signed permission to submit the request on their behalf.

   Account deletion

   You can delete your Account at any time. Log in to your Nord Account, navigate to "Account settings," go to the "Account deletion" section, and click the "Delete account" button. You will have to verify this request via email. Alternatively, you can delete your Account using our applications by following the instructions provided in corresponding support guides.

   Deleting your Account permanently removes your access to all Nord products and Services linked to that Account, including NordVPN, NordPass, and NordLocker. If you wish to delete your personal data associated only with a specific Nord product (such as NordVPN, NordPass or NordLocker), you will have to initiate the deletion separately. If you are unable to delete your Account using the means outlined above, please contact us using the details provided in the "Contact us" section.

6. Your marketing choices

   Summary:

   You're in control of how we use your data for marketing. For example, you can turn off cookies or unsubscribe from marketing emails anytime.

   When it comes to using your personal data for marketing and analytics purposes, you can choose to:

   • Opt out of marketing communications. Steps you need to take opting out of our marketing communications depend on the means of marketing communications:

     • Marketing emails: You can opt out of our marketing emails at any time by updating the notification preferences in your Nord Account settings or by clicking the "unsubscribe" link included in such email.
     • Marketing in-app messages and push notifications: You can turn off marketing in-app messages and push notifications by adjusting the notification preferences in your Nord Account settings, if this option is available for a specific Nord product. In addition, you can always disable all push notifications in your device simply by adjusting your device settings or our applications settings (if available) – this will turn off all push notifications (including marketing push notifications).

     Please note that opting out of marketing communications will not affect service-related or transactional notifications because they are necessary for provision of the Services in accordance with our General Terms.

   • Manage consent for cookies and similar tracking technologies:

     • Websites: You can manage your privacy preferences at any time using the "Cookie Preferences" link (or, depending on your location, the "Your privacy choices" link) in the footer of our Websites.
     • Applications: You have full control and can disable analytics and advertising at first use of applications and any time later in your "Privacy Preferences" settings, located in the application settings.

7. Data security

   Summary:

   We take your data security very seriously, using a number of protective measures to keep your personal information safe.

   We maintain control over the personal data we collect to ensure that it is adequately protected. Our dedicated IT security team has implemented appropriate physical, technical, and organizational measures to protect information about you against accidental or unlawful destruction, or accidental loss, alteration, unauthorized disclosure, or access, and against all other unlawful forms of processing. These safeguards include:

   • Physical measures. We control access to our facilities using secure electronic access systems. We also use security alarm systems and CCTV. Devices with personal data are stored only in locked rooms or cabinets, while our printers are protected by access control measures. We also follow a clean desk policy.
   • Technical measures. We use a layered defense with firewalls, anti-malware protection, and intrusion detection and prevention systems. Our infrastructure is regularly updated, with vulnerability scans carried out periodically to detect possible gaps. We have security event and incident management solutions in place to correlate and investigate signals in security tools. Our servers are hardened and managed using automated configuration tools. All our workplaces are managed using a centralized endpoint management tool. We encrypt data at rest and in transit, using encryption protocols in accordance with the latest security practices.
   • Organizational measures. We have adopted information security and data processing policies in accordance with the best practices. We have undergone external audits to prove that our information security and data processing policies meet the required standards. When it comes to our employees, we consciously foster a culture of continuous improvement with regard to security and data protection awareness (including organizing regular and ongoing training, as well as engaging in other activities to raise awareness). We analyze our organization's threat landscape and attack surface to continuously update our security measures. Finally, access to databases containing personal data is granted only on a need-to-know basis.

   If we detect anything suspicious, we will notify you without undue delay and guide you through the steps you need to take to stay protected.

   PLEASE NOTE: No company can guarantee the total security of your internet communications because no technology is infallible. By using our Services/Websites, you expressly acknowledge that we cannot guarantee 100% security for any personal data provided to or received by us through the Services/Websites, and that any information received from you through the Services/Websites is provided at your own responsibility. If you have any reason to believe that your interactions with us are no longer secure, please notify us at privacy@nordaccount.com.

8. Data retention and deletion

   Summary:

   We only keep your personal data for as long as we need it to provide our Services or comply with the law. Once there are no legitimate grounds for holding this information, we'll immediately dispose of it in a secure way.

   Nord will only keep your personal data for as long as it is necessary to provide you with our Services, or for as long as we have other legitimate grounds to do so (but not longer than permitted or required by law).

   Information retained until your Account is deleted

   We retain some of your data while your Account exists, including account details such as your email address, notification preferences, and certain usage information. This helps us improve our Services, understand how users interact with our features, and personalize your experience. You can delete your Account at any time.

   Retention for specific purposes

   We may need to retain certain information for a set amount of time (which may extend beyond the deletion of your Account) to meet business or legal requirements:

   • Legal compliance. We retain billing and payment information for ten (10) years after your last transaction to comply with accounting, tax, and financial regulations.
   • Marketing communications. We may continue sending you marketing emails, push notifications, and/or in-app messages for up to one (1) year after your Subscription ends, unless you opt out earlier.
   • Legal requests, claims, and disputes. If you contact us (e.g., for support or data access requests), we may retain related communications for as long as necessary to resolve the matter and/or protect our legal rights.

   Please note that some of our Services may be subject to their own privacy notices or policies (as listed in the "Service-specific privacy notices" section), which may specify different lengths of time for data retention depending on the nature of the Service or applicable legal requirements.

   Secure disposal

   When we no longer have a valid reason to retain your personal data, it will either be:

   • Permanently and securely deleted using industry-standard data destruction methods, or
   • Irreversibly anonymized so it can no longer be linked to you.

9. Country-specific provisions

   Summary:

   While some of your rights are rooted in this Privacy Policy, you may have additional rights available to you depending on your country. If you want to exercise them (or if you want to know more), simply contact us.

   For users in the United States

   Sharing in the last twelve (12) months

   In the past twelve (12) months, we have disclosed personal information for business purposes to the categories of service providers and contractors listed in the "Sharing your personal data" section.

   "Do not sell or share my personal information"

   We do not sell personal data to third parties. We share information gathered by cookies and other tracking technologies with our data analytics and advertising partners for our advertising. Consistent with applicable privacy laws (e.g., the California Consumer Privacy Act as amended by the California Privacy Rights Act, collectively referred to as the "CCPA"), you may opt-out of such processing of your personal data by disabling third-party cookies. To disable them when you first visit our Websites, please click the "Privacy controls" link on a cookie banner of the Website. If you'd like to adjust your choices later, you can manage your preferences at any time using the "Your privacy choices" link (or, depending on your location, the "Cookie preferences" link) in the footer of our Websites. To manage third-party provider settings via our applications and extensions, follow the instructions provided therein.

   "Do not track"

   For details on the use of cookies and tracking technologies on our Websites (including how we respond to "Do not track" signals), please see our Cookie Policy.

   Additional rights for California residents

   In addition to the rights described in the "Your privacy rights" section, California residents may also have the following rights under the provisions of the CCPA applying to the processing of personal information:

   • Right to opt out of sale/sharing. You have the right to opt out of the sale or sharing of your personal information to third parties. However, please note that Nord does not sell your personal information as defined by the CCPA.
   • Right to non-discrimination. You have the right to not receive discriminatory treatment if and when you exercise your privacy rights under the CCPA.
   • Right to limit the use of sensitive personal information. In general, you have the right to limit the use of your sensitive personal information (as described in the CCPA) when such use goes beyond that which is necessary for providing the Service (or for certain other permissible purposes, like fraud prevention, customer service, or quality control). However, Nord does not process sensitive information in a manner which might give rise to this right.

   For users in the Republic of Korea

   As set out in this Privacy Policy, we share personal data with service providers and other third parties that may be located outside the Republic of Korea. For users in the Republic of Korea, a detailed list of these third parties (along with additional Korea-specific terms) is provided in the Korean-specific Privacy Policy available here.

10. Children's data

    Summary:

    Nord's Services are not intended for children under 18, and we do not knowingly collect personal data from minors.

    We do not offer our Services to children and, therefore, do not knowingly collect or solicit personal data from anyone under the age of eighteen (18). If you are such an individual, please do not attempt to submit any personal data about yourself to Nord.

11. Other terms

    Summary:

    We will do our best to keep your personal data safe, but you are ultimately responsible for your actions online while using our Services and Websites. In addition, this Privacy Policy does not apply to other websites, even if you got to them by following a link on our page. Finally, this document is not set in stone — but if we do change it in a way that significantly concerns you, we'll let you know.

    Limitation of liability

    It is important that you use our Services and Websites carefully and responsibly — if your actions violate someone else's privacy, rights, or any applicable laws, the responsibility lies with you and you alone. Nord is not liable for any consequences resulting from your unlawful, intentional, or careless actions, or for events that go beyond what Nord could reasonably control or foresee. For more details, please refer to our General Terms.

    Links to other websites

    Our apps or Websites may contain links to third-party websites (such as social media platforms), which are not operated by us. If you follow a link to one of these websites and share your personal data with them, that data will be handled according to their own privacy policies, which may differ from ours. We strongly encourage you to review them before providing any personal information.

    Prevailing language

    For all intents and purposes, the English language version of this Privacy Policy shall be the original, governing instrument and understanding between you and us. In the event of any conflict between this English language version of the Privacy Policy and any subsequent translation of it into any other language, the English language version shall prevail.

    Updates to this Privacy Policy

    We're continuously developing and improving our Services and Websites, which may require us to update this Privacy Policy from time to time. When the changes are significant and materially impact how we process your personal data, we will inform you in advance using reasonable means (such as in-app notifications, messages on our Websites, or by email).

    We always include the "last updated" date at the top of this Privacy Policy so that you know when changes were made. Unless stated otherwise, any updated version becomes effective as soon as it is published on the Website. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your personal data. By continuing to use our Services and Websites after the changes are published, you agree to the updated terms.

12. Contact us

    Summary:

    Legal documents can be tricky. If you have any questions about how we handle your personal data, this Privacy Policy, or if you wish to exercise your privacy rights, please contact us using the details provided below.

    If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal data, or if you wish to exercise your privacy rights, please contact us directly:

    • Email: privacy@nordaccount.com;
    • Postal address: nordvpn S.A., PH F&F TOWER, 50th Street & 56th Street, Suite #32-D, Floor 32, Panama City, Republic of Panama.

    For the purposes of the GDPR, Nord's representative in the European Economic Area (EEA) is NordSec B.V. (email: representative@nordsec.com; postal address: Fred. Roeskestraat 115, 1076 EE Amsterdam, the Netherlands).

    To oversee matters related to data privacy, Nord has also appointed a Data Protection Officer (email: dpo@nordsec.com).