Legal · Privacy

Privacy Policy

How we process personal data — aligned with the GDPR and CCPA / CPRA.

Effective: December 27, 2025 · Last updated: December 27, 2025

1. Introduction

Welcome to vpnunited.com (the "Website"). We take the protection of your personal data seriously and process it in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA / CPRA"), and other applicable data protection laws.

Current status of this Website: At the time of writing, vpnunited.com does not load any third-party scripts, web fonts, analytics or advertising trackers on its public pages. Server log files (see Section 8) are processed for technical operation only. Sections 4–7 below describe processing that may apply if the operator activates analytics or advertising in the future — readers will be informed via cookie consent at that point.

2. Data Controller

The operator's contact details are shown below as an image to prevent automated harvesting.

Contact details of the VPNunited operator

A Data Protection Officer has not been appointed, as this is not required under Art. 37 GDPR.

3. What Data We Collect

IP address, approximate region, and time zone
Device type, operating system, browser type / version
Referrer URL and pages visited, clicks, scroll depth, time spent
Search terms and interaction with elements on the page
Cookie identifiers and online identifiers
Server log data (date, time, status code, bytes transferred)

4. Purposes and Legal Bases

Analytics (Google Analytics 4) — for traffic analysis and to improve the user experience. Legal basis: consent (Art. 6(1)(a) GDPR).
Advertising (Google Ads / Microsoft Ads) — to deliver personalized or contextual ads and measure conversions. Legal basis: consent (Art. 6(1)(a) GDPR).
Technical operation (server logs, security) — to ensure the security and integrity of the Website. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
Legal obligations — to comply with tax, commercial, and other statutory duties. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Cookies & Consent Management

We use the consent management platform CookieYes. On your first visit, a banner asks for your consent for non-essential cookies (analytics, advertising, embedded media). You can withdraw or change your consent at any time via the "Cookie settings" link below.

6. Recipients / Third Parties

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Analytics, Ads, Tag Manager, YouTube)
Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Ads)

We have entered into data processing agreements with these providers in accordance with Art. 28 GDPR.

7. International Data Transfers

Some recipients (e.g. Google LLC, YouTube LLC, Microsoft Corporation) are based in the United States. For such transfers we rely on the European Commission's Standard Contractual Clauses (SCCs) (Art. 46 GDPR).

8. Retention Periods

Google Analytics data: 14 months (shorter on withdrawal)
Advertising / conversion data: 90 days
Server log files: 7–14 days
Documents subject to statutory retention requirements: as required by applicable law

9. Automated Decision-Making / Profiling

We do not carry out automated decision-making with legal effect. As part of advertising audiences (remarketing), only pseudonymous profiling occurs after consent has been given.

10. Security

We use SSL/TLS encryption, access controls, regular software updates, and server-side firewalls to protect your data.

11. Your Rights (EU / EEA Residents)

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure / "right to be forgotten" (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent at any time (Art. 7(3) GDPR)

12. Your Rights (California & Other US States)

Residents of California, Virginia, Colorado, Connecticut and Utah may request access to, deletion of, or correction of their personal information and may opt out of "sharing" as defined under the relevant state law. We do not sell personal information.

13. Exercising Your Rights

Send your request to the contact details listed above. We will respond within one month (EU) or 45 days (US).

14. Changes to This Policy

This Privacy Policy will be updated as needed. The "Last updated" date above will be adjusted accordingly. We recommend reviewing this page periodically.

15. Contact

If you have questions about this policy or our data processing, please contact us using the details listed above.