Identity Defender Privacy Policy

This Privacy Policy is designed to help you understand how Express Technologies Ltd (“ExpressVPN,” “we,” “us,” or “our”), collects, uses, and shares personal information collected through the Identity Defender products. This Privacy Policy applies only to information gathered as described above and does not apply to any other information you submit for our VPN Services.

We want to assure you that no VPN data, including user IDs or any other personally identifiable information, is shared or otherwise linked with our Identity Defender products.

By subscribing to our Identity Defender products, you agree to be bound by this Privacy Policy. If you do not agree with any of the terms of the Privacy Policy, please DO NOT provide us with your information.

1. The Information We Collect

The Information we gather:

Voluntarily Provided Information. The types of personal information that you voluntarily provide us includes, but is not limited to:

• Contact and identity Information such as name, address, email address, phone number, and billing address;
• Social Security number, date of birth, ID and passport documents;
• Banking or financial account information;
• Social media-related information, including handles and user names;
• Transaction information such as product selections and order history;
• Communications such as emails or telephone calls with customer service.
• Device data, such as your computer or mobile device operating system type and version number, manufacturer and model, browser type, date and time of visits, unique identifiers, and geolocation information such as city or town.
• Usage data, such as the Sites you visited, pages or screens you viewed, time spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.

Some of the information may be provided to us through the following:

• Cookies, which are small pieces of information stored on your device that uniquely identify your browser and settings within your browser for the purpose of helping you navigate between pages efficiently and remembering your preferences, enabling functionality, helping us understand user activity and patterns, facilitating online advertising and measuring the effectiveness of our ads. Users can also express their choices for display advertising, through the following platforms: Digital Advertising Alliance opt-out platform or the Network Advertising Initiative opt-out platform. To opt out of these cookies, please go to http://www.aboutads.info/choices.

• Web beacons, also known as pixel tags or clear GIFs, are used to count and recognize users to the Site, or demonstrate that a webpage or email was accessed or opened, or that certain content within it was viewed or clicked, typically to compile statistics about usage of Sites and the success of marketing campaigns.

• Javascript libraries, which are snippets of code within web pages that execute when certain actions take place.

Third Parties. For example, the Payment Processors that completed the Purchase may provide us with certain information, or the various online app stores may provide us with certain information.

2. Use of Information

We may use or disclose your personal information for the following business purposes or as otherwise described to you at the time of collection:

Delivery of Services. We use your personal information to provide, operate, maintain, and improve the Services, to communicate with you regarding the Services, to process transactions and payments for your Services, to personalize your experience with the Services, and to provide support for the Services.

Compliance and protection. We may use your personal information to protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims), to audit our internal processes for compliance with legal and contractual requirements and internal policies, to enforce our Terms of Use, to protect, investigate, and deter against cyberattacks and identity theft, and to comply with applicable laws, lawful requests, and legal process.

Limited authority to act on consumer's behalf. In order to make an opt-out request, we and our service providers may need to interact with data broker sites on your behalf. You hereby expressly authorize us and our agents, servicers, and employees, to act as a your personal representative in order to submit opt-out requests to data broker sites and:

• Obtain information on your behalf;
• Submit your personal information to the data broker sites;
• Communicate with the data broker sites or other third parties on your behalf;
• Agree to applicable terms and conditions imposed by these data broker sites;
• Complete and sign or execute documents on your behalf; and
• Take other actions that the Client believes is reasonably necessary to complete an opt-out request from a data broker site or to implement the Client service.

3. Sharing of Information

We do not share the personal information that you provide to us, except as described in this Privacy Policy. We may share your personal information with the following parties and as otherwise described in this Privacy Policy:

Service Providers. We may share your Personal Information with our third-party service providers and vendors that assist us with the provision of our Services and process Personal Information on our behalf, including Array Inc. This includes service providers and vendors that provide us with IT support, hosting, payment processing, customer service, and related services. They are restricted from using your personal information except as authorized to perform these tasks in a manner consistent with this Privacy Policy.

Professional advisors. We may disclose your personal information to professional advisors, such as insurers, where necessary in the course of the professional services they render to us.

Compliance and protection. We may disclose your personal information as we believe appropriate to government or law enforcement officials or private parties (i) for compliance and protection purposes; (ii) as required by law, lawful requests, or legal process, such as to respond to subpoenas or requests from government authorities; (iii) where permitted by law in connection with any legal investigation; and (iv) to prosecute or defend legal claims.

Affiliates. We may share your Personal Information (i) with our company affiliates, for example: for our administrative purposes, IT management, or for them to provide services to you or support and supplement the Services we provide; (ii) in connection with, or during negotiations for, an actual or proposed acquisition, merger, asset sale, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, transition of service to another provider, or other similar business transfer that involves all or substantially all of our assets or functions where Personal Information is transferred, or shared as part of the business assets in connection with such a transaction, as permitted by law and / or contract; (iii) with your consent or at your direction.

4. Your Privacy Choices and Rights

Phone Calls. If you receive an unwanted phone call from us, you may opt out of receiving future phone calls from us by following the instructions which may be available on the call or by otherwise contacting us via live chat support at www.expressvpn.com/support.

Cookies and Personalized Advertising. You can control our use of certain cookies and other tracking technologies (“Technologies”) that we use for targeted or cross-contextual behavioral advertising in the following ways:

• Cookie Preference Tool. Where our website includes a cookie preference tool, you can use this to indicate your cookie preferences.
• Browser and Device Controls. You may also stop the placement of Technologies on your Device or remove them by adjusting your preferences as your browser or Device permits.
• Ad Industry Opt-outs. In addition, the online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these websites and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada. Please note you must separately opt out in each browser and on each device.
• Do Not Track/Global Privacy Control. Do Not Track is a privacy preference that users can set in certain web browsers. Additionally, some browsers or plug-ins use a Global Privacy Control (“GPC”), which you can learn more about at https://globalprivacycontrol.org/. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers. However, if our site detects a GPC signal from your device, we will interpret it as either a Do Not Sell request or a request to limit the sale or sharing of Personal Information for targeted advertising depending on the law applicable to your jurisdiction. Please note that your request to opt-out of sale/sharing will be linked to your browser identifier only. If you use a different computer or internet browser to access our sites, you will need to renew your opt-out request.
• Contact our Data Protection Officer at dpo@expressvpn.com.

Your Privacy Rights. In accordance with applicable law, you have the right to:

• Access to and Portability of Personal Information about you, including: (i) confirming whether we are processing your Personal Information; (ii) obtaining access to or a copy of your Personal Information;
• Request Correction of your Personal Information where it is inaccurate, incomplete, or outdated;
• Request Data Deletion, Anonymization, or Blocking of your Personal Information when processing is based on your consent or when processing is unnecessary, excessive, or noncompliant;
• Request Restriction of or Object to our processing of your Personal Information when processing is noncompliant;
• Withdraw your Consent to our processing of your Personal Information. Please note that your withdrawal will only take effect for future processing, and will not affect the lawfulness of processing before the withdrawal. If you refrain from providing Personal Information or withdraw your consent to processing, some features of our Services may not be available;
• Request data portability and receive an electronic copy of Personal Information that you have provided to us;
• Be informed about how we handle your Personal Information and the third parties with which your Personal Information has been shared; and
• Processing Sensitive Information. You may have the right to limit the processing of sensitive Personal Information for certain purposes such as profiling or inferring characteristics about you. You may request that we limit our use of Sensitive Personal Information that we have collected about you to that which is necessary to perform the services that we provide to you.

To exercise your rights to access, correct, or delete your data, please email us at dpo@expressvpn.com. We will process such requests in accordance with applicable laws. To protect your privacy, we may take steps to verify your identity before fulfilling your request.

We will not discriminate against you for exercising your rights. This generally means we will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of quality for goods. Please know, if you ask us to delete or stop selling your data, it may impact your experience with us, and you may not be able to participate in certain programs or membership services which require usage of your personal information to function.

5. Children’s Online Privacy Protection Act

The Federal Trade Commission, the United States’ consumer protection agency, enforces the Children’s Online Privacy Protection Act (COPPA), which spells out what operators of websites and online services must do to protect children’s privacy and safety online. We do not knowingly market to or collect personally identifiable information from children under the age of 16. We encourage parents and legal guardians to monitor their children’s internet use. Also, we strongly encourage parents to help us enforce this Privacy Policy by instructing their children never to provide personal information on the Site without permission. It is possible that due to fraud or deception by others, we may unknowingly receive information pertaining to children under the age of 16. If we learn that any user of the Service is under the age of 16, we will take appropriate steps to delete that individual’s personal information and restrict that individual from future access to the Service.

6. Data Storage and Retention

All Information collected for the Identity Defender products will be stored in the United States. We endeavor to retain your Personal Information in accordance with applicable law. We will keep your Personal Information for the minimum period necessary for the purposes set out in this Notice, namely (i) for as long as you are a registered subscriber or user of the Identity Defender products; or (ii) for as long as your Personal Information is necessary in connection with the lawful purposes set out in this Notice, for which we have a valid legal basis; (iii) for as long as is reasonably necessary for business purposes related to provision of the Services, such as internal reporting and reconciliation purposes, warranties, or to provide you with feedback or information you might request; or (iv) for as long as is reasonable necessary to resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, comply with applicable laws, or based upon other criteria, including but not limited to the sensitivity and volume of such data.

7. Security

We place a priority on the security of personal information, and we have security measures in place to protect the loss, misuse, and alteration of the information under our control. We can keep your personal information safe and secure by utilizing the industry standard technology, including password-protected member records, firewalls, secure servers, and Secure Sockets Layer (SSL) encryption technology. Unfortunately, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we are committed to protecting your information, we cannot ensure or warrant the security of any information you transmit to us.

8. Changes to This Privacy Policy

We reserve the right to change or modify this Privacy Policy at any time and without prior notice. Please review the Site and this Privacy Policy periodically for the latest information on our privacy practices. Any changes and/or modifications shall become effective immediately upon posting thereof. Without limiting the foregoing, we may occasionally notify you by email (if you have a registered account) or another manner through the Site or the Services about changes to the Privacy Policy, including providing notices of changes or links to notices to you generally on the Site. Your continued use of the Site and Services after the posting of the updated Privacy Policy shall constitute your agreement and acceptance of the update.

9. Contact Us

For further information or questions about this Privacy Policy, you may contact our Data Protection Officer at dpo@expressvpn.com.