URBAN PRIVACY POLICY

[Last updated: September 4, 2026]

First and foremost, before we dive into the legal details of our privacy policy, we wish to make it clear- We do not want to know your identity and we do not collect data to try and figure out who you are. We don’t require registration of any kind in order to use our services. Of course, we do provide all of the regular privacy policy information to which you are entitled, and we will get to that in a minute. But in case you do not have the time or patience to read through the whole policy, we want to repeat and make that point perfectly clear: We do not want to know your identity. Any data collected from you simply by your use of our product will never be used to figure out who you are or to send you targeted ads.

This Privacy Policy (“Privacy Policy”) governs the manner in which we, Urban Cyber Security Inc. (“Company”, “Urban”, “we” or “us”) process information collected from our users (“you“, “your” or “user“) in connection with their access to or use of our website, available at: https://www.urban-vpn.com (“Website”) and our products (“Products”): (i) UrbanVPN mobile application available on Android and Urban Premium VPN mobile application available on Android and iOS as subscription-based versions (“Mobile App”); (ii) Urban Premium VPN Mac available as a subscription-based version (“Mac App”); and (iii) Urban VPN and Urban Premium VPN Desktop EXE software for Windows, available in free or subscription-based versions (“Windows App”), all as detailed and defined in our Terms of Use (“Terms”). The Company also owns and markets browser extensions. Each browser Products is subject to a dedicated privacy policy that describes the information collected and processed in connection with that Products. Notwithstanding the foregoing, the information described in this Privacy Policy includes information collected by the Company, including through browser extensions owned and marketed by the Company.

This Privacy Policy contains important disclosures on how we collect, share, and use your personal data or information as further detailed below. To the extent permitted by applicable laws, this Privacy Policy is an integrated part of the binding Terms of Use (“Terms of Use”). Definitions herein shall have the same meaning as defined in the Terms of Use.

PLEASE DO NOT DOWNLOAD, INSTALL, OR ADD THE PRODUCTSS TO YOUR BROWSER, OR USE THE SERVICES IN ANY MANNER BEFORE YOU READ AND ACKNOWLEDGE THIS PRIVACY POLICY. THE USE OF INFORMATION RECEIVED FROM THE GOOGLE API THROUGH THE PRODUCTS WILL ADHERE TO THE CHROME WEB STORE USER DATA POLICY INCLUDING THE LIMITED USE REQUIREMENTS THEREIN. We may update this Privacy Policy from time to time and recommend that you check back periodically for the latest version as indicated by the date at the end of the Privacy Policy. Where required by applicable laws, we will provide you with notice of material changes to this Privacy Policy.

This Privacy Policy applies to all users worldwide. If you are a resident of California, please refer to Additional Privacy Information for California Residents for information about the categories of Personal Information we may collect and your rights under California privacy laws. If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, Washington, or Utah, please refer to Additional Privacy Information for Certain United States Residents, which includes additional information about privacy rights for residents of certain U.S. jurisdictions.

The use of information received from Google API will adhere to the Chrome Web Store User Data Policy including the Limited Use requirements.

1. CONTACT INFORMATION:

Urban Cyber Security Inc. registered number 10158667, address at: 1007 N Orange St FL 83 Wilmington, DE, 19801-1239 United State is the controller (as such term is defined under the General Data Protection Regulations (“GDPR”) or equivalent privacy legislation) of the Personal Data we collect from you. For any question, inquiry or concern related to this Privacy Policy or the processing of your Personal Data, you may contact us by email: privacy[at]urban-vpn[dot]com.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact. Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website. https://prighter.com/q/13252349120

2. PERSONAL DATA PROCESSED, THE PURPOSE AND LAWFUL BASES

We process, collect and share “Personal Information” or “Personal Data”, as defined under applicable privacy laws, including, without limitations contact information, online identifiers and information that can reasonably identify you (collectively hereinafter “Personal Data”). Personal Data does not include non-identifiable information collected or generated via your use of the Products and Service that is not linked or linkable to you and could not be used to identify you, whether directly or indirectly with reference to other information (“Non-Personal Data”), such as technical information about your browser or device (type of browser, device, language preference, country level location, etc.) and other information that we aggregate or de-identify consistent with applicable law.

Sensitive Data. Pursuant to Article 9 of the GDPR, sensitive personal data shall include Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying an individual, data concerning health, or data concerning an individual’s sex life or sexual orientation (“Sensitive Data“). In light of our collection of Browsing and Activity Data as set forth below, such data may, depending on the websites visited by you, searches conducted by you, or content with which you interact, incidentally encompass information relating to you that may constitute Sensitive Data. We shall process any such Sensitive Data solely to the extent permitted under applicable law and subject to the implementation of appropriate safeguards.

We may use and disclose Non-Personal Data related to our business and the Services for quality control, analytics, research, development, and other purposes. Some of this information may be considered “de-identified” under U.S. privacy laws (i.e., data that is no longer linked or reasonably linkable to an identified or identifiable consumer). Where we rely on data that has been “de-identified” as defined by U.S. privacy laws, we will: (i) take reasonable measures to ensure that the de-identified information cannot be associated with an individual, household, or device; (ii) commit to maintain and use the information in de-identified form and not attempt to re-identify the information; and (iii) contractually obligate any further recipient not to re-identify the de-identified data.

DATA SET	PURPOSE OF PROCESSING	LAWFUL BASIS (AS DEFINED UNDER GDPR)
Contact Information: When you contact us for an inquiry or support, or register to our newsletter, we will collect basic contact information such as email addresses, full names and related general contact information.	We process the Contact Information for the following purposes: ●        Support– to provide relevant support when you contact us for troubleshooting or otherwise. ●        General Inquiries– to respond to your inquiries about the Company or our Services. ●        Direct Marketing- to send you information about our Services and offerings, which we think may be of interest to you. ●        Complying with our legal obligations, including law enforcement requests.	We process the Contact Information for support under contract necessity and as determined in our Terms of Use.   Otherwise, we will process the information based on our legitimate interests, provided that our interests are not overridden by your interests or fundamental rights and freedoms, for example when responding to your inquiries, for security purposes, to understand, enhance and improve the Services, or otherwise for direct marketing.   We may also have a legal obligation to collect or otherwise use your Contact Information, for example in order to comply with a law enforcement order or other legal obligations.
Identifiers, Panel ID: Internet Protocol (IP) addresses, which is trimmed and hashed (irreversibly encrypted) on a daily basis, and thus is not and cannot be traced back to an individual or used in any way to identify an individual, globally unique identification number, which is a random number we generate to keep track of the data sets we collect and if required, enable us to execute your data rights requests as further detailed below (“GUID”), user agent, device ID, etc.	Promote the security of our Services by tracking use of our Services to detect abnormal user behavior, for enforcing our terms and policies, investigating, and preventing fraudulent, suspicious or illegal activities, and preventing unauthorized access to the Services. Improving and enhancing the Services.	We process such information on the bases of our legitimate interests of ensuring the security of our Services. We have conducted our assessments to ensure that our processing is reasonable and that our interests are not overridden by your interests, fundamental rights or freedoms.
Usage Data: When you use our website, products and Services we will collect certain telemetry data regarding your interaction with the Services, general location (country level), time spent, features used, logs (i.e., time of access and duration of use), crashes, and analytic data.	We collect your information for the purpose of providing and improving the Services. This information helps us monitor the security and performance of our Services, understand how the Services are used, optimize user engagement and customize and enhance your experience.	Usage Data is processed based on our legitimate interest that are not overridden by your interests or fundamental rights and freedoms.
Browsing and Activity Data: This data includes URL referrer, URLs viewed or visited, pages ads viewed or clicked, ad URL, search engine results page data (keyword, order or index of results, links of results, title, description, and ads displayed). We make sure that the Browsing Data is cleaned and scrubbed on your device (i.e., on the client side) prior to being sent to our servers, for the purpose of removing and filtering any information that could be used to identify you or another individual.	We use Browsing and Activity Data to provide the Services. This means that in order to provide in-depth analysis of traffic and engagement metrics about pages you are browsing and visiting. We also use and disclose the Browsing and Activity Data for market intelligence or analytics purposes.	For the purpose of providing the Services as set forth in the Terms of Use, the Browsing and Activity Data is processed for contract necessity. Otherwise, the secondary use of the de-identified, filtered, anonymized and aggregated Browsing and Activity Data, is carried out based on your consent, where such consent is required by applicable laws. You can withdraw your consent at any time as detailed below through the opt-out options. You can opt-out of the collection of the Browsing Data by following the instructions in the “Opt Out Right” section below
E-commerce Data: This information includes actions on ecommerce websites, such as purchases, time and date, the products purchased, prices, quantities, seller, URL of where the product was found, URL of the image of the product. To clarify, we are interested in aggregated information on eCommerce activity and not specifically your personal purchases. We  have measures in place to remove any information that may identify you or another individual.	We use E-commerce Data to provide the Services, including to protect you from unsafe websites, fraudulent purchases, and phishing attempts. We also use and disclose the E-commerce Data for market intelligence or analytics purposes.	For the purpose of providing the Services as set forth in the Terms of Use, the E-commerce Data is processed for contract necessity. Otherwise, the secondary use of the de-identified, filtered, anonymized and aggregated E-commerce Data, is carried out based on your consent, where such consent is required by applicable laws. You can withdraw your consent at any time as detailed below through the opt-out options. You can opt-out of the collection of the E-commerce Data a by following the instructions in the “how to exercise tour rights” below
AI Inputs and Outputs: Prompts, queries, content, and other inputs that you may enter or submit to certain artificial intelligence (AI) tools (such as ChatGPT, Google Gemini, Microsoft Copilot, Claude, Perplexity, and similar services), and results or other output that you may receive from such AI tools. We process this data to provide AI-related protection features, including scanning for personal data exposure and unsafe links within AI interactions.   Considering the nature and general scope of input and output that is typical to AI tools, some sensitive personal data may be inadvertently processed in the provision of our Services. However, the aim of the processing is not the collection of any Personal Data or data that could identify you. While we cannot guarantee that all personal data is removed, we do take steps to remove or filter out identifiers and personal data that you may enter or submit to these tools.	We use the AI Inputs and Outputs to provide the Services, including our AI protection and safe browsing features. This enables us to alert you to potential personal data exposure in your AI interactions and to identify unsafe or suspicious links in AI-generated responses.   We also use and disclose de-identified, filtered, and aggregated AI Inputs and Outputs for market intelligence or analytics purposes, including to provide digital intelligence insights to our business customers.	For the purpose of providing the Service as set forth in the Terms of Use, the AI Inputs and Outputs is processed for contract necessity.   Otherwise, the secondary use of the de-identified, filtered, anonymized and aggregated AI Inputs and Outputs, is carried out based on your consent, where such consent is required by applicable laws. To the extent sensitive personal data is inadvertently processed, such data will be processed on the basis of your explicit consent, where required by applicable law.   You can withdraw your consent at any time as detailed below through the opt-out options. You can opt-out of the collection of the AI Inputs and Outputs by following the instructions in the “Opt Out Right” section below.
Account Data: In order to use some features of our Products, and specially in order to use our Urban Premium VPN features across different platforms (e.g. desktop, iOS mobile app, Android mobile app, etc.), you may be required to create an account through your Google or Apple account, and provide certain information such as name, email address, and profile picture (if applicable).	We process such data to create and activate your account and to be able to provide you with certain features of the Services.	Performance of a ‎contract.‎
Transaction Information: when you purchase a Subscription through our App, all payment are in-app payments and are subject to the applicable app stores terms and privacy policy: Google Pay: Google Pay – Learn What the Google Pay App Is & How To Use It which its privacy policy is available here Apple Pay: https://www.apple.com/apple-pay/ which its privacy policy is available here when you purchase a ‎Subscription through our ‎website for our Windows App or Extensions, we will use Paddle as a third party payment processor to process information related to the transaction, such as your name, email address, country, postal code and any transaction data. Consequently, any transactions that are processed by Paddle will be governed by its privacy policy, which we recommend that you review.	We use third party payment processors; the payment information is solely processed by the applicable app store provider. We do not store nor process any Personal Data when you process the payment. We receive an order number which is connected to a user ID which was generated when installing the app (non identifiable).	The Payment Information is processed to perform our contract with you to provide you our Services.
Android Permissions: In case you are user of our Mobile App and you choose to use our active “safe browsing” feature available on our Mobile App you will be required to enable the certain device permissions such as: VPN permission; Accessibility permission (“Permission”). You can disable the Permission at any time	“Safe Browsing Mode” enable us to block unwanted websites or apps.	To access the Permission, you will need to actively and explicitly enable it through an in-app permission or the mobile settings. Therefore the lawful basis is consent.  You may withdraw your consent at any time but please note if you disable the Permission, the “Safe Mode” feature will not operate properly.

 

3. HOW WE COLLECT PERSONAL DATA

• Directly from you:  Personal Data provided voluntarily by you, when you provide it to us by reaching out.
• Automatically while using the Products or Services: Personal Data collected automatically or inferred about you while using the Service such as Usage Data or Online Identifiers.
• Provided by third parties: Personal Data provided by third-party partners such as data enrichment partners, analytic partners, partners which implemented our SDK, as applicable.

4. COOKIES AND SIMILAR TRACKING TECHNOLOGIES

We may use cookies, other similar tracking technologies (“Cookies”) to gather, store, and track certain information related to your access and interaction with our Products. Cookies are very helpful and may be used for a variety of different purposes. These purposes for which we use Cookies include (without limitation), allowing you to navigate between pages more efficiently, enabling the automatic activation of certain features, remembering your preferences and making the interaction between you and our Services quicker and easier, to secure, prevent fraud and protect our Services.

These Cookies enable core functionality of the service. You may disable these by changing your browser settings, but that will affect how the Services function.

Most browsers will allow you to erase cookies from your computer’s hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. However, if you block or erase cookies your online experience may be limited.

Please see the following links for more information with respect to how you can block or erase cookies via your particular browser: Google Chrome; Firefox; Internet Explorer; Safari; Edge; Opera.

Please visit: www.allaboutcookies.org to learn more about cookies.

5. DATA BROKER

Please be aware that our parent company is a data broker (“Data Broker”), meaning you data may be sold or shared with our parent company’s clients for the purposes described in this Privacy Policy. In most cases, such data shall not include raw Personal Information. Instead, business intelligence customers will be provided with aggregated information that has undergone anonymization and de-identification processes, as further described below. However, we may sell or otherwise disclose raw Personal Information to our affiliates or parent company so that they may aggregate, anonymize, and de-identify such information and provide resulting market intelligence to business intelligence customers. For purposes of this Privacy Policy, “sell” means the sale or transfer of your Personal Information to a third party for monetary or other valuable consideration, subject to certain exceptions in applicable law. For purposes of this Privacy Policy, “share” means transferring, making available, or otherwise disclosing your Personal Information to another party for purposes of sending advertising to you based on your Personal Information obtained from your activities across distinctly-branded sites.

6. HOW IS THE DATA SHARED?

We may disclose Personal Data to the following parties for the following purposes:

• Vendors and Service Providers. We may share Personal Data we collect with our service providers, processors, and vendors who perform functions on our behalf to allow us to provide the Services (for example: cloud hosting providers, payment processors, etc.).
• Business Partners. We may also share certain Personal Data as necessary prior to the completion of a transaction or corporate transactions such as financings or restructurings, merger, acquisition transaction, to lenders, auditors, and third-party advisors, including attorneys and consultants, as part of due diligence or as necessary to plan for a transaction.
• Business Intelligence Customers: We or our parent company may compile and disclose analytics and market intelligence data derived from the data we collect about you and other users through the Services. For example, such analytics and market intelligence data may include aggregated insights regarding advertising trends, website traffic patterns, consumer behavior analytics, and market intelligence data derived from de-identified browsing and activity information. Generally, the data that is disclosed under this operations to customers is aggregated and converted into metrics that do not identify you. In most cases, direct identifiers (e.g., IP address, email, phone number, device ID) and other identifying data are removed or replaced with a pseudonymous identifier before this data is disclosed. In limited cases, we may disclose your Personal Data which includes the Panel ID to our clients so that they may conduct their own analysis on consumer behaviors (no specific identifying personal information such as name; email phone number and etc); however, we contractually prohibit them from using this data in order to reach you with targeted advertising or from further sharing or disclosing this data to third parties.
• Others, as permitted or required by applicable law. We may disclose Personal Data to third parties (authorities, legal representatives, regulators, government entities, and law enforcement) to the extent permitted or required by applicable laws. It may also include certain disclosures that we are required to make. We may disclose your Personal Data when we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Use or this Privacy Policy, or as evidence in litigation in which we are involved.

7. INTERNATIONAL TRANSFERS

Transfers of your Personal Data will be made in accordance with applicable laws, including Regulation (EU) 2016/679 (“GDPR”) Chapter V. We will take the necessary steps to ensure that international transfers of Personal Data meet all requirements under applicable data protection laws. Your Personal Data may be transferred to and processed in countries outside your country of residence, including Israel, the United States, and other jurisdictions where our servers, affiliates, or service providers are located. When Personal Data originating in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland is transferred to a country that has not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including: (a) Standard Contractual Clauses (“SCCs”) as approved by the European Commission (Commission Implementing Decision (EU) 2021/914) or the UK International Data Transfer Agreement/Addendum, as applicable; (b) where available, reliance on an adequacy decision by the European Commission or the UK Secretary of State; (c) the EU-U.S. Data Privacy Framework, the UK Products to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework, where the recipient is a certified participant; or (d) other approved transfer mechanisms, such as Binding Corporate Rules or approved codes of conduct, where applicable. We conduct transfer impact assessments where required. You may request a copy of the relevant contractual safeguards that we have put in place by contacting our Data Protection Officer.

8. DATA RETENTION POLICY

Unless you instruct us otherwise, we retain the information we collect for as long as needed to provide the Services and to comply with our legal obligations, and no longer than is necessary for the purposes for which it was collected. We apply the principle of data minimization and retain Personal Data only for the period required to fulfil the stated purposes. Specifically: (a) Contact Information and Communication Data are retained for the duration of your account or our business relationship, plus any applicable statutory retention period; (b) Online Identifiers, including IP addresses, are trimmed and irreversibly hashed on a daily basis; (c) Browsing and Activity Data and E-commerce Data are de-identified and aggregated within 90 days after collection and are not retained in raw form thereafter.; (d) Usage Data and telemetry logs are retained for performance monitoring and security purposes. Upon expiration of the applicable retention period, we will securely delete or irreversibly anonymize your Personal Data in accordance with applicable law. You may request deletion of your Personal Data at any time, subject to applicable legal exceptions, by contacting our Data Protection Officer.

9. HOW DO WE SAFEGUARD YOUR INFORMATION?

We endeavour to use security methods and encryption when handling data (i.e., we handle the user data securely, including by transmitting it via modern cryptography). We have implemented and maintain appropriate technical and organizational security measures, policies and procedures designed to reduce the risk of accidental destruction or loss, or the unlawful or unauthorized destruction, loss, alteration, disclosure or access to your Personal Data. However, we cannot guarantee the security of information transmitted through the internet. As the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect your user IDs and passwords, please take appropriate measures to protect this information.

Please contact us at: privacy[at]urban-vpn[dot]com, if you feel that your privacy was not dealt with properly, in a way that was in breach of our Privacy Policy, or if you become aware of a third party’s attempt to gain unauthorized access to any of your Personal Data. We will make a reasonable effort to notify you and the appropriate authorities (if required by applicable law) in the event that we discover a security incident related to your Personal Data.

10. PRIVACY CHOICES

Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used. We allow you to exercise certain choices and controls in connection with your information. Depending on your relationship with us, your jurisdiction and the data protection laws that apply to you, you may have certain rights with respect to your personal information.

In the table below you can review your choices depending on your interaction with us, how you can exercise them, and appeal a decision we take in this regard. Any specification per geo-location or territory are available below the table:

RIGHT TO BE INFORMED, RIGHT TO KNOW	You have the right to confirm whether we collect Personal Data about you, and additional information about the how we use and share your data. Some of this information is contained in this Privacy Policy.
ACCESS RIGHTS	You further have the right to know which Personal Data we specifically hold about you, and receive a copy of such or access it, if you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO CORRECTION	You have the right to correct inaccuracies in your Personal Data, taking into account the nature and purposes of each processing activity. If you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO RESTRICTION	In certain circumstances, you have the right to request that we restrict the processing of your Personal Data. If you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO BE FORGOTTEN, RIGHT TO DELETION	In certain circumstances, you have the right to request the deletion of the Personal Data we hold about you. If you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO DATA PORTABILITY	You have the right to obtain your Personal Data in a structured and machine readable format that allows you to transmit the data to another entity without hindrance. We will select the format in which we provide your copy. If you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO OBJECT TO PROCESSING BASED ON OUR LEGITIMATE INTERESTS	You can object to any processing of your Personal Data which has our legitimate interests as its lawful basis. Where you exercise this right, we will have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. If you wish to exercise this right, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com.
RIGHT TO WITHDRAW CONSENT UNDER THE EU AND UK LAWS, AND IN THE US THE RIGHT TO OPT OUT FROM: (I) SELLING PERSONAL DATA; (II) RIGHT TO OPT OUT FROM TARGETED ADVERTISING; AND (III) RIGHT TO OPT OUT FROM PROFILING AND AUTOMATED DECISION MAKING	Browsing Data: You can withdraw your consent and stop the automated collection and sharing of your Personal Data for which your consent was required, by opting out of the data collection through the Products settings, note that once you opt out or turn off the permissions, some or all of the Services will no longer be available. Please note that your withdrawal of consent will not affect any of the processing we have carried out, prior to the exercise of this right. Sale of Personal Data/Targeted Advertising/ Profiling: If and to the extent applicable, you have the right to opt out of the sale of your Personal Data. We do not process Personal Data for the purpose of targeted advertising or profiling and automated decision making. We further do not use any Personal Data for automated decision making. Last, you are able to install privacy-controls in the browser’s settings to automatically signal the opt-out preference to all websites you visit (such as the Global Privacy Control).
RIGHT TO A COPY OF THE SAFEGUARDS FOR INTERNATIONAL TRANSFERS	Where applicable, you can request a copy of or reference to the safeguards under which your Personal Data is transferred outside location.
RIGHT TO APPEAL OR COMPLAINT	If we decline to take action on your request, we shall so inform you without undue delay as required under applicable laws. The notification will include a justification for declining to take action and instructions on how you may appeal, if applicable. Depending on your location, you may also have the right to lodge a complaint with your local data protection authority.
NON-DISCRIMINATION	Where granted by applicable laws, you may have the right to not be discriminated against. Such discrimination may include denying a good or service, providing a different level or quality of service, or charging different prices. We do not discriminate our users. If you feel that we have discriminated against you, please contact us through our Data Protection Officer at: privacy[at]urban-vpn[dot]com.

We will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to respect your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by data protection laws.

11. HOW TO EXERCISE YOUR PRIVACY RIGHTS

If you are a user of our Products and wish to submit a request regarding information collected through the Products, we will typically need you to provide your unique Panelist ID, which allows us to locate your records in our systems. Any association between information collected through the Products and your Panelist ID is retained in our systems for no longer than 90 days. Following this period, the information is aggregated and no longer retained in a form that enables us to associate specific information with a Panelist ID or a particular user. Accordingly, after the 90-day period, we may be unable to locate, access, correct, delete, or otherwise respond to requests relating to information associated with a specific Panelist ID, except to the extent required by applicable law.

·         Locating Your Panelist ID – if you installed our browser Products, you can retrieve your Panelist ID directly from your browser as follows:

• Right-click anywhere on the page and select Inspect (or open your browser’s Developer Tools).
• Navigate to the Application tab (in some browsers, this may be labelled Storage).
• In the left-hand panel, expand Products Storage, locate our Products, and select Local.
• In the list of keys, look for panalyticsid.
• The value displayed next to this key is your Panelist ID.

·         Submitting a Request – to exercise your privacy rights, please contact us at privacy[at]urban-vpn[dot]com and include:

• Your Panelist ID (retrieved as described above), if available;
• A description of the request (e.g., access, deletion, correction, opt-out of sale/sharing);
• Sufficient information for us to verify your identity as the Products user, if required under applicable law.

12. MINORS

Children under 16 (or any younger age, to the extent required under applicable laws) are prohibited from using the Service. In the event that we become aware that a user who is considered a child under applicable laws, has shared any information, we will discard such information. If you have any reason to believe that a child has shared any information with us, please contact our Data Protection Officer at: privacy[at]urban-vpn[dot]com. 

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Privacy Policy, we will notify you through appropriate means, which may include posting a notice within the Products, updating the “Last Updated” date above, or, where required by applicable law, providing you with prior notice via email or in-Products notification before the changes take effect. We encourage you to periodically review this Privacy Policy to stay informed about our data practices. Your continued use of the Productss after any modifications to this Privacy Policy constitutes your acknowledgment and acceptance of the updated terms.

14. ADDITIONAL PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS

In this section, we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA/CPRA”), which requires that we provide California residents certain specific information about our information practices, including how we process their Personal Information, whether collected online or offline. Under the CCPA/CPRA, “Personal Information” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. This section of the Privacy Policy does not apply to publicly available information or Personal Information that is otherwise exempt under the CCPA/CPRA. To the extent you are a resident of California, and we collect “Personal Information” subject to CCPA/CPRA, the following applies.

Categories of Personal Information Collected and Disclosed:

While our processing of Personal Information varies based upon our relationship and interactions with you, the table below identifies the categories of Personal Information we may collect about you (and may have collected in the prior 12 months), as defined by the CCPA/CPRA, as well as the categories of third parties to whom we disclosed Personal Information for a business purpose.

Categories of Personal Information Collected	Third Party Disclosures for Business or Commercial Purposes
Identifiers. Includes direct identifiers, such as name, alias, account number or unique personal identifier; email address, phone number, and other contact information; IP address and other online identifiers.	●        Advisors and agents ●        Security and fraud prevention providers ●        Business customers ●        Others as required by law
Customer Records. Incudes information such as name, user ID, account name, contact information, and other similar information. For example, this may include information collected when an individual purchases our Services or enters into an agreement with us related to our Services.	●        Advisors and agents ●        Security and fraud prevention providers ●        Regulators, government entities and law enforcement ●        Others as required by law
Commercial Information. Includes records of products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.	●        Advisors and agents ●        Business customers ●        Security and fraud prevention providers ●        Regulators, government entities and law enforcement ●        Others as required by law
Internet or Other Electronic Network Activity Information. Includes but is not limited to, browsing history, search history, and information regarding interactions with our website and services, advertisements, including other usage data related to your use of any of our services or other similar online services.	●        Advisors and agents ●        Security and fraud prevention providers ●        Business customers ●        Others as required by law
Geolocation data. Includes approximate location information derived from your device, IP address, Wi-Fi connections, or other location-based technologies, which may indicate your physical location at a particular time	●        Advisors and agents ●        Security and fraud prevention providers ●        Others as required by law
Profiles and Inferences. Such as inferences drawn from any of the information described in this section about a consumer including inferences reflecting the consumer’s preferences, characteristics, behaviors, attitudes, abilities, and aptitudes.	●        Affiliates and subsidiaries ●        Regulators, government entities and law enforcement ●        Others as required by law
Sensitive Personal Information. In some circumstances, through your use of the Services, we may incidentally collect information that may reveal religious or philosophical beliefs, consumer health-related data, and information concerning a consumer’s sex life or sexual orientation, to the extent inadvertently processed through Browsing Data and E-commerce Data.	●        Business customers ●        Others as required by law

Sources of Personal Information:

We generally collect Personal Information from the following categories of sources: directly or indirectly from you; third parties; automatically, including personal information derived/inferred about users based upon their browsing or other data; and operations systems and platforms; business partners; vendors and service providers; publicly available sources; Internet service providers.

Purposes of Collection, Use, and Disclosure:

• Operating Services and providing related support
• Analytics and improvement
• Communication
• Marketing, advertising, and campaign management
• Insight development and data enhancement
• Security and protection
• Business transfers
• Market intelligence or analytics services of our affiliates
• Compliance and legal process
• Auditing, reporting, and other internal operations
• Provision of Services by us and by our service providers, processors, and vendors
• General business and operational support

Sales and Sharing of Personal Information:

The CCPA/CPRA defines “sale” as disclosing or making available Personal Information to a third-party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing or making available Personal Information to a third-party for purposes of cross-context behavioural advertising. We sell marketing insights and behavior segments (as detailed below) that are based, in most cases, on aggregated non-identifying Web Browsing Data (CATEGORY F). The aggregated non-identifying Web Browsing Data is collected from our Products (as defined in our Privacy Policy), which collect, upon your consent, your Web Browsing Data.

Depending on our customers’ needs, from this filtered Web Browsing Data marketing insights are created. These insights show how ads and web pages are viewed and whether and when they are clicked, behavior segments and modules that demonstrate website and app engagement, eCommerce trends, etc. (collectively “Insights”). These Insights are sold to customers for commercial purposes. These customers include companies active in the advertising and marketing sector such as data analytics, market measurement and marketing companies, as well as brands, eCommerce vendors.

In some cases, the Insights are linked to a unique identifier, therefore the information may be considered as Personal Information, which in some territory may also be considered as sensitive information. In cases where these Insights are sold to customers (as detailed above) along with a unique identifier, this action shall be considered as “sell” under the CCPA, however in cases where the Insights are sold without any unique identifier, it shall not fall to the CCPA scope as detailed in Section A above (CATEGORY G) and is not defined as a “sale” or “share”. You can opt-out from sharing the Web Browsing Data at any time through the App settings.

Data Retention:

We retain the Personal Information we collect only as reasonably necessary for the purposes described above or as otherwise disclosed to you at the time of collection. When deciding how long to keep your Personal Information, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period before we can delete them) or whether we have taken any legal positions (e.g., issued any legal holds or otherwise need to preserve the information). Rather than delete your data, we may also deidentify it by removing identifying details. Where we have committed to maintaining and using Personal Information in a deidentified form, we agree not to reidentify deidentified data except as permitted by applicable law.

Your CCPA Rights:

The CCPA provides California residents with specific rights regarding Personal Information. Subject to certain conditions and exceptions, California residents have the following rights with respect to their Personal Information:

• Right to Know. You have the right to request: (i) the categories or Personal Information we collected about you; (ii) the categories of sources from which the Personal Information is collected; (iii) our business or commercial purposes for collecting, selling, or Personal Information; (iv) the categories of third parties to whom we have disclosed Personal Information; and (v) a copy of the specific pieces of Personal Information we have collected about you.
• Right to Delete. You have the right to request we delete Personal Information we have collected from you.
• Right to Correct. You have the right to request that we correct inaccuracies in your Personal Information.
• Right to Opt-Out of Sales and Sharing. You have the right to opt-out of “sales” and “sharing” of your Personal Information, as those terms are defined under the CCPA.
• Right to Limit Use. You have the right to limit use and disclosure of your sensitive personal information.
• Right to Non-Discrimination. You have the right not to be subjected to discriminatory treatment for exercising any of the rights described in this section.

Exercising Your Privacy Rights:

California residents may exercise their CCPA privacy rights as set forth below:

• Right to Know, Delete, Correct, and Limit. California residents may submit CCPA requests to access/know, delete, and correct their Personal Information, and limit the use/disclosure of their Sensitive Personal Information by contacting us at privacy[at]urban-vpn[dot]com. When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial. You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
• Right to Opt-Out of Sales and Sharing. To exercise your right to opt-out of the “sale” or “sharing” of your Personal Information, you may do by contacting us at privacy[at]urban-vpn[dot]com, using the opt-out toggle within the Products settings, or by clicking the “Do Not Sell or Share My Personal Information” link on our website. We will apply your opt out based upon the Personal Information in our records that is linked or reasonably linkable to the information provided in your request. You may also click the “Do Not Sell or Share My Personal Information” link on our website footer and within the Products settings panel. In addition, if we detect that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control” or “GPC” signal, we will opt that browser or device out of cookies that result in a “sale” or “sharing” of your Personal Information. If you come to our Site or use our Services from a different device or from a different browser on the same device, you will need to opt-out, or use an opt-out preference signal, for that browser and/or device as well. More information about GPC is available at: https://globalprivacycontrol.org/.

15. ADDITIONAL PRIVACY INFORMATION FOR CERTAIN UNITED STATES RESIDENTS

Residents of certain U.S. states, including California (to the extent not addressed in Section 12 above), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia, may have additional rights under applicable privacy laws and be entitled to additional disclosures.

Sale of Personal Data: We may sell the following categories of Personal Data: Identifiers, commercial information, internet and electronic network activity information, profiles and inferences, and “sensitive data,” as that term is defined under applicable U.S. privacy laws. We sell such categories of Personal Data to our business customers so that they may conduct their own analysis on consumer behaviours and analyze and improve their marketing and advertising campaigns.

Consumer Rights:

Residents of certain U.S. states, including California (to the extent not addressed in Section 12 above), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia, may have additional rights under applicable privacy laws, subject to certain limitations, which may include:

• Access. The right to confirm whether we are processing their Personal Information and to obtain a copy of their Personal Information in a portable and, to the extent technically feasible, readily usable format.
• Delete. The right to delete their Personal Information provided to or obtained by us.
• Correct. The right to correct inaccuracies in their Personal Information, taking into account the nature and purposes of the processing of the personal information.
• Opt–Out. To opt out of certain types of processing, including: (i) to opt out of the “sale” of their Personal Information; (ii) to opt out of targeted advertising by us; and (iii) to opt out of any processing of Personal Information for purposes of making decisions that produce legal or similarly significant effects.

You may submit a request to exercise most of your privacy rights under U.S. state privacy laws online by emailing us at privacy[at]urban-vpn[dot]com. When you submit a request, we will take steps to verify your identity and your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for denial and how to remedy any deficiencies, where applicable.

To opt out of sales by us, using the opt-out toggle in the Products settings, submitting a request through by contacting us at privacy[at]urban-vpn[dot]com.

Authorized agents may initiate a request on behalf of another individual by contacting us at privacy[at]urban-vpn[dot]com authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.