Privacy Policy

1. General Information

This Privacy Policy applies to the services offered under the name NDK VPN by NDK DIGITAL LLP.

By downloading, accessing, creating an account for, purchasing a subscription to, or otherwise using NDK VPN, you acknowledge that you have read and understood this Privacy Policy.

2. Information We May Process

2.1 Information You Provide Directly

We may process information you provide directly to us, including:

• email address, if you choose to link it to your account or contact support;
• name or nickname, if you voluntarily provide one;
• support requests and related correspondence;
• any other information you voluntarily send to us.

2.2 Account and Subscription Information

We may process information related to your account and subscription, including:

• account identifier;
• anonymous or linked account status;
• selected plan or subscription tier;
• subscription status;
• purchase, renewal, cancellation, restore, and refund status information;
• transaction identifiers and limited payment metadata required for billing reconciliation.

2.3 Technical, Diagnostic, and Product Usage Information

We may process limited technical information necessary to operate, secure, and improve the service, such as:

• device model;
• operating system and version;
• application version;
• language and regional settings;
• hashed device or app identifiers used for account security, abuse prevention, and service eligibility checks;
• crash reports, diagnostics, and performance data;
• service interaction events needed for product operation, quality improvements, and subscription support;
• public IP status lookup results when you request IP display inside the app.

2.4 VPN Service and Connection Information

NDK VPN uses Android VpnService and Apple Network Extension technologies to create an encrypted device-level VPN tunnel between your device and the selected VPN endpoint.

NDK VPN encrypts data from the device to the VPN tunnel endpoint and does not use normal service operation to inspect, sell, or use the contents of your internet traffic, browsing history, DNS query payloads, or messages for advertising, profiling, or monetization purposes.

To establish, maintain, secure, and troubleshoot the VPN service, we and our infrastructure providers may process limited technical connection metadata such as selected server or region, VPN protocol, connection state, request timing, temporary operational logs, internal technical identifiers, and other short-lived service metadata reasonably necessary to operate the VPN service, prevent abuse, enforce device and subscription limits, and diagnose failures.

NDK VPN is not intended to use VpnService to redirect or manipulate user traffic from other apps on a device for monetization purposes.

We may separately process account, subscription, device, crash, and diagnostic data described in this Privacy Policy to operate the service and support your account.

3. How We Use Information

We may use information for the following purposes:

1. to provide access to the service and its features;
2. to create, authenticate, secure, and manage accounts;
3. to process subscriptions, billing, renewals, trial periods, restores, and refunds;
4. to deliver VPN configuration, connection, and region-selection functionality;
5. to respond to support inquiries and communicate with users;
6. to maintain service stability, security, rate limiting, fraud prevention, and abuse prevention;
7. to diagnose errors and improve performance and reliability;
8. to comply with legal obligations and enforce our terms;
9. to protect our rights, users, infrastructure, and legitimate business interests.

4. Legal Bases for Processing

Depending on the law that applies to you, we may process personal data on one or more of the following legal bases:

• performance of a contract with you;
• your consent;
• compliance with legal obligations;
• our legitimate interests, where those interests are not overridden by your rights and freedoms.

5. How We Share Information

We may share information with the following categories of recipients, only to the extent reasonably necessary:

• app stores and billing providers, including Google Play and Apple App Store;
• payment processors used for bank card and other externally available payment methods;
• analytics and crash-reporting providers, including Firebase Analytics and Firebase Crashlytics;
• public IP lookup providers used to display connection status inside the app, such as api.ipify.org;
• hosting providers, infrastructure vendors, database providers, CDN providers, email delivery providers, and VPN node providers;
• affiliates, contractors, and service providers acting on our behalf under appropriate confidentiality and data protection obligations;
• courts, regulators, law enforcement, and other authorized recipients where required by law or reasonably necessary to protect rights, security, and operations.

Third parties receive only the information reasonably necessary for their services and are not permitted to use it for unrelated purposes where prohibited by applicable law or contract.

6. International Data Transfers

Your information may be processed on servers located outside your country of residence. Where such transfers occur, we take reasonable steps designed to ensure an appropriate level of protection consistent with applicable law.

7. Data Retention

We retain information for no longer than necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• account and subscription records are generally retained while your account remains active and thereafter only for the period reasonably necessary to complete deletion requests, comply with legal obligations, resolve disputes, and prevent abuse;
• billing, accounting, and tax records are retained for the period required by applicable law and payment processor rules;
• support correspondence, crash reports, diagnostics, and technical service logs are retained for a limited period reasonably necessary for support, reliability, and security;
• limited operational VPN service metadata and provider-side technical diagnostics may be retained for a limited period reasonably necessary to operate, secure, and troubleshoot the VPN service;
• NDK VPN does not use normal service operation to store the content of VPN traffic, browsing history, DNS query payloads, or messages transmitted through the VPN service.

8. Cookies and Similar Technologies

If you use our website or web account area, we may use cookies, session tokens, and similar technologies to:

• authenticate users;
• remember settings and preferences;
• maintain security;
• analyze website usage and improve the service.

9. Security

We take reasonable technical and organizational measures to protect information, including:

• access controls and least-privilege practices;
• encryption in transit for app-to-service communication where appropriate and encrypted VPN transport from the device to the VPN tunnel endpoint during service operation;
• service monitoring, logging, and incident response procedures;
• data minimization and internal security policies.

No method of transmission or storage is completely secure. Therefore, we cannot guarantee absolute security.

10. Your Rights

Depending on the law that applies to you, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to certain processing activities;
• withdraw consent where processing is based on consent;
• receive a portable copy of your data;
• lodge a complaint with a competent supervisory authority.

To exercise your rights, contact us at support@ndkvpn.com.

11. Account and Data Deletion

You may request deletion of your NDK VPN account and related personal data by:

• using the in-app deletion flow at Settings > Account > Delete account;
• contacting support@ndkvpn.com;
• using the account deletion instructions published at https://ndkvpn.com/account-deletion/.

After receiving and validating a deletion request, we will delete or anonymize your data within a reasonable period, except where retention is required for legal compliance, tax and accounting purposes, fraud prevention, dispute resolution, security, or the protection of our rights and infrastructure.

Depending on how you use the service, account deletion may also remove local app session data, cached VPN configuration files, and account-linked preferences from the device.

12. Children's Privacy

NDK VPN is not directed to children under 18 without the involvement of a parent or legal guardian, where required by law. If you believe a child has provided personal data without proper authorization, please contact us.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will be published at https://ndkvpn.com/privacy-policy/. If required by applicable law, we will provide additional notice of material changes.

14. Contact Information

If you have questions about this Privacy Policy or our data practices, you may contact:

NDK DIGITAL LLP
Company number OC460979
Stoney Works, 8 Stoney Lane, London, United Kingdom, SE19 3BD
Email: support@ndkvpn.com
Website: https://ndkvpn.com
Support: https://ndkvpn.com/support/