Privacy Policy

1. General provisions and definitions

Virtunio Ltd. is a legal entity incorporated in Republic of Cyprus (European Union). Any person using our Services or System is considered a Client ("you"). The Company and the Client are bound by the Terms of Service, which governs the contractual relationship between us.

LightningBytes provides IP address proxy infrastructure solutions, including residential and mobile proxies, by reselling services supplied by our network suppliers. The Services can be reached and used via the System.

We may modify this Privacy Policy at any time. Your continued use of the Services after a change constitutes acceptance of the updated version. For privacy matters, contact us at privacy@lightningbytes.com.

This Privacy Policy is prepared in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Cyprus Data Protection Law, and other applicable EU and national data protection regulations.

2. Controller and processor roles

LightningBytes acts in two distinct roles depending on the type of data:

• Data controller, for your account information (name, email, billing details, support correspondence) that you provide directly to LightningBytes when registering, paying, or contacting us. We determine the purposes and means of processing this data.
• Data processor, for proxy-service usage data (traffic, IPs, sessions) that flows through our Suppliers' network. We process this data on behalf of and under the instructions of our Suppliers, who act as the data controllers for that usage data.

Where we act as a data processor for our Suppliers, we do not use your proxy-usage data for our own purposes and only process it as necessary to deliver the resold Services and comply with our Suppliers' instructions and applicable law.

For questions about your rights under the GDPR, contact us at privacy@lightningbytes.com or our Data Protection Officer at dpo@lightningbytes.com.

3. Data categories and sources

3.1 Account data (we are the controller)

When you create an account or contact us, we may process basic details such as your name, email address, country of residence, and account credentials.

3.2 Billing data (we are the controller)

When ordering Services, we process payment information such as transaction IDs and payment-method identifiers. Card details are handled by our payment processors; we do not store full card numbers.

3.3 Proxy-usage data (we are a processor for our Suppliers)

When you use the proxy infrastructure, usage data (traffic volume, target IPs, sessions, and authentication logs) is processed to deliver the Services. This data is processed on behalf of our Suppliers under their data-controller instructions.

3.4 Log data

We may collect log data such as IP address, browser type, device type, access times, and pages visited. This helps us operate and secure the System.

4. Purposes and legal basis

We process your personal data based on the following legal bases:

• Performance of the contract, to provide the Services you ordered and manage your account.
• Legal obligations, to comply with accounting, tax, anti-fraud, and law-enforcement requirements.
• Legitimate interests, to secure the System, prevent fraud, and improve our Services, where these do not override your rights.
• Consent, for optional marketing communications and non-essential cookies, which you can withdraw at any time.

5. Recipients of personal data

We only share your personal data as described below or as required by law. We do not sell your personal data.

• Our Suppliers receive proxy-usage data necessary to deliver the resold Services. They act as independent data controllers for that usage data.
• Payment processors handle billing data under their own compliance programs.
• Cloud and analytics providers process limited data to help us operate and improve the System.
• Authorities, where required by law or court order.

Additional proxy providers may be added in the future as Suppliers, on the same data-processor basis. We will update this Policy when that happens.

6. Retention

We keep your personal data only as long as necessary to provide the Services, comply with legal obligations, and defend legal claims. Account data is retained for the duration of your account plus a minimum of 6 months after termination. Proxy-usage data is retained per our Supplier's instructions and applicable law.

7. Data security

We implement industry-standard measures to protect your data, including TLS encryption in transit, access controls, two-factor authentication, and regular reviews. No system is completely secure, but we strive to protect your personal data in accordance with the GDPR.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to data portability. You can lodge a complaint with the competent data-protection authority.

To exercise any right, email privacy@lightningbytes.com or dpo@lightningbytes.com. We respond within 30 days (with possible extensions) and may request identification to verify your identity.

9. International transfers

Personal data may be transferred to countries outside the EU/EEA, including to our Suppliers and their service providers. Where this happens, we ensure appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms under Chapter V of the GDPR.

10. EU and California residents

EU residents have the full rights described above under the GDPR. If you are a California resident, the CCPA/CPRA provides comparable rights to know, delete, correct, and opt out of the sale of personal information. We do not sell your personal information.

11. Contact

For any privacy matter, contact us at privacy@lightningbytes.com or dpo@lightningbytes.com, or write to Virtunio Ltd., Republic of Cyprus (European Union).