Privacy Policy

1. Who we are

Octopus Telecom Ltd is the controller responsible for the personal information described in this policy.

2. Scope of this policy

This policy applies to the Octopus VPN website at octopusvpn.uk, Octopus VPN client applications, VPN account profiles and the VPN infrastructure operated by or for Octopus Telecom Ltd.

Separate websites, payment providers, app stores, DNS resolvers and third-party services have their own privacy policies. Their processing is governed by those policies where they act independently.

3. Information we process

Website information

When you visit our website, our hosting and security systems may process your IP address, request time, requested page, browser and device information, referring page, and security events. This information is used to deliver the website, prevent abuse and investigate faults.

The website uses Google Analytics to help us understand aggregate website use. Google Analytics may process cookie identifiers, truncated or full IP information depending on its configuration, device and browser information, approximate location, referral information and pages viewed. You can restrict analytics cookies through your browser settings. More information is available in Google's Privacy Policy.

Account, order and support information

When you enquire about, order or receive support for a service, we may process your name, company name, postal address, email address, telephone number, account identifiers, order and invoice information, support correspondence and service preferences. Payment providers may process card or bank details under their own privacy policies; we do not need to receive your complete payment-card number.

Information stored by the client application

An imported .octvpn profile contains the server address, account name, connection settings, a pinned server identity and private authentication key. The application stores this profile on your device so that you can connect. The private authentication key is used locally and is not sent to Octopus Telecom Ltd.

The application calculates connection duration and sent/received byte totals for the current session so they can be displayed to you. These counters are not transmitted to us merely because they appear in the application. The current Windows client does not contain advertising SDKs and does not send application analytics or advertising identifiers to us.

VPN account and connection information

To authenticate and operate a VPN session, our systems process the VPN account name, public-key fingerprint, source IP address, assigned tunnel address, connection and disconnection times, server and device slot, authentication results, and limited diagnostic or security events. Depending on the service and customer portal, aggregate bandwidth or connection-status information may also be processed or displayed.

Packets passing through the VPN necessarily contain routing information such as source and destination IP addresses. This information is processed transiently to route traffic and apply network-security controls.

4. VPN traffic and activity logs

We do not create or retain activity logs that identify the websites you visit, destination URLs, DNS queries, applications you use, files you access, communications content or the content of your VPN traffic.

Our no-activity-logs statement does not mean that no technical data is ever processed. Limited connection, authentication, fault and security data described above may be generated so that we can provide the service, enforce device limits, keep the infrastructure secure and resolve problems. We do not use VPN traffic content for advertising and we do not sell browsing data.

If your profile uses a third-party DNS resolver, that resolver receives your DNS queries and processes them under its own privacy policy. Internet destinations, network operators and services you access may also process information independently of Octopus Telecom Ltd.

5. Why we process information

6. When we share information

We may share only the information necessary for the relevant purpose with:

• data-centre, hosting, network transit and infrastructure providers;
• customer-account, billing and payment-service providers;
• website analytics and security providers;
• professional advisers, auditors and insurers; and
• courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required.

We do not sell personal information or VPN browsing data.

7. How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including contractual, security, accounting and legal requirements.

• VPN profiles remain on your device until you remove them or uninstall the application, subject to operating-system backup behaviour.
• Operational connection and security records are kept for a limited period appropriate to troubleshooting, abuse prevention and system-security needs, then deleted or overwritten.
• Support records are retained while an enquiry is active and afterwards where reasonably needed to document its resolution.
• Account, invoice and transaction records are retained for the period required by applicable tax and accounting law, normally up to six years.
• Website analytics data is retained according to our configured analytics retention settings and the provider's applicable terms.

We may keep information longer where necessary to establish, exercise or defend legal claims, resolve a dispute, prevent fraud or comply with a binding legal requirement.

8. International transfers

Our service uses infrastructure and suppliers in the United Kingdom, the European Economic Area and potentially other countries. Where personal information is transferred from the United Kingdom or EEA to a country without an applicable adequacy decision, we use an appropriate legal safeguard where required, such as approved contractual clauses, together with technical and organisational protections. Contact us if you would like more information about the safeguard used for a particular transfer.

9. How we protect information

We use measures designed to protect information against unauthorised access, alteration, disclosure and loss. These include encrypted VPN and administrative connections, key-based authentication, restricted service accounts, network access controls, least-privilege separation and security updates.

Your .octvpn file contains a private authentication key. Anyone who obtains that file may be able to use the associated VPN account. Keep it private, do not send it through untrusted channels, and contact us promptly if it is lost or disclosed so that its key can be revoked.

No system can be guaranteed completely secure. Please keep Windows, the Octopus VPN application and your other device software up to date.

10. Your privacy rights

Depending on where you live, you may have rights to request access to your personal information, correction, deletion, restriction, portability or objection to certain processing. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

Your right to object: you may object at any time to processing based on our legitimate interests. You also have an absolute right to object to the use of your personal information for direct marketing.

To make a request, email info@octopustelecom.co.uk. We may need to verify your identity before responding. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to the relevant supervisory authority in your country.

11. Children's privacy

Octopus VPN is not directed specifically at children, and we do not knowingly collect personal information from children in circumstances where parental authorisation is legally required. If you believe a child has provided personal information to us improperly, please contact us.

12. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The latest version will be published on this page with a revised “Last updated” date. We will provide additional notice where a material change requires it.