Privacy Policy

The data controller responsible for your personal data is:
A. DEMS LTD
Stadiou 11, 2103 Aglantzia/Nicosia, Cyprus
VAT: CY60137615U
Contact for privacy requests: {email}

We collect only the minimum personal data needed to deliver the service. Specifically:

• Account / activation — your device ID (8-character code), email address.
• Payment — purchase amount and order ID. The full card / PayPal data is processed by our payment providers and is never stored on our servers.
• Technical — IP address, device type, browser type, timestamps, error logs (kept for security and debugging only).
• Playlist data — the M3U URL or Xtream credentials you submit, stored encrypted on our servers and used solely to push the playlist to your device.
• Communications — content of messages you send through the contact form.

We process your data on the following bases:

• Performance of a contract (Art. 6(1)(b)) — activation, playlist management, email confirmations.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, debugging.
• Legal obligation (Art. 6(1)(c)) — accounting and tax records (Cypriot law).
• Consent (Art. 6(1)(a)) — when you explicitly agree to a processing not covered above.

We use your personal data only to: (a) deliver the {brand} service you ordered, (b) process payments through our partners, (c) send transactional emails (activation confirmation, support replies), (d) detect and prevent fraud and abuse, (e) comply with our legal obligations (accounting, tax). We do not use your data for marketing, profiling, or advertising.

We share data only with the following processors, strictly for the purposes above:

• Hetzner Online GmbH (Germany / Finland) — server hosting.
• Cloudflare, Inc. (USA, with EU presence) — CDN, anti-bot protection, Turnstile captcha. Bound by Standard Contractual Clauses (SCCs) for any US transfer.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payment processing for PayPal transactions.
• MyPos AD (Bulgaria, EU) — payment processing for credit-card transactions.
• OVH SAS (France, EU) — outgoing email (SMTP).

We do not sell or share your data with anyone else.

Cloudflare may process data in the United States. Such transfers rely on the EU Commission's Standard Contractual Clauses (SCCs) and Cloudflare's participation in the EU-US Data Privacy Framework. All other processors store data within the EU/EEA.

You have the following rights regarding your personal data:

• Right to access (Art. 15) — get a copy of the data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion when no longer needed.
• Right to restriction (Art. 18) — limit processing in specific cases.
• Right to data portability (Art. 20) — receive your data in a structured machine-readable format.
• Right to object (Art. 21) — to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)) — at any time, where consent is the basis.
• Right not to be subject to automated decision-making (Art. 22) — we do not use such decision-making.

Send your request to {email} with the device ID linked to your license. We respond within one month (Art. 12(3) GDPR). We may extend this period by two months for complex requests, after notifying you.

If you believe we mishandle your personal data, you have the right to lodge a complaint with the Cypriot supervisory authority: Office of the Commissioner for Personal Data Protection, 1, Iasonos Street, 1082 Nicosia, Cyprus — www.dataprotection.gov.cy. You may also complain to your local DPA in your EU country of residence.

We use industry-standard technical and organisational measures to protect your data: TLS encryption in transit, at-rest encryption of sensitive fields (AES-256-CBC), access controls, secrets stored outside the web root, request rate-limiting, anti-bot protection (Cloudflare + Turnstile), and audit logging. No method of transmission or electronic storage is 100% secure, but we apply reasonable care.

We use only strictly-necessary cookies for security (Cloudflare anti-bot) and to remember your form drafts. We do not use analytics, marketing, or tracking cookies. Therefore no consent dialog is required under GDPR/ePrivacy. A small information banner is shown on first visit; dismissing it is acknowledged but not consent (none being needed).

We may update this Privacy Policy occasionally. The "Last updated" date at the top reflects the most recent revision. Material changes are announced via email to active customers.

For any privacy question: {email}, or write to A. DEMS LTD, Stadiou 11, 2103 Aglantzia/Nicosia, Cyprus.