Bitdefender

Anonymisation and pseudonymisation are stated as the primary principle for technical data; card details are never seen by Bitdefender (handled entirely by Adyen/PayPal); email protection collects only headers (sender, recipient, subject) and not message content; but anti-threat technical data can be retained for up to ten years, and geo-location data is collected by the Anti-theft feature while it is active.

No selling of data — explicit and unambiguous; no advertising partner data sharing is described anywhere in the policy; third-party processors are limited to four categories (hosting, support, e-commerce, marketing) in EU and USA; but specific processor names are withheld and provided only to competent authorities, and partner access is permitted for fulfilling contractual obligations related to product distribution.

GDPR rights (access, rectification, erasure, restriction, objection, portability) are documented; automated profiling with significant effects is explicitly ruled out; specific retention periods are given for key categories (5 years post-contract for account data, max 5 years for support); but the website policy explicitly states it will change without prior notice, marketing emails run on a legitimate interest basis for five years post-cancellation, and rights requests must be submitted in writing.

Romanian EU jurisdiction provides GDPR enforcement through the Romanian DPA with no Five/Nine/Fourteen Eyes exposure; ISO 27001 and SOC2 Type 2 certifications are explicitly named; the anonymisation-first technical data principle is substantive; and no advertising partner data flows are described — but processor names are withheld, VPN and identity protection services have separate policies, and the website policy has no prior-notice commitment for changes.