Privacy Policy – Authenticator

1. Contact

The company within the meaning of the data protection laws is:

Authenticator app is provided and operated by:

SMM Service, s. r. o.
Lužická 1237/29
741 01 Nový Jičín
Czechia

If you have any questions, feel free to contact us at help@team2swift.com

2. Subject matter of data protection

The subject matter of data protection is personal data. Under Article 4(1) GDPR, this means any information relating to an identified or identifiable natural person; this comprises, for example, names or identification numbers.

When you access our website, your device will automatically transmit data for technical reasons. These data will be stored separately from other data that you may transmit to us:

• – date and time of the access,
• – browser type/version,
• – operating system used,
• – URL of the previously visited website,
• – IP address (truncated by one octet)

This data is stored exclusively for technical reasons and will never be assigned to any specific person.

We will store your support requests for a period of 120 days from completion of your request, in order to ensure that your request has been successfully processed, and to enable us to understand which problems may have occurred in the past in the event of subsequent requests that may help with solving your request.

We collect and process your data in order to answer your support request and in order to ensure defect-free operation of our product for you, Article 6(1) point (b) GDPR. If you contact us independently of a specific support request or a technical issue, we will collect and process your personal data based on our legitimate interest in being able to answer email queries and due to the fact that your interests are not overriding, Article 6(1) point (f) GDPR.

We specifically use the following cookies:

• – cookies from Firebase;
• – a cookie from Google Ads to measure success of Google Ads;
• – two cookies from Google Analytics for statistical evaluation of the use of the website and for improvement of our offer;
• – a cookie to record whether you have already confirmed the cookie notice with OK;
• – a cookie to determine whether the non-standard Authenticator that are used on the website have been loaded.

These cookies cannot identify you as a person. In any case, use of cookies is justified based on our legitimate interest in demand-oriented design, as well as statistical evaluation of our website, and the fact that your legitimate interests are not overriding, Article 6(1) point (f) GDPR.

6.1. If necessary, to investigate illegal use of our services, or for prosecution, personal data will be passed on to the law-enforcement authorities and potentially to harmed third parties. However, this will only be the case if there are any specific indications of illegal or abusive behavior. Data may also be passed on if this serves to enforce terms and conditions of use or other agreements. We are also legally required to provide information to certain public bodies on request. These are law-enforcement authorities, public authorities that pursue administrative offences subject to fines and the tax authorities.

These data are passed on based on our legitimate interest in fighting abuse, prosecuting criminal offences and the securing, assertion and enforcement of claims and that your rights and interests in protection of your personal data are not overriding, Article 6(1) point (f) GDPR or based on a legal obligation in accordance with Article 6(1) point (c) GDPR.

6.2. We depend on contractually bound third-party companies and external service providers for rendering our services (“Data Processors”). In such cases, personal data will be passed on to such Data Processors in order to permit further processing by them. We select our Data Processors with care and review them at regular intervals to ensure that your rights and freedoms are respected. The Data Processors must only use the data for the purposes specified by us, and are furthermore contractually obligated by us to treat your data only in accordance with this Privacy Policy, and the applicable data protection laws.

In detail, we use the following Data Processors:

• – OLYMPIC s.r.o. (support requests via SupportBox)
• – Google LLC (Google Analytics, Google Ads, reCaptcha v3, Firebase)

Data is passed on to Processors based on Article 28(1) GDPR, alternatively based on our legitimate interest in economic and technical advantages connected to the use of specialized processors, and the fact that your rights and interests in protection of your personal data are not overriding, Article 6(1) point (f) GDPR.

6.3. We also process your data in states outside of the European Economic Area (“EEA”).

For the USA, the European Commission resolved by its decision dated 12 July 2016 that there is an adequate level of data protection under the provisions of the EU-U.S. Privacy Shield (adequacy decision, Article 45 GDPR). We use the following service providers that are certified under the EU-U.S. Privacy Shield:

Any passing on of the personal data is justified by our legitimate interest in adjusting our corporate form to the economic and legal conditions if required and by the fact that your rights and interests in protection of your personal data are not overriding, Article 6(1) point (f) GDPR.

• – Support requests to SupportBox: 120 days.
• – Google Analytics: 14 months.

After the end of these periods, the data will be deleted, except if the data is needed for a longer period due to statutory archiving periods, for criminal prosecution or to secure, assert or enforce legal claims. In such a case, the data will be blocked and is no longer available for further use.

• We do NOT monitor, store, or log your online activities, including your browsing history, connection times, metadata, downloads, server usage, or data content during your session in the VPN Products.
• We also NEVER store or log your IP address after the end of your session in the VPN Products – we always remove your IP address immediately after your session ends.
• We do NOT request your full name for providing our VPN Products. You are only required to provide your email address when you register an account in our VPN Products with Registration.
• If you use the additional functionality called Virtual Private Servers (VPS) we may collect and store the total amount of traffic used and the dates of use only.
• VPN module without Registration: When you use our VPN Products without Registration (without creating an account), we collect the following Personal Data:
• User information. It includes GuestID that is used to identify the unique user by assigning him our internal unique ID.
• Device information. It may include device name/device ID, operating system and its version, browser type, the language of the device, time zone, app usage, including app version, activation date, and update installation date. These are used to identify the device for statistics and troubleshooting, and also to carry out user support, troubleshooting, and product planning. The time zone is used for data analytics and marketing purposes.
• Location information. It includes IP address and geographic location. These are used to determine the location of your device and provide the fastest VPN server nearby. Please note! We NEVER store or log your IP address after the end of your session in the VPN Products.

Our Authenticator app, in accordance with the Google API Service: User Data Policy, upholds a transparent and comprehensive privacy framework. This privacy policy, alongside in-product privacy notifications, meticulously elucidates the precise methodologies employed for interaction with Google user data.

• Usage of Google Drive for 2FA Code Backups: The Authenticator app utilizes the Google Drive platform to facilitate the secure backup of 2FA codes. These codes are stored within users’ individual Google Drive accounts.
• Limited Data Access: It is crucial to emphasize that the Authenticator app’s access to users’ data is exclusively restricted to the aforementioned purpose. We do not, under any circumstances, extend our access beyond the parameters necessary for the secure backup of 2FA codes.
• Strict Adherence to Described Purpose: The usage of Google user data remains in strict alignment with the functionality described herein. Any utilization of data is confined solely to the processes of 2FA code backup and storage on users’ Google Drive accounts.