Military-Grade Encryption
Your data is protected with AES-256 encryption, the same standard used by governments and security experts worldwide.
Privacy Policy
Why Choose The Proton VPN?
Discover why The Proton VPN is the top choice for Australians. Learn about our strict no-logs policy, Australian servers, unlimited data & more.
Lightning Fast Speeds
Our optimized Australian servers ensure you get the fastest possible connection without compromising security.
Global Server Network
Access content from around the world with servers in 50+ countries, including multiple locations across Australia.
Strict No-Logs Policy
We never track, monitor or store your online activity. Your privacy is guaranteed with our audited no-logs policy.
Privacy Policy
This Privacy Policy explains how The Proton VPN Australia collects, uses, discloses, and protects your personal information when you use our website and services. It is a binding document that outlines our operational principles under Australian privacy law.
We operate under the jurisdiction of the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). This policy is written for an Australian audience, using Australian English spelling and referencing local legal frameworks. It is designed to be read by researchers, analysts, and informed users who require precise, verifiable information about our data handling practices. We avoid vague assurances. We provide specific details, numeric data where possible, and clear limitations.
1. Scope & Key Definitions
This policy applies to all interactions with The Proton VPN Australia, including our website (theprotonvpnaustralia.com.au), our VPN applications, and any related support services. Understanding the defined terms is critical to interpreting our commitments accurately.
| Term | Definition & Operational Meaning |
|---|---|
| Personal Information | Information or an opinion about an identified individual, or an individual who is reasonably identifiable. For our service, this primarily includes account information (email, payment data) and limited connection metadata (timestamp of last login, subscription status). It explicitly excludes your browsing history, destination IP addresses, and DNS queries. |
| VPN Service Data | Data related to the operation of the VPN tunnel. We adhere to a strict no-logs policy. We do not log IP addresses you assign, your original IP address after a session ends, browsing history, traffic destination, or data content. |
| Aggregate Data | Non-personally identifiable information used for analytical purposes. E.g., "97.8% of connections to our Sydney-3 server cluster are for streaming protocols." This data cannot be reverse-engineered to identify you. |
| APPs (Australian Privacy Principles) | The thirteen principles governing the handling of personal information by Australian organisations. They cover collection, use, disclosure, quality, security, access, and correction. Our policy is structured to demonstrate compliance with each relevant APP. |
1.1 Jurisdiction and Legal Compliance
The Proton VPN Australia is operated by an entity subject to Australian law. This is a fundamental differentiator from many VPN providers based in jurisdictions with weaker privacy frameworks or mandatory data retention laws. Our primary legal obligations are to the Privacy Act 1988 (Cth) and the Telecommunications (Interception and Access) Act 1979 (Cth). We structure our systems to technically and legally minimise data exposure. For instance, our payment processing is handled by PCI-DSS compliant third-party gateways, segregating financial data from our core service infrastructure.
- Australian Law as Foundation: All user agreements, including our Terms of Service, are governed by the laws of New South Wales, Australia. Any alleged privacy breach would be assessed under the APPs.
- Offshore Data Centres: Our global server network includes locations outside Australia. Data in transit is encrypted. We select server jurisdictions based on robust privacy laws and have contractual agreements with hosting providers prohibiting unauthorised access.
- Contrast with Typical Alternatives: A provider based in a Five-Eyes alliance country without a verified no-logs policy potentially can lead to user data being accessible to intelligence sharing agreements. Our Australian base, combined with a technically enforced no-logs architecture, creates a distinct privacy proposition for users within and outside the Five-Eyes framework.
1.2 What This Policy Does Not Cover
- Your Internet Activity: We cannot see, collect, or log the websites you visit or the content of your communications. This is a technical impossibility given our service design.
- Third-Party Services: Your use of other websites, even while connected to our VPN, is governed by their privacy policies. We encourage you to read them.
- Anonymity Guarantees: A VPN enhances privacy; it does not grant perfect anonymity. Your actions can still be linked to you through other means (e.g., account logins, behavioural patterns).
2. Collection and Use of Personal Information
We practice data minimisation. We collect only what is necessary for the provision, maintenance, and improvement of our service, and for legal compliance. The following table itemises collection points, data type, legal basis, and use case.
| Collection Point | Data Type Collected | Primary Purpose & Legal Basis | Retention Period |
|---|---|---|---|
| Account Registration | Email address, hashed password. | Service provision (APP 6.1(a)), account authentication and recovery. We use the email for essential communications (invoices, critical security notices). | For the duration of your account plus 30 days post-cancellation, after which it is anonymised, unless longer retention is required by law (e.g., for financial record-keeping under the *Taxation Administration Act 1953*). |
| Payment Processing | Payment gateway transaction ID, plan type, amount (A$), date. We do not store credit card numbers or bank account details. | Fulfilment of contract (APP 6.1(b)), financial accounting and fraud prevention. This data is processed by our third-party payment partners (e.g., Stripe, PayPal). | 7 years as required by Australian financial regulations for audit purposes. |
| Website Analytics | Aggregate, non-identifying data: browser type, device type, country-level location (from IP), pages visited. We use tools configured to respect Do Not Track signals and avoid user profiling. | Service improvement (APP 6.2(a)). To understand website performance and feature usage without identifying individuals. | 26 months, after which data is automatically purged. |
| Support Enquiries | Email address, correspondence content, and any diagnostic data you voluntarily provide. | Providing customer support (APP 6.1(a)). We use this data to resolve your specific issue. | 2 years from ticket resolution, to maintain a history of support interactions and improve our support centre resources. |
- Principle of Minimal Viable Data: We reject the surveillance capitalism model. We do not sell, rent, or trade personal information. Our revenue model is subscription-based, aligning our interests with user privacy.
- Comparative Analysis with "Free" VPNs: A 2020 study by the CSIRO's Data61 and the University of New South Wales found that over 72% of free Android VPN apps embedded tracking libraries. These services monetise user data. Our paid model eliminates this fundamental conflict of interest.
- Practical Application for Australians: Under APP 1.2, you have the right to deal with us anonymously or by pseudonym where practicable. You can visit our website anonymously. You could, theoretically, use a anonymous email and cryptocurrency to purchase our service, creating a highly pseudonymous relationship. However, providing legitimate contact information is required for effective support and account recovery.
2.1 Direct Marketing
- We do not engage in intrusive direct marketing. You will receive transactional emails related to your account.
- If you opt-in to our newsletter (a separate, explicit action), we use your email for that purpose only. Every marketing email contains an unambiguous unsubscribe link, with removal processed within 48 business hours.
- We never provide your contact details to third parties for their marketing purposes.
3. Data Security & Storage
Security is not an abstract promise but a series of implemented technical and organisational controls. We protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure (APP 11).
| Control Area | Implementation | Rationale & Standard |
|---|---|---|
| Encryption in Transit | All data between your device and our servers uses AES-256-GCM encryption with Perfect Forward Secrecy (PFS), using protocols like WireGuard® and OpenVPN. | Military-grade encryption ensures data cannot be intercepted. PFS means a compromised key cannot decrypt past sessions. This is standard for high-assurance VPNs but contrasts with weaker protocols sometimes used by lower-tier providers. |
| Encryption at Rest | Any stored personal information (e.g., account database) is encrypted using industry-standard algorithms. Cryptographic keys are managed via a secure, segregated key management service. | Protects against data breaches from physical or logical access to storage media. Aligns with the *Essential Eight* mitigation strategies from the Australian Cyber Security Centre (ACSC). |
| Network Security | Our infrastructure is protected by firewalls, intrusion detection/prevention systems (IDS/IPS), and regular vulnerability scans. Our servers run on RAM-disk mode where possible, meaning no data persists on hard drives after a reboot. | Minimises attack surface. RAM-disk operation is a technical measure that physically enforces our no-logs policy; data simply cannot be retained. |
| Access Control | Strict principle of least privilege. Employee access to user data is logged, audited, and requires multi-factor authentication (MFA). Access is granted only for specific, authorised tasks. | Prevents insider threats and limits damage from credential compromise. This is a procedural control often overlooked in smaller VPN operations. |
3.1 Data Breach Response
We have a formal incident response plan. In the unlikely event of an eligible data breach under the *Privacy Amendment (Notifiable Data Breaches) Act 2017*, we will comply with all legal obligations. This includes containing the breach, assessing the risk of serious harm, and notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.
Frankly, the architecture of our service limits the impact of any potential breach. A breach of a VPN server would yield no user activity logs. A breach of our account database would yield email addresses and encrypted data, but not browsing histories or original IP addresses.
- Definition of "Secure": In our context, security is the implementation of layered technical controls (encryption, network hardening) and organisational policies (access control, training) to reduce risk to a level acceptable under Australian law and our ethical commitments.
- Comparative Analysis: Many consumer-grade services advertise "bank-level encryption" but fail to implement PFS or secure key management. Our implementation is auditable in its design and uses open-source, peer-reviewed cryptographic libraries where possible, allowing independent verification.
- Practical Application for Australian Businesses: For an Australian researcher or business professional using our service, this security posture means that sensitive communications or competitive intelligence gathering activities are protected by a robust chain of custody. It provides a verifiable layer of security atop potentially insecure networks, like public Wi-Fi in Sydney airports or Melbourne cafes.
3.2 International Data Transfers
- Your personal information (account data) is primarily stored within Australia. However, for global service operation, it may be transferred to, accessed from, or processed in other countries where we or our sub-processors have operations (e.g., for payment processing or support software).
- We ensure such transfers are protected by appropriate safeguards, such as data processing agreements incorporating standard contractual clauses or the recipient being in a country with adequacy decisions under Australian law.
- This is a necessary reality of operating a global VPN for travel and international access. The key is contractual and technical control, not merely geographic location.
4. Your Rights & Disclosure Scenarios
You have specific rights regarding your personal information under the APPs. We also operate with transparency about when disclosure might be legally compelled.
| Your Right (APP) | How to Exercise It | Our Commitment & Limitations |
|---|---|---|
| Access (APP 12) To request access to the personal information we hold about you. |
Submit a verifiable request via our contact portal. We will respond within a reasonable period (usually 30 days). | We will provide the information free of charge, in a commonly used electronic format. We may refuse if providing access would reveal a commercially sensitive decision-making process or is otherwise unlawful. |
| Correction (APP 13) To request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information. |
Notify us via your account settings or our support channel. Provide evidence of the correct information. | We will take reasonable steps to correct the information. If we disagree, you may request a statement of correction be associated with the data. We will notify relevant third parties if practicable and required by law. |
| Deletion / Anonymisation To request erasure of your personal information. |
Cancel your account via the dashboard. You may also submit a specific request. | We will anonymise your account data after the operational retention period (see 2.1). Due to our no-logs policy, there is no VPN usage data to delete. Financial records must be retained for 7 years by law. |
| Complaint To lodge a complaint about a perceived privacy breach. |
Contact us first. If unsatisfied, you may complain to the Office of the Australian Information Commissioner (OAIC). | We have a dedicated process for privacy complaints. We will investigate and respond, outlining any remedial actions. We view this as a critical feedback mechanism. |
- Legal Disclosure Principle: We may disclose personal information if required by a valid legal process from an Australian court or authorised body. We scrutinise all requests for legal validity and specificity. Our design limits what we can provide.
- Comparative Analysis of "Warrant Canaries": Some services use warrant canaries. We believe a more transparent approach is to state our policy clearly: we will comply with legally binding orders from Australian authorities. However, according to the data from public transparency reports of similar providers, the number of such requests is exceedingly low—often zero for companies with a verified no-logs policy. The technical reality is that we possess no usage logs to disclose.
- Practical Application: For an Australian user, this means your rights are enforceable under a familiar legal framework. A complaint to the OAIC has tangible weight. This is a significant advantage over dealing with a provider based in a jurisdiction with opaque or user-hostile legal systems.
4.1 Scenario: A Law Enforcement Request
- Received Request: We receive a subpoena for data on a specific user.
- Our Response: We verify the request's validity under Australian law. We then check our systems for any stored personal information related to the account (email, sign-up date, payment info).
- Data Provided: We may be compelled to provide that limited account information. We would be unable to provide connection logs, IP addresses, or browsing history, as they are not recorded. This fact would be stated in our response to the authority.
- User Notification: Our policy is to notify the affected user of the request, unless legally prohibited (e.g., by a non-disclosure order under the *Telecommunications Act*). We believe in challenging such prohibitions where possible.
5. Policy Updates & Contact Information
This policy is a living document. It will evolve to reflect changes in our services, technology, and the legal landscape. We do not make changes retroactively without consent unless required by law.
5.1 Update Mechanism
We will notify users of material changes via email (to the address on file) and/or a prominent notice on our website at least 30 days before the changes take effect. "Material" changes include any expansion of the types of personal information collected, a change in the primary use of that information, or a significant alteration in your rights.
The updated policy will be posted on this page with a revised "Last Updated" date. Your continued use of our services after the effective date constitutes acceptance of the updated policy.
| Version | Last Updated | Summary of Material Changes |
|---|---|---|
| 2.1 | [Current Date] | Initial publication for The Proton VPN Australia, localised to Australian law and context. |
5.2 Contacting Us & The OAIC
For privacy-specific enquiries, access/correction requests, or complaints:
The Privacy Officer
The Proton VPN Australia
Email: [email protected] (preferred for security)
Postal: [Our Registered Australian Business Address]
You can also contact our general support team for non-privacy issues.
If you are not satisfied with our handling of your complaint, you may contact the Office of the Australian Information Commissioner (OAIC):
OAIC
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Website: oaic.gov.au
- Definition of Accountability: Our contactability and the clear path to the OAIC represent our accountability under APP 1.2. It closes the loop, making our policy an enforceable framework, not just a public relations document.
- Comparative Analysis: Many international VPN providers list only a web form or a foreign address, creating a significant barrier for Australian users seeking redress. Our local presence and designated Privacy Officer provide a direct, accessible channel.
- Practical Application: For an Australian researcher citing this policy, the provided details allow for verification and direct engagement. It underscores that our privacy commitments are backed by a tangible operational presence within the Australian regulatory perimeter.
5.3 Concluding Note
- Privacy is a technical and legal undertaking. This policy outlines both.
- We are not infallible, but we are transparent about our practices and limitations.
- Your trust is the foundation of our service. We protect it by designing systems that collect minimal data, securing that data rigorously, and being honest about our obligations.
- For further details on how our service works, please see our pages on what a VPN is and our core advantages.
Last Updated: [Current Date]
Ready to Secure Your Internet?
Join thousands of Australians who trust The Proton VPN for their online privacy and freedom.
30-day money-back guarantee • No credit card required for trial