Law enforcement requests

This page explains how LUPA LLP (“we”) handles requests from law enforcement agencies, courts and other public authorities concerning users of Bebra VPN (the “Service”).

1. General principles

1.1. We disclose information about users only when the law that applies to us requires it and the request is made in the proper form.

1.2. The Service is designed to collect as little data as possible. We do not record traffic contents, the websites users open or their DNS queries, so we cannot provide such information under any circumstances.

2. How to submit a request

2.1. Requests are accepted in writing only, at [email protected].

2.2. Messages sent to support, chat, messengers or social networks are not treated as official requests. We will ask the sender to use the address in clause 2.1.

2.3. We confirm receipt of every request by reply. Requests are handled by the employee responsible for legal matters.

3. Request requirements

3.1. A request must:

• come from an authorised body and allow us to verify the sender: an official email address or letterhead, and the official’s position and contact details;
• cite a legal basis that applies to LUPA LLP and be sent through the procedure that law provides, including mutual legal assistance where it is required;
• identify the account precisely (the account email address), the information requested and the period it relates to.

3.2. We reject requests that do not meet these requirements, are overly broad or whose sender cannot be verified, and we tell the sender so.

4. How we review requests

4.1. Every request is reviewed with a lawyer: authenticity, legal basis, jurisdiction and proportionality.

4.2. If a demand is lawful, we disclose only the information that the request expressly names and that we actually hold, and no more than is needed to comply.

4.3. We may challenge a request that we consider unlawful or excessive.

5. What we cannot provide

5.1. Traffic contents, visited websites and DNS queries: we do not record them.

5.2. Which user performed a particular action online. Our server IP addresses are shared: many users are connected through the same server at the same time, so a server address and a time cannot identify a user.

5.3. Logs kept by the hosting and network providers where our servers are located. Providers may keep their own connection logs; we do not control them, and requests for such logs should be sent to the providers directly.

6. Notifying users

6.1. Unless the law or a court order prohibits it, we tell the user about a request before disclosing any information, so that they can protect their rights.

6.2. If we cannot notify the user in advance, we do so once the prohibition no longer applies.

7. Request log

7.1. Every request is recorded in a log: date received, authority, legal basis, scope of the information requested, our decision and the date of our reply.

7.2. For questions about your subscription or the app, please contact support: [email protected].