# Opera Privacy Statement

Last updated: May 5, 2023

## Introduction

This privacy statement describes how we use data in our browsers, websites, and services. Some of the data we use is considered “personal data” under applicable law. However, even when we use personal data, we generally have no way of actually identifying you as an individual, and our users are essentially anonymous to us.

The specific categories of data that we collect, use, or otherwise process can vary from product to product, from one purpose to another, and in some cases based on your location. This privacy statement sets out when, how, and why we process your data (including but not limited to personal data), as well as your rights under applicable law.

## Definitions

First, let’s define some key terms. Many of these definitions are adapted (with changes) from the General Data Protection Regulation (or “GDPR”), the data privacy law which applies in the European Union as well as in Norway. We use the GDPR as a guidepost because it applies directly to our European companies and because we believe it sets the highest legal standard for user privacy. However, in some cases we have simplified definitions here for the purpose of clarity.

Personal data: “any information relating to an identified or identifiable natural person” as the GDPR says. This includes data such as your IP address, device IDs, advertising IDs, and location. Below where we describe how we process personal data, we also list the specific purpose for doing so, as well as our legal basis under the GDPR (as those terms are defined below).

Data controller: The person or company that decides whether and how to process personal data.

Data processor: Someone who processes personal data on behalf of a data controller.

Legal basis: the specific legal grounds we use for processing personal data. The GDPR sets out six specific grounds for processing personal data. The ones most relevant to our Applications are as follows:

Consent: When we process personal data based on your consent, that means you’ve expressly given us permission to do so.

Contractual grounds: When we process personal data because it is necessary to perform a contract, for example to provide you with a service as described in our Terms of Service or some other agreement.

Legitimate interest: When we process personal data based on legitimate interest, that means we have some use for the personal data (such as monetization, or ensuring that products work properly) which is in balance with your right to privacy.

Legal compliance: In some instances it is necessary for us to process personal data in order to fulfill other obligations under the law, for example detecting fraud, making sure you are who you say you are, etc.

Applications: the specific apps we offer, as mentioned below, including our desktop and mobile browsers.

Monetization: making money. Nearly all of our Applications are free to download and use. Therefore we monetize our products in various ways, mostly by selling advertising within the Applications themselves. The money we make helps us keep the lights on, pay the salaries of our staff, and continue developing the most innovative, independent browsers on the market. However, when we monetize our Applications, we never sell our users’ personal data to anyone.

Purpose: the specific reason or reasons we have for processing personal data.

Process or processing: collecting or using personal data. As defined in the GDPR, the word “processing” can mean doing almost anything with personal data. Below we have used it in this general sense when we have a general meaning in mind, and used more specific terms (like “store” or “share”) where appropriate.

Retention / retain: the time period for which we will continue to store data. In general, we do not process or store personal data longer than needed and therefore delete it after a certain period of time. Below we have included some more specific details on retention periods, which vary depending on the type of personal data at issue and the purpose for which it is processed.

Transfer: Personal data is “transferred” when it is sent or made permanently available to someone or some company outside the European Economic Area (or EEA - that is the European Union plus Norway, Iceland, and Liechtenstein).

Opera Group: Our affiliated group of companies, including Opera Norway AS (a Norwegian company) which develops and publishes the Opera browsers, as well as other subsidiaries and affiliated companies around the world. For more information, see below.

## Applications

The kinds of data (including personal data) that we process vary a great deal depending on which applications you use. You can read more about how each of our products processes data below.

## Desktop Browsers

The following sections describe how we process data (including, but not limited to personal data) in our desktop applications – Opera browser for Computers (on Windows, Mac, and Linux), Opera GX desktop (on Windows and Mac), and our desktop Crypto Browser (on Windows and Mac).

### Opera Account

None of our browsers require that you sign in before you can start using them. However, you have the option to create an Opera account to use certain services (like commenting on our Forum or blogs, VPN Pro, Loomi, Cashback, etc.). Again, you do not have to create an Opera account to use our browser applications for regular browsing activities, such as browsing the web.

If you choose to create an Opera account, we ask for a preferred username and an email address. The email address will be used to identify you as a user and for password recovery. Alternatively, you can use your Google, Facebook, Twitter, or VK account to sign in to an Opera account and access our services with the same profile. In this case we may collect information such as your name, profile picture, and email address from these social networks. If you use your Opera account in conjunction with a service like VPN Pro or Cashback, the data we process in connection with those services will be associated with your Opera account.

You can modify your Opera account, delete it, or request a copy of your data using your profile page. We retain your data for seven days after you’ve decided to discontinue your Opera account in case you choose to change your mind. Your Opera account with a verified email address will be deleted automatically if you don’t sign in for two years. Accounts with unverified email addresses will be deleted after six months of inactivity.

Note also that Opera allows you to sync your browser data, such as Speed Dial entries and bookmarks, between devices that have another Opera browser installed on them. The synced data is retained until your Opera account is deleted.

Purpose: to allow you to access certain services.

Legal basis: Contractual grounds (e.g., providing you the services), legitimate interest.

### Personalized Content

Our browsers may include personalized content features, such as a native newsfeed, or specialty content features such as Shopping Corner. When you interact with these features, we collect some information, such as the articles you read in the newsfeed, and your general location. We use this information to build a profile of your interests, which we use to select more relevant content for you. This information is linked to a randomly generated ID and may be stored on our servers for up to three months. We process this data based on your consent. If you would like to withdraw your consent, you can go to the settings menu and disable personalized content.

Purpose: Providing a more personalized experience and encouraging user engagement; monetization.

Legal Basis: Consent.

### Browser Extensions

You can install browser extensions or add-ons, which can be downloaded from the Opera add-ons website. Most of these extensions are developed by third parties and are subject to their own privacy terms. Please carefully review the terms before installing extensions. Please note that, as described in our Terms of Service, the sidebar messaging services (such as WhatsApp, Telegram, Facebook Messenger, etc.) offered within Opera are provided by third parties. These services will not collect any data from you through the side-bar tool unless you specifically sign into them and use them. Opera does not collect any data when you use these services.

### Free VPN

When you use our free, built-in browser VPN service, we do not log any personal data or other information related to your browsing activity or originating network address. As long as the browser VPN is active, all traffic in the browser is encrypted using strong industry standard encryption.

### VPN Pro

Depending on where you live, you may be able to purchase a paid, premium VPN service called VPN Pro.

- VPN Pro is provided by a third-party service provider which owns, operates, and maintains the infrastructure which provides the Service. Data communicated through VPN Pro will be encrypted and routed through one of thousands of servers around the world. However, we do not promise that the service is absolutely secure. Despite our best efforts and the best efforts of our provider, criminals or other bad actors may still be able to access your data.

- VPN Pro is a no-log service. We do not collect or store records of web pages you visit or links you click on in the servers dedicated for this Service.

- To use VPN Pro you need to create and sign in to an Opera account. We use your Opera account to identify you as a valid subscriber to the VPN Pro service. We will share only information required to identify you as a subscriber with our third-party service provider, including a random ID number. We do not share your email, name, or other data or personal data with our third-party service provider.

Purpose: To provide the service.

Legal Basis: Contractual grounds.

### AI Chat

Depending on which version of the browser you are using, you may be able to access an AI-powered chat assistant (‘AI Chat’). AI Chat is powered by OpenAI (a US-based company). To access AI Chat, you will need to sign into your Opera Account. We do not share your Opera Account data with anyone, including OpenAI. For more information on how we use and retain Opera Account data, see the section on Opera Account above. Any information you include in an AI Chat is shared with OpenAI. AI Chat processes your input in order to give you more contextualized output. Such processing happens within each separate session with AI Chat and involves all data, which you provide to AI Chat, including personal data. We will ask you for a separate consent for aforesaid data processing.

After your session is complete, your chats will be stored locally, but will not be retained by OpenAI. Chats will be retained for 6 months, and then automatically deleted. You can delete them by going to the chats list by clicking the chat bubble icon on the top bar of the chat. There you can either delete them one at a time by swiping, or you can select multiple chats and delete them all at once by clicking the bin icon. If you want to delete all your conversations and erase all data related to this feature, you can clear the data in the Settings menu.

Purpose: To provide and manage the service

Legal basis: Legitimate interest (for Opera Account data), Consent (for any data you input to AI Chat)

### Cashback

Cashback is an incentive program where you can earn rewards when purchasing goods or services from participating online merchants. When you choose to use the Cashback program and visit supported websites, we will collect merchant URLs, a list of your purchased items, transaction amounts, and IP address. This data is required for the Cashback service to function, and we also use it to provide more relevant partner deals, and to detect fraud and misuse of the service. To enable payouts, your Opera account will be linked with a payment service provider, which will share your customer ID, and relevant payment related data with Opera. Your payment data may be stored for up to five years due to regulatory requirements. You can modify your Opera account, delete it, or request a copy of your data using your profile page. Your Cashback data will be automatically deleted after two years of inactivity. You may delete your Cashback account, which will erase your personal data from the system, through the Account Setting menus in Cashback account.

Purpose: To provide and improve the service.

Legal basis: Contractual grounds, legal compliance.

### GX Gaming Servers

Depending on where you live, the GX Gaming Servers service may allow you to purchase a license to access servers optimized for online gaming (the “GX Gaming Servers”).

To use GX Gaming Servers you need to create and sign in to an Opera account. We use your Opera account to identify you as a valid subscriber to the GX Gaming Servers service. We will only share information required to identify you as a subscriber with:

- GTX Network Limited, our third-party service provider - a random ID number;
- payments provider - e-mail, unique ID tracking number, country.

GTX Network Limited may process additional data, including your name, address, email address, and phone number. Processing by GTX Network Limited is subject to their Terms and conditions and Privacy Policy. Data you upload to the GX Gaming Service will be stored on the GTX Network Limited servers while you continue to use the GX Gaming Service and for 2 months afterward. GTX Network Limited will store the additional data as above for 12 months.

GTX Network Limited maintains servers around the world, including Europe, the United Kingdom, the United States, and Australia. If you choose one of those locations your data will obviously be stored there.

Purpose: To provide the service.

Legal Basis: Contractual grounds

### GX Cloud

GX Cloud is a set of online services, and a community for gamers, consisting of the following websites: GX Games, GX Store, GX Create, and GX Me, which give you access to games and other content and the option to play, compete in, and create video games, mods, and other. You do not need an account to play most games; however, to get access to certain content (including paid content), participate in challenges, or to create content, you need an Opera account. After signing up for the first time, you will be prompted to provide your date of birth and an optional avatar. We use your date of birth to ensure you are eligible to use the service. You can modify your Opera account, delete it, or request a copy of your data using your profile page.

Purpose: To provide the service.

Legal Basis: Contractual grounds.

### My Flow

If you use the “My Flow” function, a random ID is generated by the Flow server and assigned to each client device. These IDs are used solely to enable pairing functionality between Opera desktop and mobile applications and persist only while your devices are connected to My Flow. Your data is protected with end-to-end encryption and we retain it only as long as you continue to use the feature. You can disconnect your devices from My Flow, and delete your data through the application’s Settings menu.

### Crypto Wallet

Depending on your location, some Opera browsers may allow you to access a non-custodial crypto “wallet” offered by our affiliate, Blueboard Limited (an Opera Group company). Blueboard is the data controller for this feature, and you can read their privacy statement here. Opera does not act as a data controller for this feature, but may process some data in order to help the wallet to function in our apps.

### SaviSwap

SaviSwap is a free to use smart contract Service, provided by Opera, that finds and chooses for you the best available swap. If you use SaviSwap, Opera may collect the following data: your public wallet transaction history, asset balance, and public wallet addresses directly via our backend services which collect data directly from the blockchain or use 3rd party services (like for NFTs), which themselves gather data from the blockchain. We may share those data with swap providers to find the best swap for you. We store the data in the user’s local storage (a feature that is available natively in each browser) for caching purposes.

### Usage Statistics

When you install an Opera application, a random installation ID is generated. We collect this identifier, as well as Machine ID, hardware specifications (model, release date, etc.), operating system, environment configuration, and feature usage data to improve our products and services. For example, we may use it to analyze how our users interact with our applications, or to determine the effectiveness of promotional campaigns, or to detect and debug problems. We have no practical way of using this information to identify you personally. We retain this usage data for up to three years. You can opt out of reporting extended statistics through the settings menu and choosing not to “Help Opera”.

Purpose: Improving our products.

Legal basis: Legitimate interest.

### Crash Reports and Logs

If an Opera application crashes, we collect a log that includes some information about your browser’s version, your operating system, platform and some memory data related to the crash. We collect this data with the sole purpose of improving our products and services. Crash logs are kept for up to five months. You can opt out of reporting this data to us through the settings menu of the browser.

If you visit our websites, we may collect your IP address to help diagnose problems with our servers and to administer our websites. We use IP addresses of website visitors solely for this purpose and may keep these website access logs up to six months.

### Browser Assistant

Opera for computers on Windows includes a component called Browser Assistant that displays notifications promoting the browser’s features or the browser itself. Browser Assistant checks if any notifications are pending on a scheduled basis and may report occurrences of certain system events (such as low battery, low hard disk space, new Wi-Fi network connected, another browser installed). Browser Assistant collects this data, as well as a randomly generated Opera ID so that we can determine and evaluate the effectiveness and performance of the notifications that we display to users. We may retain this data for up to four years. You can opt out of this data collection via your browser settings by selecting not to help improve Opera.

Purpose: Improving our products.

Legal basis: Legitimate interest.

### Malicious-site Check

We use a fraud prevention framework (including Google Safe Browsing) to check the URLs you visit against lists of known, malicious websites to protect you online. We do not process any personal data in this context.

### Personalized Ads & Profiling

Based on data such as IP address, hashed user ID, and your general location, some of our Applications serve targeted ads. These ads are provided by our monetization partners. You can always adjust your personalized ad choices in the application’s “Settings” menu or through your operating system’s settings.

As noted in our End User License Agreements and Terms of Service, our applications are generally provided for free and as such are ad-supported. Collecting this information helps us offset the costs of our business and helps provide a more personalized experience for the user.

We may also combine this data with other elements – including categories of websites you search and visit, device information (model, release date, device IDs, hardware specifications, operating system, etc.), and categories of ads you have clicked on in our products - to build a better understanding of what our users are interested in. We do not log or store your entire browsing history for this purpose. Instead we simply make a record of whether you have visited certain categories of websites based on the domains of pages you visit and mix it with other data (which might depend on which application you use, and may include page loads, number of SpeedDial clicks, whether you have ad blocker enabled or not, etc.) to make an informed guess about whether you are interested in broad categories of interests (such as sports, gaming, news, etc.). We then add this basic profile to other data, such as your general location (country or city) in order to enable our advertising partners to target their ads to groups of users who might be interested in their products and services. We do not share your personal interests or browsing history with anyone. We retain this data for up to one year after which it is deleted automatically.

We process this data based on your consent. If you would like to view your options, or to withdraw your consent, please visit the settings menu of the application you are using.

Purpose: Improving our products and services, monetization.

Legal Basis: Consent.

### Speed Dials

Our browsers include visual bookmarks on the home screen which we call Speed Dials. You can customize the Speed Dials through the Application’s settings menu. Some Speed Dials are ads provided by our advertising partners. If you choose to use Opera’s default Speed Dials, you may be redirected through Opera’s partners or other third parties. These partners and third parties may collect data from you independently of Opera. This data may include third party cookies, device IDs, and session statistics. If you wish to opt out of such data collection, you can easily configure your browser’s Cookie Settings to reject third party cookies. You may also choose not to receive Speed Dial suggestions, or to adjust your Speed Dials by deleting preset options based on your own preference.

### Web3 Guard

Some Opera browsers may provide you with additional Web 3 security check features. Those features are enabled by default and are visible in your address bar. You may turn off the specific features at any time in the browser settings.

Dapp Check is a feature that will look for known security risks connected to decentralised applications you are exploring, such as:

- If the Dapp contains malicious contracts
- If the Dapp has a malicious owner
- Whether the Dapp has been audited
- Whether Dapp’s contracts are open source

If a Dapp contains malicious contracts or is owned by a known malicious creator, you will be warned prior to entering the Dapp’s website. Dapp does checks based on the URL you are visiting against a database of Dapp security information that Opera maintains internally. This database is kept within your local storage, and the check itself is run locally any time you enter a website. Because of this, the check is performed without collecting any of your personal data, and without storing any of the URLs you visit.

Seed Phrase Phishing Check is a feature that checks webpages you visit for suspicious seed-phrase phishing behaviors, such as:

- Common phishing keywords: the private key, seed phrase, mnemonic phrase, etc.
- Common phishing properties: input box, list of wallet options to connect with
- Certain sizes, numbers, and positions of text input components
- Files and documents that include phishing patterns

When a risk is detected, a message is displayed to warn you against engaging in risky interactions with a suspected phishing site. Seed Phrase Phishing Check monitors the DOM (document object model), a piece of the interfacing layer of the actual web page, and screens for any phishing patterns. So the check does not listen to or watch the actual content of your browsing, and does not collect, process, or share any of your browsing data or personal data.

### Promotion & Marketing

We process some data in order to promote and market our products and services. Some of this data comes directly from you when you submit it to us for some specific purpose. For example, if you decide to provide feedback to Opera, or participate in a promotional campaign, contest, or survey, organized by Opera or our partners on behalf of Opera, we may ask for information such as your name, age, phone number, email, or postal address. Depending on the nature of the campaign or contest, it may be necessary to share your data with third parties. When that applies, we will make it clear in the terms applicable to the campaign.

If you agree to receive marketing information from Opera via email, SMS, or push notifications, we may use third-party technology providers to deliver such messages to you. You can opt-out from marketing communication at any time in your Opera account profile settings or directly from a marketing email you received.

If you submit your phone number or email address on an application download page, we may send you a download link via SMS or email for your convenience.

In Opera for Windows computers, we may use the Browser Assistant component to promote the browser and its features to you. Browser Assistant comes as part of the Opera Browser for Windows, and may be manually removed from the system’s startup list, or via the browser settings. To learn more about Browser Assistant, please read our dedicated section on it in this statement.

In general when we process data in the context of a promotional campaign, contest, or survey, we process your personal data on the basis that doing so is necessary to enable you to participate in the campaign. In some cases we process data for marketing purposes based on your consent. In any case we will not retain your data any longer than necessary to fulfill the specific purpose for which it was collected to begin with. You can always control your preferences via the settings menu or through your account, and if you have other concerns you can reach out to us through this form.

Purpose: To promote our products and services.

Legal Basis: Varies by context as explained above - may include contractual grounds, legitimate interest, or consent (in some cases).

### Third Party Technologies

Our applications and services include third-party technology or code, some of which may use your data in different ways. When such third-party technologies use previously collected data, they typically act as data processors for us. When they collect data on their own, they typically act as independent data controllers. For convenience, we have included links to their privacy policies below. Data controllers are marked with an asterisk.

- Third-party features:
  - Google Geolocation API (Windows only)*
  - Google Safe Browsing
  - Google Ads
- Payment service providers:
  - Paypal*
  - PayU*
  - Google Billing Services
  - Cypix
  - Rapyd
  - Xsolla
  - NexWay SAS
- Technology providers:
  - Sendinblue
  - Freshdesk
  - OpenAI

Please note that this list of third-party entities applies only to the currently supported versions of our applications and services.

## Mobile Browsers

The following sections describe how we process data (including, but not limited to personal data) in our mobile applications – Opera for Android, Opera Mini, Opera for iOS, Opera GX Mobile, and the mobile Opera Crypto Browser.

### Opera Account

None of our browsers require that you sign-in before you can start using them. However, you have the option to create an Opera account to use certain services (like our blogs, VPN Pro, Loomi, or Cashback, etc.). Again, you do not have to create an Opera account to use our browser applications for regular browsing activities, such as browsing the web.

If you choose to create an Opera account, we ask for a preferred username and an email address. The email address will be used to identify you as a user and for password recovery. Alternatively, you can use your Facebook, Twitter, or VK account to sign in into an Opera account and access our services with the same profile. In this case we collect information such as your name, profile picture, and email address from these social networks. If you use your Opera account in conjunction with a service like VPN Pro or Cashback, whatever data we process in connection with those services will be associated with your Opera account.

You can modify your Opera account, delete it, or request a copy of your data using your profile page. We retain your data for seven days after you’ve decided to discontinue your Opera account in case you change your mind. Your Opera account with a verified email address will be deleted automatically if you don’t sign in for two years. Accounts with unverified email addresses will be deleted after six months of inactivity.

Note also that Opera allows you to sync your browser data, such as Speed Dial entries and bookmarks, between devices that have another Opera browser installed on them. The servers we use for this service do not retain this data.

Purpose: to allow you to access certain services.

Legal basis: Contractual grounds, legitimate interest.

### Personalized news

Certain applications include a native newsfeed feature. To provide you with more relevant news content in certain countries and languages, we collect some information about the articles you read in the application’s native newsfeed, and your general location. We use this information to build a profile of your interests, which we use to select more relevant content tailored to you. This information is linked to a randomly generated News ID and stored on our servers for up to four years. We process this data based on your consent. If you would like to withdraw your consent, you can go to the settings menu and disable personalized news.

News applications like Apex News and Apex Football are offered by our affiliate, Opera Unite Pte. Ltd.

Purpose: Providing a more personalized experience and encouraging user engagement; monetization.

Legal Basis: Consent.

### Crypto Wallet

Depending on your location, some browsers allow you to access a non-custodial crypto “wallet” offered by our affiliate, Blueboard Limited (an Opera Group company). Blueboard is the data controller for this feature and you can read their privacy statement here. Opera does not act as a data controller for this feature, but may process some data in order to help the wallet to function in our apps.

### SaviSwap

SaviSwap is a free to use smart contract Service provided by Opera which finds and chooses for you the best available swap. If you use SaviSwap, Opera may collect the following data: your public wallet transaction history, asset balance, and public wallet addresses directly via our backend services which collect data directly from the blockchain or use 3rd party services (like for NFTs), which themselves gather data from the blockchain. We may share those data with swap providers to find the best swap for you. We store the data in the user’s local storage (a feature that is available natively in each browser) for caching purposes.

### Free VPN

When you use our free, built-in browser VPN service, we do not log any personal data or other information related to your browsing activity and originating network address. All traffic in the browser is encrypted using strong industry standard encryption as long as the VPN is active.

### VPN Pro

Depending on where you live, you may be able to purchase a paid, premium VPN service called VPN Pro.

- VPN Pro is provided by a third-party service provider which owns, operates, and maintains the infrastructure which provides the Service. Data communicated through VPN Pro will be encrypted and routed through one of thousands of servers around the world. However, we do not promise that the service is absolutely secure. Despite our best efforts and the best efforts of our provider, criminals or other bad actors may still be able to access your data.

- VPN Pro is a no-log service. We do not collect or store records of web pages you visit or links you click on in the servers dedicated for this Service.

- To use VPN Pro you need to create and sign in to an Opera account. We use your Opera account to identify you as a valid subscriber to the VPN Pro service. We will share only information required to identify you as a subscriber with our third-party service provider, including a random ID number. We do not share your email, name, or other data or personal data with our third-party service provider.

Purpose: To provide the service.

Legal Basis: Contractual grounds.

### AI Chat

Depending on which version of the browser you are using, you may be able to access an AI-powered chat assistant (‘AI Chat’). AI Chat is powered by OpenAI (a US-based company). To access AI Chat, you will need to sign into your Opera Account. We do not share your Opera Account data with anyone, including OpenAI. For more information on how we use and retain Opera Account data, see the section on Opera Account above. Any information you include in an AI Chat is shared with OpenAI. AI Chat processes your input in order to give you more contextualized output. Such processing happens within each separate session with AI Chat and involves all data, which you provide to AI Chat, including personal data. We will ask you for a separate consent for aforesaid data processing.

After your session is complete, your chats will be stored locally, but will not be retained by OpenAI. Chats will be retained for 6 months, and then automatically deleted. You can delete them by going to the chats list by clicking the chat bubble icon on the top bar of the chat. There you can either delete them one at a time by swiping, or you can select multiple chats and delete them all at once by clicking the bin icon. If you want to delete all your conversations and erase all data related to this feature, you can clear the data in the Settings menu.

Purpose: To provide and manage the service

Legal basis: Legitimate interest (for Opera Account data), Consent (for any data you input to AI Chat)

### Data Compression

Extreme-savings mode (in Opera Mini) renders web pages on our servers before sending a compressed version of the content to the application on your device. High-savings mode (Opera Turbo) does not render content, but our servers look through your requests to see if any elements on the page can be compressed before sending them to your device. If you use extreme-savings mode or Opera Turbo in Opera Mini we log your IP address as well as a randomly generated ID, advertising ID, and URLs of your requests that are sent through our servers, but not the content. We may also log a phone number and IMEI, if they were provided by your mobile operator. If you use Opera Turbo in Opera for Android, we log IP address URLs of requests. We use this data to debug and improve our services, and we store it in our server logs for up to forty-five days. Then we anonymize and aggregate this data, and may allow our business partners access to it.

Purpose: To provide the service; improving our products and services; monetization (anonymized data only).

Legal basis: Contractual grounds; legitimate interest.

### Cashback

Cashback is an incentive program where you can earn rewards when purchasing goods or services from participating online merchants. When you choose to use the Cashback program and visit supported websites, we will collect merchant URLs, a list of your purchased items, transaction amounts, and IP address. This data is required for the Cashback service to function, and we also use it to provide more relevant partner deals, and to detect fraud and misuse of the service. To enable payouts, your Opera account will be linked with a payment service provider, which will share your customer ID, and relevant payment related data with Opera. Your payment data may be stored for up to five years due to regulatory requirements. You can modify your Opera account, delete it, or request a copy of your data using your profile page. Your Cashback data will be automatically deleted after two years of inactivity. You may choose to delete your Cashback account, which will erase your personal data from the system, through the Account Setting menus in Cashback account.

Purpose: To provide and improve the service.

Legal basis: Contractual grounds, legal compliance.

### Hype

Depending on where you live, you may be able to access the Hype messaging service within Opera Mini. If you choose to use Hype, you will be prompted to give us your phone number, which is required to operate the service. You will also be asked if you agree to give us access to your contacts, in order to connect with other Hype users. You do not need to give us your contacts in order to use the service. We will retain your phone number and contacts for as long as you use Hype. Additionally, you also have the option to upload profile information at your discretion, including a user name, avatar, and your friends. If you delete your account, or go inactive for a while, we will retain this data for a short period of time in case you decide to reactivate.

Purpose: Providing the service.

Legal basis: Contractual grounds, legitimate interest.

### Malicious-site Check

We use a fraud prevention framework and check the URLs you visit against lists of known, malicious websites to protect you online.

### Personalized Ads & Profiling

Based on data such as Advertising ID, News Client ID, general location, and device information, some of our Applications serve targeted ads. These ads are provided by our monetization partners. You can always adjust your personalized ad choices in the application’s “Settings” menu or through your operating system’s settings.

As noted in our End User License Agreements and Terms of Service, our applications are generally provided for free and as such are ad-supported. Collecting this information helps us offset the costs of our business and helps provide a more personalized experience for the user.

We may also combine this data with other elements – including categories of websites you search and visit, device information (model, release date, device IDs, hardware specifications, operating system, etc.), and categories of ads you have clicked on in our products - to build a better understanding of what our users are interested in. We do not log or store your entire browsing history for this purpose. Instead we simply make a record of whether you have visited certain categories of websites based on the domains of pages you visit and mix it with other data (which might depend on which application you use, and may include page loads, number of SpeedDial clicks, whether you have ad blocker enabled or not, etc.) to make an informed guess about whether you are interested in broad categories of interests (such as sports, gaming, news, etc.). We then add this basic profile to other data, such as your general location (country or city) in order to enable our advertising partners to target their ads to groups of users who might be interested in their products and services. We do not share your personal interests or browsing history with anyone. We retain this data for up to one year after which it is deleted automatically.

We process this data based on your consent. If you would like to view your options, or to withdraw your consent, please visit the settings menu of the application you are using.

Purpose: Improving our products and services, monetization.

Legal Basis: Consent.

### Speed Dials

Our browsers include visual bookmarks on the home screen which we call Speed Dials. You can customize the Speed Dials through the application’s settings menu. Some Speed Dials are ads provided by our advertising partners. If you choose to use Opera’s default Speed Dials, you may be redirected through Opera’s partners or other third parties. These partners and third parties may collect data from you independently of Opera. This data may include third party cookies, device IDs, and session statistics. If you wish to opt out of such data collection, you can easily configure your browser’s Cookie Settings to reject third party cookies. You may also choose not to receive Speed Dial suggestions, or to adjust your Speed Dials by deleting preset options based on your own preference.

### Promotion & Marketing

We process some data in order to promote and market our products and services. Some of this data comes directly from you, when you submit it to us for some specific purpose. For example, if you decide to provide feedback to Opera or participate in a promotional campaign, contest, or survey, organized by Opera or our partners on behalf of Opera, we may ask for information such as your name, age, phone number, email, or postal address. Depending on the nature of the campaign or contest, it may be necessary to share your data with third parties. When that applies, we will make it clear in the terms applicable to the campaign.

If you agree to receive marketing information from Opera via email, SMS, or push notifications, we may use third-party technology providers to deliver such messages to you. You can opt-out from marketing communication at any time in your user profile settings or directly from a marketing email you receive.

If you submit your phone number or email address on an application download page, we may send you a download link via SMS or email for your convenience.

We may display in-app campaigns and promotions of Opera products, services or features through push-notifications. You may disable these notifications through your settings menu.

In general when we process data in the context of a promotional campaign, contest, or survey, we process your personal data on the basis that doing so is necessary to enable you to participate in the campaign. In some cases we may process data for marketing purposes based on your consent. In any case we will not retain your data any longer than necessary to fulfill the specific purpose for which it was processed to begin with. You can always control your preferences via the settings menu, and if you have other concerns you can reach us through this form.

Purpose: To promote our products and services.

Legal Basis: Varies by context as explained above - may include contractual grounds, legitimate interest, or consent (in some cases).

### Third Party Technologies

Our applications and services include third-party technology or code, some of which may use your data in different ways. When such third-party technologies use previously collected data, they typically act as data processors for us. When they collect data on their own, they typically act as independent data controllers. For convenience, we have included links to their privacy policies below. Data controllers are marked with an asterisk.

- All mobile applications
  - Google Geolocation API*
- Opera for Android
  - AppsFlyer
  - Facebook SDK*
  - Firebase Cloud Messaging
  - Google AdMob*
  - Firebase Analytics
  - Infura
  - Outbrain*
  - Amazon Assistant
  - Gateway
  - Polygon
  - Ronin
  - Solana
  - Near
- Opera for iOS
  - AppsFlyer
  - Firebase Cloud Messaging
  - Firebase Crashlytics
  - Google AdMob*
- Opera Mini for Android
  - AppsFlyer
  - Facebook SDK*
  - Firebase Cloud Messaging
  - Firebase Analytics
  - Google AdMob*
  - Outbrain*
  - Pangle Ad SDK
  - Mobpower Ad SDK
  - MobVista SDK
- Opera Mini for iOS
  - AppsFlyer
  - Facebook SDK*
  - Google AdMob*
- Opera GX for Android
  - Facebook SDK*
  - Firebase Cloud Messaging
  - Google AdMob*
  - Infura
  - Outbrain*
- Opera GX for iOS
  - Firebase Cloud Messaging
  - Firebase Crashlytics
- Opera Touch
  - AppsFlyer
  - Firebase Cloud Messaging
  - Firebase Crashlytics
- Payment service providers
  - Paypal*
  - PayU*
  - Google Billing Services
  - Cypix
  - Rapyd
  - Xsolla
- Technology providers
  - Sendinblue
  - Freshdesk
  - OpenAI

Please note that this list of third-party entities applies only to the currently supported versions of our applications and services.

## Websites

The following sections describe how we process data (including, but not limited to personal data) when you visit or use our websites - including opera.com, Loomi.tv, and more.

### Promotion & Marketing

We process some data in order to promote and market our products and services. Some of this data comes directly from you, when you submit it to us for some specific purpose. For example, if you decide to provide feedback to Opera or participate in a promotional campaign, contest, or survey, organized by Opera or our partners on behalf of Opera, we may ask for information such as your name, age, phone number, email, or postal address. Depending on the nature of the campaign or contest, it may be necessary to share your data with third parties. When that applies, we will make it clear in the terms applicable to the campaign.

If you agree to receive marketing information from Opera via email, SMS, or push notifications, we may use third-party technology providers to deliver such messages to you. You can opt-out from marketing communication at any time in your user profile settings or directly from a marketing email you receive.

If you submit your phone number or email address on an application download page, we may send you a download link via SMS or email for your convenience.

We may display in-app campaigns and promotions of Opera products, services or features through push-notifications. You may disable these notifications through your settings menu.

In general when we process data in the context of a promotional campaign, contest, or survey, we process your personal data on the basis that doing so is necessary to enable you to participate in the campaign. In some cases we process data for marketing purposes based on your consent. In any case we will not retain your data any longer than necessary to fulfill the specific purpose for which it was processed to begin with. You can always control your preferences via the settings menu, and if you have other concerns you can reach us through this form.

### Cashback

Cashback is an incentive program where you can earn rewards when purchasing goods or services from participating online merchants. When you choose to use the Cashback program and visit supported websites, we will collect merchant URLs, a list of your purchased items, transaction amounts, and IP address. This data is required for the Cashback service to function, and we also use it to provide more relevant partner deals, and to detect fraud and misuse of the service. To enable payouts, your Opera account will be linked with a payment service provider, which will share your customer ID, and relevant payment related data with Opera. Your payment data may be stored for up to five years due to regulatory requirements. You can modify your Opera account, delete it, or request a copy of your data using your profile page. Your Cashback data will be automatically deleted after two years of inactivity. You may choose to delete your Cashback account, which will erase your personal data from the system, through the Account Setting menus in Cashback account.

Purpose: To provide and improve the service.

Legal basis: Contractual grounds, legal compliance.

### Opera Account

None of our browsers or websites require that you sign-in before you can start using them. However, you have the option to create an Opera account to use certain services (like our blogs, VPN Pro, Loomi, or Cashback, etc.). Again, you do not have to create an Opera account to use our browser applications for regular browsing activities, such as browsing the web.

If you choose to create an Opera account, we may for a preferred username and an email address. The email address will be used to identify you as a user and for password recovery. Alternatively, you can use your Facebook, Twitter, or VK account to sign in into an Opera account and access our services with the same profile. In this case we collect information such as your name, profile picture, and email address from these social networks. If you use your Opera account in conjunction with a service like VPN Pro or Cashback, whatever data we process in connection with those services will be associated with your Opera account.

You can modify your Opera account, delete it, or request a copy of your data using your profile page. We retain your data for seven days after you’ve decided to discontinue your Opera account in case you change your mind. Your Opera account with a verified email address will be deleted automatically if you don’t sign in for two years. Accounts with unverified email addresses will be deleted after six months of inactivity.

Note also that Opera allows you to sync your browser data, such as Speed Dial entries and bookmarks, between devices that have another Opera browser installed on them. The servers we use for this service do not retain this data.

Purpose: to allow you to access certain services.

Legal basis: Contractual grounds, legitimate interest.

### AI Chat

Depending on which version of the browser you are using, you may be able to access an AI-powered chat assistant (‘AI Chat’). AI Chat is powered by OpenAI (a US-based company). To access AI Chat, you will need to sign into your Opera Account. We do not share your Opera Account data with anyone, including OpenAI. For more information on how we use and retain Opera Account data, see the section on Opera Account above. Any information you include in an AI Chat is shared with OpenAI. AI Chat processes your input in order to give you more contextualized output. Such processing happens within each separate session with AI Chat and involves all data, which you provide to AI Chat, including personal data. We will ask you for a separate consent for aforesaid data processing.

After your session is complete, your chats will be stored locally, but will not be retained by OpenAI. Chats will be retained for 6 months, and then automatically deleted. You can delete them by going to the chats list by clicking the chat bubble icon on the top bar of the chat. There you can either delete them one at a time by swiping, or you can select multiple chats and delete them all at once by clicking the bin icon. If you want to delete all your conversations and erase all data related to this feature, you can clear the data in the Settings menu.

Purpose: To provide and manage the service

Legal basis: Legitimate interest (for Opera Account data), Consent (for any data you input to AI Chat)

### Loomi by Opera

Depending on where you live, you may be able to access the Loomi Service to stream or download movies and other content from within the browser or via the Loomi.tv website. If you use the Loomi Service, Opera will collect the following data:

- Opera account data. Using Loomi requires creating an Opera account. We use your Opera account data to provide and administer the Loomi Service, for example to determine your default language, to list titles you have watched and payments you have made, and to inform you about changes to the Service. We retain this data for as long as your Opera account is active (as described above).

  Purpose: To provide you the service.

  Legal Basis: Contractual grounds.

- Content-related data. We collect data, such as the titles you have viewed, titles you have rented, and where you have left off in a movie, in order to manage your account and so that you can resume viewing at a later time. We also collect additional data, such as your IP address and a unique, randomly-assigned internal identification number, in order to comply with certain legal and/or contractual obligations, such as ensuring that you are located in a territory covered by the applicable content license, and detecting abusive or illegal use of the Loomi Service. Information about titles and views is associated with your Opera account and will be retained for as long as your account is active, however your payment data may be stored for up to five years due to regulatory requirements.

  Purpose: To provide you the service; to understand our users and improve the service.

  Legal Basis: Contractual grounds, legal compliance.

- Usage statistics. We collect information, such as user agent, operating system, IP address and content identifiers, for the purposes of debugging and improving the Loomi Service. This data is retained for up to forty five days.

  Purpose: To improve the service.

  Legal Basis: Legitimate interest.

- Third Parties. If you use Loomi, we share data with selected suppliers or other third parties for different purposes. If you choose to make a rental purchase via Loomi, data will be collected by our third-party payment service providers, such as PayU. We also use suppliers such as EZDRM to manage content license compliance, and Neutrino to detect improper VPN usage.

  Purpose: To provide you the service; to monitor license compliance.

  Legal Basis: Contractual grounds, legal compliance.

### GX Cloud

GX Cloud is a set of online services, and a community for gamers, consisting of the following websites: GX Games, GX Store, GX Create, and GX Me, which give you access to games and other content and the option to play, compete in, and create video games, mods, and other. You do not need an account to play most games; however, to get access to certain content (including paid content), participate in challenges, or to create content, you need an Opera account. After signing up for the first time, you will be prompted to provide your date of birth and an optional avatar. We use your date of birth to ensure you are eligible to use the service. You can modify your Opera account, delete it, or request a copy of your data using your profile page.

Purpose: To provide the service.

Legal Basis: Contractual grounds.

### Use of Cookies

We use cookies on our websites for session management and retaining your settings or preferences. We may also use third-party cookies to collect visitor statistics and measure our marketing campaigns. If you would like to reject third-party cookies, please configure your browser’s settings accordingly. Please refer to our Cookie Policy for more information.

### Third Party Technologies

Our web services include third-party technology or code, some of which may use your data in different ways. When such third-party technologies use previously collected data, they typically act as data processors for us. When they collect data on their own, they typically act as independent data controllers. For convenience, we have included links to their privacy policies below. Data controllers are marked with an asterisk.

- Loomi
  - Neutrino
  - EZDRM
- GX Games
  - Google Analytics
- Technology Providers
  - OpenAI
- Payment Service Providers
  - Paypal*
  - PayU*
  - Google Billing Services
  - Cypix
  - Rapyd
  - Xsolla

## General Topics

### Data Controller & Internal Processing

Opera browsers are developed and published by Opera Norway AS, a company registered under the laws of Norway. Therefore Opera Norway AS acts as the primary data controller for Opera browsers and services.

The Opera Group companies work together to develop our apps, and to market, distribute, and monetize them around the world. In general, the other companies of the Opera Group that may have access to personal data act as data processors for Opera Norway. As a matter of company policy, we apply the GDPR to our internal processing in general, even in contexts where it might not apply directly to our affiliated companies outside of Europe.

### Use of Cookies

We use cookies on our websites for session management and retaining your settings or preferences. We may also use third-party cookies to collect visitor statistics and measure our marketing campaigns. If you would like to reject third-party cookies, please configure your browser’s settings accordingly. Please refer to our Cookie Policy for more information.

### Children’s Privacy

There are no guarantees that children cannot enter our websites or use our applications without parental consent or notification. Therefore, and as provided in our End User License Agreements, we require children to include their parents in the download process, and we encourage parents to read this privacy statement before allowing their children to use our applications and services.

### International Data Transfers

As noted above, in different contexts we may share or make available data (including personal data) with other members of the Opera Group, and sometimes with third parties, such as our marketing and monetization partners. Where applicable, we insist that a legally valid mechanism is used to protect such transfer, including for example the European Union’s model contracts for the transfer of personal data to third countries (also known as the “standard contractual clauses”) to ensure adequate protection of your personal data.

### Your Rights And Statement Updates

You have the right to make a request to access or delete any of your personal data that we might possess. You can make a request via this online request form or by contacting our Data Protection Officer at the address below. You may be required to provide additional information to authenticate your request. You also have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, which can be contacted through their webpage.

When we post changes to this privacy statement, we will include the date when the statement was last updated. If we significantly change this statement, we will notify you about the upcoming change via our website or using in-app notifications. We encourage you to review this statement periodically.

### Contacts

If you have any questions about this statement or any privacy issues in our applications or services, feel free to contact our Data Protection Officer via this online request form or by post:

    Opera Norway AS
    P.O. Box 4214, Nydalen
    0401, Oslo
    Norway