As one of the world’s most trusted antivirus brands, our goal is to help you with defenses against threats in cyberspace. To do so, we may have to collect your personal data to provide you with the best weapons and the most up-to-date security. We do not take your trust for granted so we’ve developed a Privacy Policy that covers how we collect, use, disclose, transfer, and store your personal data.
This Privacy Policy was last updated in June 29, 2025.
Who We Are
Avast (collectively “we”) is part of Gen™ – a global company with a family of trusted consumer brands.
The Controller of your personal data is Avast Software s.r.o., which has its principal place of business at 1737/1A Pikrtova, Prague 4, Czech Republic, 140 00.
If you live in the United Kingdom, Avast’s representative established in the UK is NortonLifeLock UK Limited, 100 New Bridge Street, London, England EC4V 6JA.
Privacy Policy Contents
This Privacy Policy describes how we handle and protect your personal data and the choices available to you. Additional information on our personal data practices may be provided in product settings, contractual terms, or notices provided prior to or at the time of data collection.
Please refer to our Products Policy describing specifics of personal data processing within our products and services.
This Privacy Policy is intended for you if you are a user of our products and services. If you are a business partner, the privacy notice that applies to you is located here: Business partner policy.
Personal Data We Process
Personal data refers to any information relating to an identified or identifiable individual (“Personal Data”).
We may collect data or ask you to provide certain data when you visit our websites and use our products and services. The sources from which we collect Personal Data include:
- Data collected directly from you or your device relating to an identified or identifiable natural person (“Data Subject”), and may include direct identifiers such as name, postal and email address, phone number, and online or indirect identifiers such as login account, login password, marketing preferences, social media account, and/or IP address;
- If we link other data with your Personal Data, we will treat that linked data as Personal Data; and
- We may also collect Personal Data from trusted third-party sources such as service providers, distributors, resellers, app stores, contact centers, and engage third parties such as marketing, survey, analytics or software suppliers to collect Personal Data to assist us.
We do not process special categories of personal data, such as data concerning health, race, ethnicity or political opinions, or deduce in any way this type of information from data we collect within our products.
We organize the Personal Data we process into these basic categories: Billing Data, Account Data, Product Data and Communications Data.
Billing Data
The below described billing process applies to all customers who have purchased our products and/or standalone features through our Gen eStore. This information is used to bill those customers for their services and products.
Our parent company, Gen Digital Inc., will act as a controller with respect to processing of the Billing Data.
Billing data includes your name, email address, billing address, your phone number, payment information (depending on method can include Credit/Debit Card Information or PayPal account), National ID (regional specific, if outside the United States), VAT/Tax ID (regional specific, if outside the United States) and device fingerprint ID.
| Billing data | What we use it for |
|---|---|
| Email address | To send you purchase receipts |
| Name and Billing address | To maintain billing records |
| Payment information – payment card info, for businesses only VAT/Tax ID and Business ID | To process the payment and billing records |
| Identifiers – product and license keys/numbers, Wallet ID, Auto bill ID, Payment transaction ID | To identify the product and enable features based on the purchased license and to track account activity between internal company systems, applications, and architecture. This data is also processed for the purpose of delivering the product in accordance with your device(s) as well as for trade compliance and fraud check. |
| Renewability | To check if a given subscription can be renewed under the same or similar terms |
| Expiration date | To check whether a license is current |
| Device fingerprint ID | To validate that an authenticated payment transaction occurred, and the payment card and account are appropriate for billing. |
| IP address | To facilitate the enrollment and purchases and detect and prevent fraud. |
Relevant subsets of Billing data are kept for 7 years for the purpose of complying with our legal obligations (particularly in the finance and tax area) and defending our rights.
In certain cases, you purchase our products and services from a trusted third-party service provider, reseller, or app store. In those circumstances, your Billing Data is processed by the relevant third party and we only receive a subset of this data to keep proper business records. In particular, we only have a masked credit/debit card number, not your full payment details.
Account Data
Account Data includes information to set up and customize an account, such as your name, email address and username, and information connected with our services, such as product, license and device information. For some of our products or some of their functions creating an account is necessary. Account Data is also used for customer management and engagement, revenue generation, and evaluation and optimization of operational, sales and business processes.
| Account data | What we use it for |
|---|---|
| Name | To customize our communications by addressing you by your name |
| Email address | To send you communications regarding your license and support and to offer our other products and services |
| Username | To manage your account and facilitate your login into the service |
| Account usage data (events such as request to end subscription, subscription-related information) | To enable premium features activation, provide tailored life-cycle experience and communication with customer support, suitable product interface content. |
| Subscription renewal date | To help us validate the period the license is active |
| Trial User | To add a grace period prior to the paid period of the subscription |
An account is also necessary for some features of our Forum. In the Forum profile, you have the option to provide additional information within your account such as your name, email address, social media information, birth date, gender, instant messaging information, or website name and address, your physical location, and an avatar or personalized picture. We use Discourse for hosting the Forum.
To register with us or to be able to log in later on our pages or in our products, we offer you, in addition to our own procedure, the option to do this via the services Facebook Connect, Google, and Apple ID. For this purpose, we will redirect you to a page of the corresponding provider. Data from the provider (email, platform ID, optionally name) is then provided to create the account.
The customer account remains valid until you actively delete it in the user administration section of the account. You can also contact our support or DPO in case you would like to delete your account.
Product Data
Product Data includes two sub-categories:
- Device Data includes information about the operating system; hardware; city/country location of device; IP address, device error logs; browser; network; applications running on the device, including the Avast products; and
- Service Data includes information about product usage and events relating to use of our product by you. This information includes security data (samples and detection details such as information concerning URLs of websites, texts, emails and files used for malware and scam protection), usage statistics (activation, crashes, scans, errors), information related to product licenses, support-related data and our internal identifiers associated with our services (e.g. installation ID, internal hardware ID).
These sub-categories differ for each product and service. If you want more detail about Device and Service Data we process on a product basis, please refer to our Products Policy.
Communications Data
If you contact us directly, request information or provide reviews and feedback, we collect personal data about you, including identifiers, such as your name, email address, phone number, the contents of any message or attachments that you may send or communicate to us, and any other information you choose to provide. We may retain and review audio, electronic, visual, or similar information, such as audio call and chat recordings and/or the contents of the messages as required/permitted by law and our recording and information management policies. We will also collect identifiers from you, such as your email address and phone number, when you sign up to receive product updates, offers, and other promotional information or messages from us. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our services.
Why We Process Your Personal Data
We use your Personal Data for the following purposes and on the following grounds:
On the basis of fulfilling our contract with you or entering into a contract with you on your request, in order to:
- To process purchase of our products or services from us, our partners or our trusted third- party service providers’ online stores and to bill for products and features purchased;
- To provision the download, activation, and performance of the product or service;
- To keep our products or services up-to-date, safe and free of errors, including implementation of new product features and versions;
- To verify your identity and entitlement to paid products or services, when you contact us for support or access our services;
- To process your purchase transactions;
- To send necessary service and transactional messages and update you on the status of your orders and licences;
- To manage your subscriptions and user accounts; and
- To provide you with technical and customer support. This may include remote access to your device to better solve the issue. For this purpose, we will process the information from your product and device (e.g. crash reports, usage data), your contact details as well as other information you will provide to us (e.g. description of the issue).
On the basis of your consent, in order to:
- To subscribe you to a newsletter or the Avast forum;
- To enable the provision of third-party ads in product messages;
- To enable the provision of personalized ads in support of certain free products.
We will always ask for your consent before any processing which requires it and we will provide you with necessary information through our Consent Policy or otherwise as applicable.
In order to fulfill legal obligations, we process your Personal Data when it is necessary for compliance with our legal obligations. We may be obligated to, for instance, keep and process records for tax purposes, accounting, other obligations such as court or other legal orders, anti-money laundering, sanction checks and other necessary disclosures.
On the basis of our legitimate interest we will use your Personal Data to:
- To communicate about possible security, privacy and performance improvements and products that supplement or improve our purchased products and to optimize the content and delivery of this type of communication;
- To evaluate and to improve the performance and quality of our products, services and websites, develop new products, train our employees and to understand usage trends, and analyze user acquisitions, conversions and campaigns. We may also share data and cooperate with partners such as social media providers who, if allowed in accordance with laws, can use information related to you to help us build more relevant audiences;
- To maintain and develop threat intelligence resources, in particular to be able to detect and block malware. We analyze samples of files and URLs we detect on your devices or websites you visit, and we use them to maintain our malware and privacy protection at the highest level possible. We may also share threat intelligence with other security companies and experts to improve our threat detection models;
- To make our systems and applications more secure including to prevent or stop an attack on our computer systems or networks;
- To record our phone conversation when you contact our tech support by phone to better respond to your requests.
- To maintain the effective performance of our business by ensuring necessary internal administrative and commercial processes (e.g. finances, audit, business intelligence, legal & compliance, fraud check, information security etc.); and
- To establish, exercise, or defend our legal rights.
Your interests are a key part of our decision-making process and have been considered in all of the above-mentioned processing activities. We believe we have achieved a fair balance between privacy and business operations. In any case, you have the right to object, on grounds relating to your particular situation, to those processing operations. For more details, please see section Your Privacy Rights.
The list is, however, not exhaustive and depending on the business and legal developments we may process data for other compatible purposes as applicable in accordance with relevant privacy regulations.
Balancing Legitimate Interests
Before relying on our legitimate interests, we balanced them against your interests and made sure they are compelling enough. With respect to the purposes below we consider necessary to explain what our interests are in detail.
Security and Threat Intelligence
We process Personal Data to support network and information security efforts. In line with EU data protection law, organizations have a recognized legitimate interest in collecting and processing Personal Data in a proportionate manner for the purposes of ensuring network and information security. This covers the ability of our networks or of our information systems to resist events, attacks or unlawful or malicious actions that could compromise the availability, authenticity, integrity and confidentiality of the data we store or transmit, or the security of the related services offered by, or accessible via those networks and systems.
Moreover, as a member of the security community, we also cooperate with other players across the security landscape, in particular by exchanging threat intelligence resources, and aid in research and development of new security solutions.
The Personal Data we process for the purpose listed above includes, without limitation, network traffic data related to cyber-threats such as:
- Sender email addresses (e.g., of sources of SPAM);
- Recipient email addresses (e.g., of victims of targeted email cyberattacks including phishing);
- Email header detail including addresses and intermediary systems (e.g., as configured by cybercriminals sending malicious email);
- Filenames and execution paths (e.g., of malicious or potentially harmful executable files);
- Samples (e.g., of malicious or potentially harmful executable files);
- Samples behavior (e.g., of malicious or potentially harmful files);
- URLs and associated page titles (e.g., of web pages broadcasting or hosting malicious or otherwise harmful content); and/or
- IP addresses (e.g., of web servers and connected devices involved in the generation, distribution, conveyance, hosting, caching or other storage of cyber-threats such as malicious or otherwise harmful content).
Product messaging – In-product and Email Messages
We have a legitimate interest in messaging our users about possible security, privacy and performance improvements and about products that supplement or improve the products already purchased. We can also message our customers with information and offers relating to already purchased products (e.g. time-limited offers).
If you are our customer, we feel a responsibility to inform you about security and utility improvements and possible problems to your device and software, and provide you with effective solutions relevant to these problems. Because of this, we have a legitimate interest to optimize the content and delivery of this type of communication to you so that you are likely to find them relevant and non-intrusive at the same time. We use certain limited subsets of Billing Data, Account Data, and Product Data to deliver this communication.
Product and business improvement
We have a legitimate interest to use necessary Personal Data to understand user conversions, acquisitions and campaign performance through various distribution channels, and users’ download, activation and interactions with our products. For example, we want to know how many users clicked on our offers, or purchased our product after seeing one of our ads. These analytics help us improve functionality, effectiveness, security and reliability of our products and business activities as well as helping us to develop new products. This processing includes using third-party tools. Please refer to our Products Policy for the list of third-party tools used for the specific products and services.
How We Process Your Personal Data
We do our best to disconnect or remove all direct identifiers from the Personal Data that we use:
- For free versions, this disconnection or removal of identifiers begins when the products and services are initially activated. For paid users we keep Billing Data in a separate database and minimize its use for anything other than handling payments and our own analytical and financial management activities.
- For both paid and free versions, we continuously monitor for, minimize, disconnect and remove all direct identifiers during the normal performance of the products and services.
Processing of IP Addresses
Your IP address is collected at the time at which your product or service is being provided for the purpose of downloading and installing the products, product authorization, fraud and malware detection and for the purpose of facilitating our billing process. In particular for delivering the content in accordance with your device(s) settings, determining appropriate language settings for communicating with you, troubleshooting issues, and generating appropriate diagnostics reports.
Please refer to our Products Policy for specific use of IP address by our products and services.
Personalization
We use relevant Billing Data, Account Data, Product Data and your answers from surveys, in which you can participate, to personalize our offers, communication and product recommendations.
Where possible we try to provide you with personalized discounts on our products. To do this, we analyze what products you use along with your Product, Account and Billing Data to provide you with a compelling set of products at pricing that meets your needs. Our goal is to continue to serve our loyal customers and bring cyber safety to as many people as possible across the globe while helping our business to grow responsibly.
We do not take any decisions solely based on algorithms, including profiling, that would significantly affect you.
How We Disclose Your Personal Data
We only disclose your Personal Data as described below, within our group of companies, with our partners, with service providers that process data on our behalf and with public authorities, when required by applicable law. Processing is only undertaken for the purposes described in this Privacy Policy and the relevant Products Policy sections. If we disclose your Personal Data, we require its recipients to comply with adequate privacy and confidentiality requirements, and security standards.
We do not sell your personal data to third parties. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about a consumer. Data obtained through short code programs will not be shared with any third-parties for their marketing reasons/purposes.
Payment processors
In certain cases we may use a third party payment processor to take payment from you. These third parties are properly regulated and authorized to handle your payment information and are prohibited from using your Personal Data for any other purposes other than arranging these services for us. However, they are independent controllers of your data with their own responsibility.
| Payment Processor | Link to Privacy Policy | Location |
|---|---|---|
| Softline | https://allsoftglobal.com/en/privacy-policy/ | Cyprus |
| Nexway | https://www.nexway.com/legal-notice-privacy/ | Germany, France, USA |
| Cleverbridge | https://www.cleverbridge.com/?scope=opprivacy | Germany, USA, Japan, Taiwan, Malta |
| Paypal (Braintree) | https://www.paypal.com/en/webapps/mpp/ua/privacy-full | US, Ireland |
| Google Play Store (for mobile apps) | https://business.safety.google/privacy/ | US, Ireland |
| Apple Store (for mobile apps) | https://www.apple.com/legal/privacy/ | US, Ireland |
Your Billing Data is processed by the payment processor from whom you purchased the product. Your data is processed according to the relevant processor’s terms and privacy policy.
Service Providers
We may use contractors and service providers to process your Personal Data for the purposes described in this Privacy Policy and Products Policy. We contractually require service providers to keep data secure and confidential.
Such service providers may include contact centers, professional consultants (including to defend or to exercise our rights), and marketing/survey/analytics/software suppliers. We may also connect with business partners to provide specific services to you such as identity restoration. To provide identity restoration services, we may share, at your direction, your data with financial institutions, financial services companies, and other authorized third parties.
We use Salesforce to provide us the CRM platform (see their privacy information including appropriate safeguards for cross-border transfers).
We use Qualtrics as the provider of the experience management platform used to collect and evaluate customer feedback and insights (see their Privacy statement including appropriate safeguards for cross-border transfers.
We use Civilized Discourse Construction Kit, Inc., for hosting our Forum (see their privacy information).
Sometimes these service providers, for example- our distributors, resellers, and app store partners- will be independent controllers of your data and their terms and conditions, end user license agreements (“EULA”) and privacy statements will apply to such relationships.
No data is shared for cross-contextual advertising and no data is sold to these third parties.
Advertising Companies
To be able to offer our products and services for free, we serve third-party ads in our products for mobile devices. To enable the ad, we embed a software development kit (“SDK”) provided by an advertising company into the product. The SDK collects Personal Data in order to personalize ads for you.
Only few of our free products serve third-party ads. You will be asked for consent during the installation process of any such product. For further information, including the exact scope of processed Personal Data and names of relevant products, please refer to our Consent Policy which includes the list of our advertising partners and their privacy policy.
We may share limited categories of personal data (online identifiers and product-related information used to display appropriate ads) with these third parties for cross-contextual advertising purposes, as defined under California and other applicable U.S. state laws. “Cross-contextual advertising” in this context means advertisements we believe will be more interesting and useful to you based on your data, including data related to the use of our Services. Third parties may use the data we’ve shared with them to show you personalized ads. No data is sold to these third parties.
Distributors, Resellers
We may provide your Personal Data to our partners for the purpose of distribution, sale or management of our products. Our partners may communicate with you about Avast products or services. In addition, you purchase our products directly from our distributor, a reseller, or an app store. Because your relationship in these cases is with that distributor, reseller or an app store, such third party will also process your Personal Data.
No data is shared for cross-contextual advertising and no data is sold to these third parties.
Cookies Providers
Our websites use cookies to personalize your experience on our sites, to tell us which parts of our websites people have visited, to help us measure the effectiveness of campaigns, and to give us insights into user interactions and user base as a whole so we can improve our communications and products. While using our websites, you will be asked to authorize the collection and use of data by cookies according to the terms of the Cookie Policy.
Analytics Tool Providers
We use analytical tools, including third-party analytical tools, which allow us, among other things, to identify potential performance or security issues with our products, to improve their stability and function, to understand how you use our products, and websites so that we can optimize and improve your user experience, and to evaluate and improve our campaigns. We use Service and Device data for analytics.
While we generally prefer using our own analytical tools, we sometimes need to partner with other parties, which have developed and provide us with their own tools and expertise. Below, we list these partners and tools and their privacy policies.
Not all of our products use all of these third-party analytics tools. Analytics tools that we use for diagnosing your product are necessary for service provision. You will find relevant tools listed under each product in our Products Policy.
No data is shared for cross-contextual advertising and no data is sold to these third parties.
Login via third-party providers
| Tool (provider) | More information, link to Privacy Policy | Location |
|---|---|---|
| Google Ireland Ltd. | https://support.google.com/accounts/answer/112802 https://business.safety.google/privacy/ | Ireland |
| Facebook Ireland Ltd. | https://www.facebook.com/privacy/explanation | Ireland |
| Apple Distribution International | https://www.apple.com/legal/privacy | Ireland |
No data is shared for cross-contextual advertising and no data is sold to these third parties.
Public Authorities
In certain instances, it may be necessary for us to disclose your Personal Data to public authorities or as otherwise required by applicable law. No Personal Data will be disclosed to any public authority except in response to:
- A subpoena, warrant or other process issued by a court or other public authority of competent jurisdiction;
- A legal process having the same consequence as a court-issued request for data, in that if we were to refuse to provide such data, it would be in breach of local law, and it or its officers, executives or employees would be subject to liability for failing to honor such legal process;
- Where such disclosure is necessary for us to enforce our legal rights pursuant to applicable law; or
- A request for data with the purpose of identifying and/or preventing credit card fraud.
No data is shared for cross-contextual advertising and no data is sold to these third parties.
Mergers, Acquisitions and Corporate Restructurings
Like any other consumer brand, we too go through our own cycle of growth, expansion, streamlining and optimization. Our business decisions and market developments therefore affect our structure. As a result of such transactions, and for maintaining a continued relationship with you, we may transfer your Personal Data to a related affiliate.
If we are involved in a reorganization, merger, acquisition or sale of our assets, your Personal Data may be transferred as part of that transaction. We will notify you of any such deal and outline your choices in that event, when applicable. Information including personal data relating to our business may be shared with other parties in order to evaluate and conclude the transaction. This would also be the case if we were required by law to make such changes.
Cross-Border Transfers of Personal Data among Group Entities and to Third-Party Vendors
We are a global business that provides products and services all around the world. In order to reach all of our users and provide all of them with our software, we operate on an infrastructure that spans the globe. The servers that are part of this infrastructure may therefore be located in a country different than the one where you live. In some instances, these may be countries outside of the European Economic Area (“EEA”). Regardless, we provide the same GDPR-level of protection to all Personal Data processed.
The intra-group transfers within the Gen Digital Group are covered by the EU-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding the transfer of personal information from the European Economic Area (EEA), the United Kingdom, and Switzerland to the United States. Check here to access the Gen Digital Inc. Data Privacy Framework Notice.
At the same time, when we transfer Personal Data originating from the EEA outside of the EEA or cooperate with a third-party vendor located outside the EEA, we always make sure to put in place appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions adopted by the European Commission, to ensure that your data remains safe and secure at all times and that your rights are protected.
Situations where we transfer Personal Data outside of the EEA include: allowing access to Personal Data stored in the Google Cloud Platform to Google personnel located outside the EEA, the provisioning of our products and services and third-party services related to it, the processing of transactions and of your payment details, and the delivery of support services. Further, an outside-EEA transfer may also occur in case of a merger, acquisition or a restructuring, where the acquirer is located outside of the EEA (see the Mergers, Acquisitions and Restructurings section).