Shellfire is a VPN service operated by Shellfire GmbH, a company based in Schmitten, Germany. The service runs servers in several countries, and users can choose a server in an EU member state so that the processing of their data stays inside the EU. According to the privacy policy, no personal data is stored on the VPN servers themselves. The privacy policy refers to the GDPR throughout.
The policy names Shellfire GmbH as the responsible company and states that transfers outside the EU must meet GDPR safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses. Some processing falls outside this: Google Analytics and marketing data are sent to Google servers in the USA, and payment data may be processed outside the EU depending on the payment provider. The website does not name the owners of Shellfire GmbH, so a foreign parent company cannot be confirmed. For a European organisation, the German seat and the GDPR commitments are relevant, but the use of US analytics services and the choice of payment provider deserve attention.