From this question I infer that your security objective is to add privacy for your network traffic transmitted over a public WiFi hotspot - as opposed to installing your own VPN Gateway to your own network. You are potentially intending to use a commercial VPN App.
CyberGhost is one of many commercial operators - this one based in Romania. As with all commercial operators, their declared privacy policy and that of reality are not necessarily aligned. As previously commented, the Commercial VPN operator see all your internet traffic.
Absolute privacy cannot be assured when using any commercial VPN operator - whose infrastructure acts as the termination point for your encrypted traffic. All you network traffic leaves their exit node(s) “in clear”. Unless you do something else to protect your traffic, all unencrypted protocols (such as DNS) are unencrypted from the operators VPN Gateway.
Only you can decide if a VPN operator meets your trust criteria. In essence, do your homework. Cost isn’t necessarily a good indication of security, trustworthiness or technical capability.
If speed and security are your target, an alternative that you might consider is hide.me; they offer very speed - and full VPN support for both IPv6 and older IPv4 (some providers only support IPv4). They also support some streaming services via dedicated gateway connections. In addition to manual configuration of your iPad VPN connection, their VPN App also provides direct support for IKEv2, OpenVPN and WireGuard protocols.
Again, I stress, understand precisely what you are attempting to achieve, your security/privacy needs - and the external services that you intend to access.
