VirtuWa Privacy Policy

Privacy Policy

VirtuWa Company is committed to protecting individual privacy and Processing Personal Data lawfully, fairly and transparently. This Policy describes our practices under the Saudi Personal Data Protection Law issued by Royal Decree No. M/19, as amended, its Implementing Regulations, the Regulation on Personal Data Transfer Outside the Kingdom, and other applicable legal requirements.

1 Controller Identity and Scope

VirtuWa Company is a Saudi single-person limited liability company, Unified National Number 7054874446, based in Riyadh, Kingdom of Saudi Arabia. VirtuWa develops and provides virtualization, hybrid-cloud management, migration, backup and recovery, and automation solutions, including ASAS HV, Lejam Cloud Manager, Jisir, Hemaya and Mehad, together with related licensing, support, training and proof-of-concept services.

This Policy applies to Personal Data that VirtuWa Processes when you visit our website, contact us, request a demonstration, trial or proof of concept, enter a customer, partner, distributor or supplier relationship, use licensing, support, training or event services, or apply for employment. We may provide a supplemental notice for a particular activity; that notice applies to the activity together with this Policy.

2 VirtuWa Privacy Roles

VirtuWa acts as Controller for website visitor data, business contacts, users of our portals, and account, licensing, billing, marketing, support and relationship-management data. In these cases, VirtuWa determines the purposes and means of Processing.

For Personal Data that a customer places in workloads, virtual machines, backups or customer-managed infrastructure, the customer normally acts as Controller. VirtuWa acts as Processor only when it provides a service requiring authorized access to that data on the customer's behalf. Such Processing is governed by the customer agreement, an applicable Data Processing Addendum where required, and the customer's documented instructions. As Controller, the customer remains responsible for establishing a lawful basis for Personal Data placed in its environment, providing required notices, ensuring the lawfulness of its instructions to VirtuWa and enabling Data Subjects to exercise rights for Processing whose purposes and means the customer determines, while VirtuWa remains responsible for its own statutory obligations as Processor. Because the products are commonly deployed in customer-controlled environments, VirtuWa does not routinely receive workload content unless the customer enables a service requiring transfer or makes it available or voluntarily provides it for support or diagnostics. When requesting support, customers should minimize Personal and confidential data to what is necessary, redact or mask unnecessary data where practicable, and use approved secure transfer channels.

3 Personal Data We May Collect

• Professional identity and contact data, such as name, job title, organization, business email, telephone number, country and city.

• Account and relationship data, such as authorized-user details, role, permissions, language preference, communications history and consent records.

• Commercial and contractual data, such as quotations, purchase orders, subscriptions, entitlements, invoices, payments, renewals and the distributor or partner associated with a transaction.

• Product and licensing data, such as customer identifier, Cluster ID, license key or token, products, versions, activation and expiry dates, entitlement status and deployment metadata necessary to validate licensing. A license may not be used for another customer or cluster except under VirtuWa's written terms.

• Technical and usage data, such as Internet Protocol address, device type, browser, operating system, timestamps, session identifiers, security and audit logs, usage events and error events, depending on the service and enabled settings.

• Support and diagnostic data, such as tickets, correspondence, recordings where notice is provided, and logs, diagnostic files or configuration information uploaded or made accessible by the customer. Please do not submit Personal Data or confidential data that is unnecessary to resolve the case.

• Website, cookie and analytics data, such as pages visited, referral source, language, consent choices and cookie identifiers, subject to applicable settings and consent.

• Event, training and recruitment data, such as registration, attendance, assessment results, certifications, CV, qualifications, work history, interview information and professional references.

We do not ordinarily seek to collect Sensitive Data. Where Processing Sensitive Data is necessary, we will do so only under an applicable lawful basis, to the minimum extent necessary, with appropriate safeguards and Explicit Consent where legally required. VirtuWa does not photograph or copy official documents issued by Public Entities in which a Data Subject is identifiable except upon request from a competent Public Authority or where necessary to fulfil a legal requirement; such documents will be protected and destroyed when the purpose ends unless retention is legally required. Providing data is mandatory only when necessary to enter into or perform a contract, issue a license, provide support or comply with law. If you do not provide it, we may be unable to provide the requested service.

4 Sources and Collection Methods

We collect data directly from you through forms, correspondence, meetings, contracts, portals, trials, support, events and job applications. We may collect data indirectly from your organization or an authorized user, a distributor or partner involved in an opportunity, a service provider acting for us, or lawfully available public sources. Systems may also collect limited data automatically through logs, cookies, security tools and diagnostic functions. Collection methods must be clear, secure and free of deception, and collection is limited to data directly relevant and necessary for the purpose. Where we obtain Personal Data from a source other than you, we will provide the information required by law without undue delay and within the statutory period, unless an exception under the Law or Regulations applies.

5 Purposes and Lawful Bases

• Responding to enquiries and requests for proposals, demonstrations, trials and proofs of concept, based on steps requested by you or our legitimate interest in managing a business relationship.

• Creating accounts, managing subscriptions, activating licenses tied to the customer and Cluster ID, validating entitlement and preventing license misuse, to perform a contract and for our legitimate interests in protecting product, revenue and security.

• Providing support, maintenance, updates and training, and managing incidents, complaints and service levels, to perform the contract and for our legitimate interest in operating and improving services.

• Protecting platforms, websites and technical infrastructure; verifying identity; preventing fraud, abuse and attacks; and conducting audits and investigations, based on legitimate interests and legal obligations.

• Analyzing website and product performance and improving quality, experience and features, based on Consent where required or legitimate interests after balancing the rights of individuals. Sensitive Data is not Processed on this basis.

• Sending direct marketing communications based on your Consent as required by applicable law, while keeping evidence of Consent, clearly identifying the sender and providing a free and easy method to stop marketing at any time. Administration of events and existing customer or partner relationships may, depending on the activity, rely on contract performance, Consent or legitimate interests after confirming that the basis applies and does not adversely affect Data Subject rights.

• Complying with law and official requests, accounting and tax requirements, recordkeeping, and protecting legal rights and claims, based on a legal obligation or legitimate interest.

• Assessing job applications, communicating with candidates and verifying qualifications, to take pre-contract steps and based on Consent where necessary.

When we rely on Consent, it will be freely given, specific, clear and documented, and separate Consent will be sought for purposes that require it. Before Processing for a new purpose incompatible with the original purpose, we will identify a lawful basis and provide an appropriate notice or seek new Consent as required.

6 Storage Use and Security

Data is stored in VirtuWa systems or with approved service providers according to the nature of the service and the customer agreement. Workload data in products deployed at a customer site remains under customer control unless the customer requests the transfer of specific data or permits access. Certain business, support or communications tools may be hosted inside or outside the Kingdom, subject to the transfer requirements below.

We implement administrative, organizational and technical measures proportionate to the nature of the data and Processing risks, consistent with applicable legal requirements and relevant cybersecurity controls and standards. These may include need-based access controls, authentication, encryption in transit and at rest where appropriate, event logging, backups, vulnerability management, environment segregation, confidentiality commitments, service-provider assessment and incident-response plans. These controls are intended to reduce risk, and no technical method can eliminate risk entirely; we therefore review and improve controls continuously, without limiting any statutory obligation applicable to VirtuWa.

7 Disclosure of Personal Data

We may disclose the minimum necessary data to approved providers of hosting, communications, email, customer relationship management, analytics, payment, support, security and training services acting under our instructions, after assessing that they provide sufficient guarantees for Personal Data protection and subject to appropriate contractual obligations where they act as Processors; distributors and partners involved in an opportunity or transaction where necessary and expected or with your Consent; professional advisers, auditors and insurers; competent public or judicial authorities when required by law; or parties to a reorganization, investment or sale of a business, subject to appropriate safeguards. Where a Processor or subprocessor is used, applicable statutory requirements and appropriate data-processing terms apply, including subprocessor notice or authorization requirements where applicable. We do not sell, rent or trade Personal Data.

8 Transfers Outside the Kingdom

If delivering a service or operating an approved tool requires Personal Data to be transferred or made accessible outside the Kingdom, the transfer will occur only for a permitted purpose and in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom. We limit transfers to the minimum necessary, assess the applicable protection and legal requirements, and apply appropriate safeguards where required, including the Standard Contractual Clauses issued by the Competent Authority, Binding Common Rules or recognized certification mechanisms. We conduct a transfer risk assessment where required by the Regulations and take reasonable steps to preserve Data Subjects' ability to exercise their rights and VirtuWa's ability to meet breach-notification, security and destruction obligations. If required transfer conditions or safeguards cease to be available or adequate, we will suspend the transfer or take another legally appropriate measure.

9 Retention and Destruction

We retain Personal Data for the period necessary to achieve the specified purpose or for the period required by law, whichever is longer where a legal retention requirement applies. The following default criteria apply unless a contract or specific notice states another period:

• Enquiries, sales opportunities and trial requests: up to 24 months after the last meaningful interaction, unless a contractual relationship begins or a valid destruction request applies.

• Account, subscription, licensing, contract and billing data: for the relationship and then for the applicable legal recordkeeping or limitation period needed for compliance, claims and audit.

• Support tickets: up to 3 years after closure. Temporary diagnostic files are ordinarily destroyed within 90 days after closure unless needed for an investigation or required by contract or law.

• Security, audit and activation logs: ordinarily up to 24 months, with longer retention where an incident, investigation, contract or legal duty requires it.

• Marketing data: until Consent is withdrawn, you opt out, or the purpose ends. We may retain minimal suppression-list information to evidence and respect your choice.

• Unsuccessful recruitment applications: up to 12 months after recruitment ends, unless you Consent to longer retention or a legal requirement applies.

• Rights-request and Consent records: for the period necessary to demonstrate compliance and address any complaint or claim.

When the purpose ends and no lawful retention basis remains, we destroy data so it cannot practicably be restored or linked to an individual, or we irreversibly anonymize it. Destruction covers active and backup copies through a technically reasonable secure-deletion cycle, subject to legal requirements.

10 Cookies and Similar Technologies

Our website may use cookies necessary to operate and secure the site and remember language or session settings. Non-essential analytics, personalization or advertising cookies are used only according to your choices and required Consent. You can manage choices through the consent banner or browser settings. Disabling necessary cookies may prevent some functions. When such tools are used, the consent-management tool should identify the actual cookies, providers, purposes and durations.

11 Your Rights and How to Exercise Them

Subject to legal limitations and exceptions, you have the following rights:

• The right to be informed of the lawful basis, purpose, collection and Processing methods, storage, destruction and parties to whom data may be disclosed.

• The right to access your Personal Data available to us.

• The right to request a readable and clear copy of your data in a technically feasible format.

• The right to request correction, completion or updating of inaccurate or incomplete data.

• The right to request destruction of data that is no longer required or in other circumstances established by law.

• The right to withdraw Consent at any time where Consent is the basis, without affecting prior lawful Processing or Processing based on another lawful basis.

• The right to submit a complaint to the Competent Authority concerning application of the Personal Data Protection Law and its Regulations.

• The right to claim compensation for material or moral damage resulting from a violation of the Law or its Regulations, in accordance with applicable legal procedures and requirements.

To exercise a right or submit an enquiry or complaint, email privacy@virtuwa.com with a clear description of your request. We may request reasonable information to verify identity and authority before executing the request and to protect data against unauthorized disclosure. We will act on the request without undue delay and within no more than 30 days from receipt. Where permitted by the Regulations, this period may be extended by up to an additional 30 days, and we will notify you in advance of the extension and its reasons. If you are dissatisfied with our response, you may complain to the Saudi Data & AI Authority through the National Data Governance Platform.

12 Marketing and Withdrawal of Consent

We will not Process your Personal Data for Direct Marketing unless the Consent required by law has been obtained. Direct marketing communications will clearly identify VirtuWa and provide a free and easy mechanism to stop receiving marketing that is as simple as the mechanism used to provide Consent. You may withdraw Consent or unsubscribe through the link in the message or by contacting us, and we will stop the related Direct Marketing without undue delay. Marketing opt-out does not prevent necessary operational, security or contractual service notices that rely on another lawful basis.

13 Personal Data Breaches

We maintain procedures to identify, assess, contain, investigate and document corrective actions for Personal Data Breaches. If a breach may cause harm to Personal Data or a Data Subject or conflict with the Data Subject's rights or interests, we will notify the Competent Authority within no more than 72 hours after becoming aware of the incident, subject to the applicable legal thresholds and requirements. If all required information cannot be provided within that period, we will provide the available information and complete the notification as soon as possible with reasons for the delay. We will also notify affected Data Subjects without undue delay where the statutory conditions are met, describing the nature of the incident, risks, measures taken and available recommendations to reduce impact.

14 Children and Persons Lacking Capacity

VirtuWa services are directed to organizations and professionals, not children. We do not knowingly collect data of a child or person lacking full capacity without a lawful basis and guardian Consent where required. If we learn that such data was collected without a lawful basis, we will take appropriate steps to stop Processing and destroy it.

15 Third Party Links and Services

Our website or communications may link to independent third-party services. Those independent services are governed by their own privacy policies, and VirtuWa is not responsible for the independent practices of an entity that is not acting as a Processor on VirtuWa's behalf. Service providers that Process Personal Data on our behalf remain subject to the statutory and contractual safeguards described in this Policy and applicable data-processing agreements. Review each independent service's privacy policy before submitting data to it.

16 Updates and Contact

We may update this Policy to reflect changes in products, Processing or legal requirements. We will publish the updated version and effective date and provide additional notice where a material change requires it. We will not use an update to reduce your rights retroactively without a lawful basis.

Contact the VirtuWa Privacy Team: privacy@virtuwa.com

Website: https://www.virtuwa.com

Address: Riyadh, Kingdom of Saudi Arabia