Privacy Policy

1. Who is responsible for your information

VirtuaTech ("VirtuaTech", "we", "us") is the controller of the personal information described in this policy. VirtuaTech is an engineering practice headquartered in New Mexico, United States. It serves clients internationally, including in Canada, France, Belgium, Switzerland, Morocco and other French-speaking markets.

Under Québec's Law 25, responsibility for the protection of personal information rests with the person exercising the highest authority within the organisation. That person is the founder, Mohammed Salim Zaki, who acts as privacy officer and can be reached at infos@virtuatech.co. Use the same address for any request under the GDPR, PIPEDA, or any other applicable law.

2. What we collect, and what we do not

Information you send us. If you email us or use a contact link on this site, we receive your name, your email address, and the content of your message. That is the only personal information this website collects from you directly.

Technical information. Our hosting provider records standard server logs, which may include an IP address, a timestamp, a requested URL and a user agent. These are used for security, diagnostics and abuse prevention, and are not used to build a profile of you.

Cookieless audience measurement. Vercel Web Analytics measures aggregate visits without cookies or cross-site identifiers. It also receives exactly four site events: booking_cta_click, journal_article_read, faq_question_open, and sound_toggle. Their properties are limited to public page context such as placement, language, article slug, public FAQ wording, or an on/off state. We do not send names, email addresses, message content, booking content, form values, URL query strings, or URL fragments.

Vercel Web Analytics is configured without cookies or cross-site identifiers. Vercel receives a timestamp and requested URL (with query strings and fragments removed by us), referrer, browser and operating system information, device type, coarse country or region, and the event data listed above. Vercel derives a daily, non-persistent hash from request information to count visitors; the hash is discarded and reset after 24 hours and is not used to follow you across sites.

Google Analytics, only if you agree. If you accept analytics cookies, Google Tag Manager loads Google Analytics 4. Google may then receive pseudonymous client and session identifiers, page URL and title without query strings or fragments, referrer, language, screen size, device, browser and operating system information, approximate location, and the configured public properties attached to the same four events listed above. Google Tag Manager and Google Analytics do not load, request data, or send a consent ping before you opt in.

With consent, Google Analytics may set _ga and a property-specific _ga_<id> cookie. Google announces a default expiry of two years for these cookies when the property has not been configured otherwise. We have not verified the account-specific Google Analytics retention settings.

Your choice. Necessary storage remains available so the site and this choice can work. Analytics is off by default. Your accept or refuse choice is stored locally, with a version and expiry, for six months. Refusing does not reduce access. You can withdraw or change the choice at any time; withdrawal denies analytics storage, stops future Google event entries, removes accessible _ga cookies, and reloads the page without Google Tag Manager.

Manage cookies

Other local preferences. The loader status and sound choice are also saved in your browser's local storage so the experience can remember them. They are not advertising identifiers and are not shared with other websites. Web fonts are compiled into the site at build time. There is no account system, newsletter, or payment processing here.

We do not knowingly collect information from minors. This site is aimed at business decision-makers. If you believe a child has sent us personal information, contact us and we will delete it.

3. Why we use it, and on what legal basis

Where the GDPR or comparable law applies, we rely on the following bases:

• Performance of a contract, or steps before it. To answer your enquiry, prepare a proposal, and deliver services you have engaged us for.
• Legitimate interests. To keep our systems secure, prevent abuse, retain business records, and use Vercel's cookieless aggregate measurement to improve content, accessibility, performance, and the booking journey.
• Consent. For Google Tag Manager, Google Analytics, analytics storage, and analytics cookies. You may withdraw consent at any time, which does not affect processing that already took place lawfully.
• Legal obligation. To meet tax, accounting and regulatory duties.

We do not sell personal information. We do not trade, rent or share it for anyone else's marketing. We do not engage in cross-context behavioural advertising.

4. Information inside systems we build for clients

When we build or operate a system for a client, that system may process information about the client's own prospects and customers. In that work the client is the controller: they decide what is collected and why, and we act as a processor on their documented instructions.

Client data is never used to train general-purpose AI models, and is never used to market VirtuaTech's own services. Where an engagement requires an AI model provider to process content, that is covered by the agreement with the client and by terms that exclude training on their data.

If you are an individual whose information sits inside a client's system and you want it corrected or deleted, contact that organisation directly, since they control it. If you contact us instead, we will forward your request to them and tell you that we have done so.

5. Automated decisions

Nothing on this website subjects you to a decision based solely on automated processing that produces legal effects for you. Inside client systems, AI agents may qualify or route enquiries, but a human remains responsible for decisions that materially affect a person, such as accepting or refusing a client.

6. Who else may process it

We use Vercel to host this site and provide the cookieless Web Analytics described above. After consent, Google processes the measurement data delivered through Google Tag Manager and Google Analytics. We also use a small number of providers that may include email and AI model providers used inside client systems. We ask for a list in writing before engaging a provider that touches personal information, and we will name our current providers on request.

7. International transfers

We are headquartered in the United States, so information you send us may be processed outside your country if you are in Canada, the EU, the UK, Switzerland, Morocco or elsewhere. Our service providers may also process information in other jurisdictions. Where required, transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, and on assessments of the destination jurisdiction. Ask us and we will describe the safeguards applying to your situation.

8. How long we keep it

• Enquiries that do not become engagements: kept up to 24 months, then deleted.
• Client records: kept for the duration of the engagement and then for as long as tax, accounting and limitation periods require, normally up to seven years.
• Server logs: kept for a short operational period, then rotated.
• Cookie choice: kept in local storage for six months. Google Analytics cookies, when accepted, default to two years unless the Google property is configured otherwise.

9. Your rights

Depending on where you live you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to processing, to receive it in a portable format, to withdraw consent, and to not be discriminated against for exercising a right. In Québec you also have rights to de-indexing and to information about automated processing.

Write to infos@virtuatech.co. We will respond within the period the applicable law requires, normally 30 days under Law 25 and PIPEDA, and one month under the GDPR. We may ask you to confirm your identity before acting, in order to avoid disclosing your information to someone else.

You may also complain to a supervisory authority: the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, the CNIL in France, the Autorité de protection des données in Belgium, Luxembourg's CNPD, the FDPIC in Switzerland, or the CNDP in Morocco.

10. Security

We use access controls, least-privilege practices, encryption in transit, and reputable infrastructure providers. No system is perfectly secure, and we do not claim otherwise. If a confidentiality incident creates a risk of serious injury, we will notify the affected people and the competent authorities as the law requires, and we keep a record of incidents as Law 25 requires.

11. Changes to this policy

When this policy changes, the date at the top of this page changes with it. Material changes affecting how we use information you already sent us will be communicated directly where we have a way to reach you.

12. Contact

Questions, requests and complaints: infos@virtuatech.co. Written correspondence can be sent to the same address, and we will provide a postal address on request.