Data processing terms

About these terms

Virtum Cloud Ltd, registered in England and Wales, company number 17239759. Registered office: 38 Beechfield House, Macclesfield, Cheshire, SK11 0LP, United Kingdom. On this page, "Virtum", "we" and "us" mean Virtum Cloud Ltd.

You can contact us at sales@virtum.cloud, or about your personal data at privacy@virtum.cloud.

These terms apply whenever we process personal data on behalf of a customer: in the Virtum platform, including during Early Access, and in managed services such as a website we build, host or look after for you. They form part of the Early Access terms and of any proposal or service terms we agree with you. If a written agreement signed by both of us contains its own data processing terms, those apply instead.

"You" means the customer: the organisation that uses the service. Words such as controller, processor, personal data, processing, data subject and personal data breach have the meanings they have in the UK GDPR. "Customer personal data" means personal data we process on your behalf in providing the service.

1. Roles

You are the controller of customer personal data, and we are your processor. If you are yourself processing the data for someone else, for example as a service provider to your own clients, we are your sub-processor, and you confirm that you have their authority to appoint us on these terms.

We are a controller, not a processor, for the data we need to run our relationship with you, such as account, billing and support records, and for keeping the service secure. Our privacy notice covers that.

2. The processing

• Subject matter: providing the Virtum services you use.
• Duration: for as long as we provide the service to you, and afterwards until the data is deleted or returned under section 10.
• Nature and purpose: hosting, storing, backing up, organising, searching, analysing (including with AI features you use), transmitting, displaying and deleting customer personal data, in order to provide, secure and support the service for you.
• Types of personal data: whatever you and your people choose to put into the service, typically names, contact and job details, user account details, IP addresses and device records, and personal data in your documents, tickets, tasks, messages, code and AI conversations; and, for managed websites, what visitors submit through your site, such as enquiries and orders.
• Data subjects: your staff and other users you invite; your customers, suppliers and contacts; visitors to websites we run for you; and anyone else named in your content.
• Special category data: the services are not designed for special category or criminal offence data. Do not put such data into them unless we have agreed it with you in writing.

3. Your instructions

We process customer personal data only on your documented instructions, including about transfers outside the UK, unless UK law requires us to do otherwise; in that case we will tell you first, unless the law forbids it. Your instructions are these terms, your agreement with us, your use and configuration of the service, and any other reasonable written instructions you give us. If we believe an instruction breaks data protection law, we will tell you straight away.

We do not use customer personal data for our own purposes. In particular, we do not sell it, use it for advertising, or use it to train AI models.

4. Confidentiality

Everyone we authorise to process customer personal data is bound by a duty of confidentiality, and only those who need access to provide, secure or support the service have it.

5. Security

We take appropriate technical and organisational measures to protect customer personal data, as Article 32 of the UK GDPR requires. They currently include:

• hosting the platform and its databases on servers Virtum operates in England, reached through a network edge with a web application firewall;
• encryption in transit for connections to the service and for the connection between our network edge and our servers;
• each customer's data kept separate within the platform by access controls the application applies to every request;
• access to production systems limited to named Virtum staff who need it, and a record of administrative actions;
• passwords stored only as one-way hashes, with two-factor sign-in available to every user;
• nightly database backups kept for up to 14 days on storage Virtum operates in the UK, with an encrypted copy in AWS's London region that keeps nightly backups for up to 35 days and one a month for 12 months, and a weekly test that they can be restored; and
• keeping our systems patched and monitored.

We review and improve these measures as the service develops. We do not currently hold a security certification such as ISO 27001, SOC 2 or Cyber Essentials, and we will update this page if that changes.

6. Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page. Before we add or replace a sub-processor, we will update that page and email the owners of your account at least 30 days in advance, unless a change is needed sooner to keep the service secure or working, in which case we will tell you as soon as we can. You can object on reasonable data protection grounds by emailing privacy@virtum.cloud; we will work with you to address the concern, and if we cannot, you may stop using the affected service.

We put each sub-processor under a written contract with data protection obligations that give the same level of protection as these terms, and we remain responsible to you for its performance of them.

7. International transfers

Customer personal data is hosted in the UK. Some sub-processors may process it outside the UK, as the sub-processors page shows. Where that happens, we make sure the transfer is covered by UK adequacy regulations or by the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

8. Helping you meet your obligations

• Data subject requests. You can find, correct and delete most data in the service yourself, and we will give you reasonable further help, including with exporting data, to respond to requests from people exercising their rights. If we receive a request about customer personal data directly, we will pass it to you and will not respond ourselves unless you ask us to.
• Security, assessments and consultation. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, data protection impact assessments and prior consultation with the ICO.
• Requests from authorities. If a public authority asks us for customer personal data, we will refer it to you and tell you about the request, unless the law forbids it.

9. Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we will tell you without undue delay. We will give you the information we have about what happened, the data and people likely to be affected, its likely consequences and what we are doing about it, and keep you updated as we learn more, so that you can meet your own obligations to report and inform.

10. When the service ends

Before the service ends you can take copies of your data, and we will help you export anything the service does not let you export yourself. After it ends, we delete customer personal data within 30 days, unless you ask us to return it to you first or UK law requires us to keep it. Copies in our backups are deleted as those backups expire, within 12 months after that.

11. Information and audits

We will make available to you the information you reasonably need to show that we comply with Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. We will normally start by answering your questions in writing. Where an audit is still needed, you will give us at least 30 days' notice, it will take place during working hours, no more than once a year unless there has been a personal data breach or a regulator requires it, at your cost, and your auditor will keep what it learns confidential.

12. Your responsibilities

You are responsible for having a lawful basis for the processing you ask us to carry out, for telling the people concerned about it, and for making sure your instructions comply with data protection law.

13. Liability and precedence

Each party's liability under these terms is subject to the limits in the agreement they form part of, except where the law does not allow it to be limited. If these terms conflict with the rest of that agreement on the processing of personal data, these terms prevail.

Questions about these terms: privacy@virtum.cloud. See also our sub-processors and privacy notice.