The firm collects only what is necessary to respond to an inquiry, processes it only as required, and retains it no longer than necessary. This page sets that out in detail.
Viru Consulting W.L.L. (the "firm"), domiciled in Manama, Kingdom of Bahrain, is the data controller for personal data submitted through virugroup.company. Trading name: Viru Group.
Inquiry form data. Name, email address, optional phone number (with country dial code), the practice area indicated, and an optional message. Submission requires completion of a Cloudflare Turnstile challenge to confirm a human submission; no biometric data is captured.
Technical data. The site is served via Cloudflare's edge network. Standard server logs record the IP address, user-agent, referrer, request path, response status, and timestamp of each request. No analytics, advertising, or fingerprinting scripts are loaded.
No special-category data. The form does not request information on race, religion, political opinion, health, or sexual orientation. The firm does not knowingly collect such data through the site.
Inquiry data is processed solely to evaluate and respond to the inquiry. The firm replies within one business day, by email, to the address provided. Where appropriate, the firm may invite the inquirer to a confidential consultation under non-disclosure.
The firm does not send marketing emails, newsletters, or solicitations. Inquiry data is never sold, shared with brokers or developers, or used to enrich third-party profiles.
Lawful basis. Processing is grounded in (i) the firm's legitimate interest in evaluating qualified inquiries, and (ii) the inquirer's explicit submission of the form as a request to be contacted in reply.
The site uses a small number of trusted infrastructure providers:
These providers act as processors under data-processing agreements appropriate to their service. The firm does not sell or transfer inquiry data to any party beyond these processors and the firm's own counsel of record where required.
Inquiry data is retained for as long as a working file is open, and for a reasonable period thereafter (typically twenty-four months) to allow for follow-up correspondence. Where an engagement is formalised, retention is governed by the mandate and applicable professional obligations. Inquiry data is deleted on written request, subject to legal or regulatory requirements to retain.
Standard server logs are rotated and retained for thirty days for operational security.
Subject to applicable law, the inquirer may request access to the personal data the firm holds, correction of inaccurate data, deletion, restriction of processing, portability, and the right to object. Requests are honoured within thirty days of receipt and are coordinated, where applicable, with the firm's counsel of record.
Requests should be sent to advisory@virugroup.company with sufficient information to identify the inquiry concerned.
The site does not set first-party cookies for analytics or marketing. The Cloudflare Turnstile widget sets a short-lived technical cookie required to validate the human-verification challenge; that cookie is set only on form interaction and expires within the session.
No third-party analytics, advertising, retargeting, or social-media tracking scripts are loaded by the site.
The firm is established in the Kingdom of Bahrain. Its principal processors are established in the United States (Cloudflare, Resend) and the European Union (Hetzner). Where personal data is transferred outside the inquirer's jurisdiction, the firm relies on standard contractual clauses, processor agreements, and the inquirer's explicit submission of the form as the legal basis for transfer.
The site and the firm's services are not directed to children under the age of eighteen. The firm does not knowingly collect personal data from children.
The firm may amend this Privacy Policy from time to time. The version in force is the one published at virugroup.company/privacy.html as of the effective date noted at the top of this page. Material changes will be highlighted on the page; continued use of the site after amendment constitutes acceptance.
Direct correspondence on this policy or on a specific data request is welcomed in writing.