The firm collects only what it needs to answer an inquiry. It processes that information for that purpose, and it does not keep it longer than it has to. This page is the long form of those three sentences.
Viru Consulting W.L.L. (the "firm"), domiciled in Manama, Kingdom of Bahrain, is the data controller for personal data submitted through virugroup.company. Trading name: Viru Group.
Inquiry form data. Name, email address, optional phone number (with country dial code), the practice area indicated, and an optional message. Submission requires completion of a Cloudflare Turnstile challenge to confirm a human submission; no biometric data is captured.
Technical data. The site is served via Cloudflare's edge network. Standard server logs record the IP address, user-agent, referrer, request path, response status, and timestamp of each request. The site loads three measurement scripts: Cloudflare Web Analytics and Ahrefs Analytics, both of which count page views in aggregate without setting a cookie or fingerprinting the device; and Google Analytics 4, which sets first-party cookies (typically _ga and _ga_<property>) to distinguish returning sessions and reports aggregate visit statistics to the firm. No advertising or retargeting scripts are loaded.
No special-category data. The form does not request information on race, religion, political opinion, health, or sexual orientation. The firm does not knowingly collect such data through the site.
Inquiry data is processed solely to evaluate and respond to the inquiry. The firm replies within one business day, by email, to the address provided. Where appropriate, the firm may invite the inquirer to a confidential consultation under non-disclosure.
The firm does not send marketing emails, newsletters, or solicitations. Inquiry data is never sold, never shared with brokers or developers, never used to enrich a third-party profile.
Lawful basis. Processing rests on two grounds: the firm's legitimate interest in evaluating qualified inquiries, and the inquirer's explicit submission of the form as a request to be contacted in reply.
The site uses a small number of trusted infrastructure providers:
These providers act as processors under data-processing agreements appropriate to their service. The firm does not sell or transfer inquiry data to any party beyond these processors and the firm's own counsel of record where required.
Inquiry data is held while a working file is open, and for a reasonable period after (typically twenty-four months) to allow for follow-up correspondence. Where an engagement is formalised, retention is governed by the mandate and any applicable professional obligation. Inquiry data is deleted on written request, subject to legal or regulatory requirements to retain.
Standard server logs are rotated and held for thirty days for operational security.
Subject to applicable law, the inquirer may request access to the personal data the firm holds, correction of inaccurate data, deletion, restriction of processing, portability, and the right to object. Requests are honoured within thirty days of receipt and are coordinated, where applicable, with the firm's counsel of record.
Requests should be sent to advisory@virugroup.company with sufficient information to identify the inquiry concerned.
The site sets first-party cookies only for Google Analytics 4 measurement (typically _ga and _ga_<property>, storing a random visitor identifier and session state; retention up to two years). The Cloudflare Turnstile widget sets a short-lived technical cookie required to validate the human-verification challenge; that cookie is set only on form interaction and expires within the session. No advertising or retargeting cookies are set.
The site loads Cloudflare Web Analytics and Ahrefs Analytics for aggregate page-view counts; neither script sets a cookie or fingerprints the device. Google Analytics 4 is also loaded and does set first-party cookies for session measurement, as described in the Cookies section above. No advertising, retargeting, or social-media tracking scripts are loaded by the site.
The firm is established in the Kingdom of Bahrain. Its principal processors are established in the United States (Cloudflare, Resend, Google), the European Union (Hetzner), and Singapore (Ahrefs). Where personal data is transferred outside the inquirer's jurisdiction, the firm relies on standard contractual clauses, on processor agreements, and on the inquirer's explicit submission of the form as the legal basis for the transfer.
The site and the firm's services are not directed to children under the age of eighteen. The firm does not knowingly collect personal data from children.
The firm may amend this Privacy Policy from time to time. The version in force is the one published at virugroup.company/privacy.html as of the effective date noted at the top of this page. Material changes are highlighted on the page. Continued use of the site after amendment constitutes acceptance.
Direct correspondence on this policy or on a specific data request is welcomed in writing.