VIRTUTRAX is committed to protecting your personal data. This privacy notice (the ” Privacy Notice”) describes how VIRTUTRAX collects, uses, shares, and protects information collected about you on its websites. 

Any personal data you provide or we collect from the use of the VIRTUTRAX website will only be used in accordance with this Privacy Notice. This notice does not apply to the personal data of employees or contractors of VIRTUTRAX.

Personal data

Personal data is data about an identifiable or identified natural person, not including business contact information, i.e. data that would allow an employee to be contacted at their place of business. For example, personal data includes your home address, telephone number, date of birth, personal email address, and credit card or other financial information.

What are the purposes for the collection, use and disclosure of your personal data?

VIRTUTRAX processes personal data only on legitimate grounds:

• Consent
• Performance of a contract
• Legal obligation
• Legitimate interests of VIRTUTRAX

We do not collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, or biometric data in order to uniquely identify a person or data concerning health or sex life, and sexual orientation. We ask that you do not communicate or provide these elements of data to us. We will not use your personal data for decisions based solely on automated processing if the decision produces legal effects concerning you or significantly affects you unless you gave your explicit consent for this processing. 

If you have given VIRTUTRAX consent, you may, at any time, unsubscribe or withdraw your consent by contacting VIRTUTRAX as set out below, subject to our retention policies and our legal obligations. In some cases, withdrawal of your consent may result in VIRTUTRAX being unable to provide you with a particular service through the website. If so, VIRTUTRAX will advise you of the consequences of your withdrawal of consent at the time.

Consent

VIRTUTRAX collects, uses, and discloses your personal data only for identified purposes with your knowledge and consent. Some of the purposes for which VIRTUTRAX may collect, use and disclose your personal data on this website are:

• To respond to inquiries and requests for one-time or ongoing communications from VIRTUTRAX;
• To provide you with marketing material upon completion of a form requesting access to a resource (by submitting such a form you consent to VIRTUTRAX sending you marketing material);
• To conduct promotions with you if you have indicated an interest in receiving such promotions.

If you choose not to provide VIRTUTRAX with your personal data, the website will not collect any personal data about you. 

Legal Obligation

VIRTUTRAX may disclose your personal data without your permission to the extent that it is required or permitted to do so by European Union or national law, for the following purposes:

• To comply with financial regulations regarding communications with potential and actual investors; 
• In connection with any legal proceedings or prospective legal proceedings, and in order to establish, exercise or defend VIRTUTRAX’s legal rights.

Performance of Contract

VIRTUTRAX collects, uses and discloses your personal data in the event you have sought employment, contracting opportunities, or educational opportunities, or solicited business with VIRTUTRAX, for the following purposes:

• To comply with commitments made to local authorities regarding hiring, VIRTUTRAX may provide information relating to inquiries and hiring from local areas in which VIRTUTRAX operates, to evidence compliance with commitments made by VIRTUTRAX;
• To comply with commitments made with local authorities regarding local sourcing, engagement with local organizations and groups, or provide educational opportunities (either individually or to groups). 

Legitimate interests of VIRTUTRAX

VIRTUTRAX collects, uses, and discloses your personal data to support its legitimate interests in the following categories:

• To monitor and enhance the security of our website and other systems to which it may connect;
• To deliver a tailored user experience and reduce the amount of manual data entry.

To whom do we share your personal information?

VIRTUTRAX may share your personal data with third parties to assist VIRTUTRAX in administering activities on the website, such as website maintenance to our auditors or other professional advisors, or otherwise for service promotions. VIRTUTRAX may also use service providers to assist in aggregating personal data. If you have provided VIRTUTRAX with your personal data, that personal data will not be sold.

How does VIRTUTRAX obtain your consent?

VIRTUTRAX obtains consent to collect, use and disclose your personal data for the reasonable and necessary purposes set out above. When you provide VIRTUTRAX with your information, such as for signing up to receive emails about business developments, you are consenting to the collection, use and disclosure of your personal data for these purposes, in accordance with the principles outlined in this notice.

How long does VIRTUTRAX retain your personal data?

VIRTUTRAX will not store your personal data longer than necessary for the purpose for which we have processed your personal data. How long we retain your personal data depends on the type of data and the purpose for which we process it. VIRTUTRAX includes regulated entities, which are subject to a variety of records retention requirements, and so may be unable to remove your personal data because of legal obligations. VIRTUTRAX will inform you if you request deletion of your personal data if we are unable to comply.

Data Subject Rights

You may request details of personal data which we hold about you. If you would like a copy of the personal data held on you, please email legal@virtutrax.com.   If you believe that any personal data we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any personal data found to be incorrect.

You may choose to object to the collection or use of your personal data whenever personal data is processed for the legitimate interests of VIRTUTRAX.

GDPR & CCPA

General Data Protection Regulation

VIRTUTRAX is compliant with the EU’s General Data Protection Regulation (“GDPR”) and has had guidelines and processes implemented as recommended by Price Waterhouse Coopers’ (PwC). VIRTUTRAX is committed to supporting customers’ rights as outlined in the GDPR, specifically the Right to Access, Right to be Forgotten, and Right to Data Portability.
‍
Specifically, VIRTUTRAX limits the scope of data needed to provide spend management services for companies. VIRTUTRAX stores and processes very limited Personally Identifiable Information (PII). Furthermore, VIRTUTRAX complies fully with the GDPR should an individual request an action upon their data through a support ticket.
‍
VIRTUTRAX follows ‘Privacy By Design’ by incorporating data protection elements through technology design processes, such as steps in our software development to evaluate and reduce risks in privacy and security. For example, VIRTUTRAX utilizes automated code analysis and vulnerability warning systems to alert of potential risks in production software.
‍
In addition, we ensure that vendors we rely on to provide services (i.e. subprocessors) on our behalf live up to these standards and are required to go through a vetting process.

California Consumer Protection Act

The California Consumer Protection Act (“CCPA”) is effective January 1, 2020 and provides California consumers with various privacy rights. These rights include the right of disclosure and access (the right to request to know more details about the categories VIRTUTRAX collects), right to deletion of personal data, right to opt-out of the sale of personal data and the right to not be discriminated against for exercising these rights.

Categories of personal information we collect (and have collected over the past 12 months) include contact details (name, telephone and work email) and employee work purchase history, if using the VIRTUTRAX platform (internal purchases, approval records and payment records). VIRTUTRAX does not sell personal information. 

California consumers may request additional information by emailing legal@virtutrax.com.

Use of Cookies

Our website uses cookie technology to make your use of the website more convenient. A cookie is a text file that enables the website to store information about your activities or the length of your stay. Any personal information that is collected by the cookies will be used only on an aggregate basis, which means that VIRTUTRAX removes identifiers from the information and uses it for statistical purposes to assist in enhancing your online experience or to evaluate the success of promotions that VIRTUTRAX may carry on through the website. The Site does not collect your personal or financial data from your computer, nor does it place persistent cookies on your computer. The website will not place cookies on your hard drive. Most web browsers are set to accept cookies by default; however, you should have an option to disable cookies associated with our website. If you choose to do so, this may affect the functionality of the website and your ability to access certain features of it.

How does VIRTUTRAX protect your personal data?

VIRTUTRAX is committed to ensuring that your personal data is secure. In order to prevent unauthorized access or disclosure, we have put in place appropriate technical and organizational measures to safeguard and secure the personal data we process. Our website endeavors to use appropriate reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal of your personal data per applicable law. VIRTUTRAX tries to exercise care in the secure transmission of your personal data; however, no transmission of personal data over the Internet is completely secure. VIRTUTRAX does not guarantee that personal data disclosed through the Internet cannot be intercepted by third parties. However, VIRTUTRAX takes reasonably available steps to protect any personal data that has been provided to VIRTUTRAX, including its disposal or destruction in due course.

Please remember that you control the personal information you provide while using our website. 

If a data breach does occur, we will do everything in our power to limit damage. In the event a data breach we will take reasonable actions to inform you about remedial actions to prevent further damage. Our responsibility is to inform the relevant supervisory authority or authorities without delay.

Contacting us about your privacy

If you have any questions or concerns regarding this Privacy Policy and/or the practices of this website, please contact our Data Privacy Officer by emailing legal@virtutrax.com or by writing to VIRTUTRAX, LLC.  1422 S. Tryon, #300, Charlotte, NC, 28203.

From time to time, we may change this Privacy Notice when it is appropriate to do so. We recommend that you review this notice from time to time so that you are aware of any changes.