Privacy Policy

1. Introduction & Data Controller

Virtual Team Technology OÜ (registration number 14354405) ("vTeam Technology," "we," "us," or "our") respects your privacy and is committed to protecting your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Estonian Personal Data Protection Act.

For the purposes of this Privacy Policy, Virtual Team Technology OÜ is the data controller responsible for your personal data. This means we decide how and why your personal data is processed. Our contact details, including how to reach our Data Protection Officer, are in Section 13. By accessing or using our website vteam.tech and purchasing our software licenses, hosting, domains, and VPS services, you acknowledge the practices described in this policy.

2. Data We Collect

We collect only the personal data necessary to operate our store and deliver your orders:

Data You Provide

• Account information — name, email address, password (stored as a hash), and optional phone number.
• Order and billing information — order history, billing address, and invoices.
• Payment metadata — the last four digits of your card and transaction identifiers. We never receive or store your full card number; this is handled entirely by our payment processor (Stripe).
• Support and marketing data — messages you send us and your marketing preferences.

Data Collected Automatically

• IP address and connection data — for security, fraud prevention, and abuse mitigation.
• Device and browser information — browser type, operating system, and screen characteristics.
• Usage data — pages visited, features used, and approximate session timing.
• Cookies and similar technologies — see our Cookie Policy for details.

3. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data only where we have a lawful basis to do so. The lawful basis depends on the purpose of processing:

• Performance of a contract (Art. 6(1)(b)) — to process your orders, deliver licenses, and provide the services you requested.
• Legal obligation (Art. 6(1)(c)) — to retain accounting and tax records and to comply with applicable EU and Estonian law.
• Legitimate interests (Art. 6(1)(f)) — to prevent fraud, secure our platform, and improve our services, where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)) — for optional marketing communications and non-essential cookies, which you may withdraw at any time.

4. How We Use Your Data

We use your personal data to:

• Process and fulfill your orders, including license key delivery and hosting/domain provisioning;
• Provide customer support and respond to your inquiries;
• Maintain your account and order history;
• Send transactional emails (order confirmations, invoices, delivery notices);
• Send marketing communications only where you have opted in (you can unsubscribe at any time);
• Detect and prevent fraud and unauthorized transactions;
• Maintain the security and integrity of our platform; and
• Comply with our legal and tax obligations.

5. Sharing with Third Parties

We do not sell your personal data. We share it only with service providers and partners who help us operate our business, under contracts that require them to protect your data and use it only for the purposes we specify. These include:

• Stripe — our payment processor, which handles card and wallet payments. Stripe processes your payment data under its own PCI-DSS compliance program.
• Brevo — our email service provider, used to deliver transactional and marketing email.
• Software suppliers and vendors — to activate and fulfill certain licenses you purchase, where activation is managed by the original vendor.
• 20i — our reseller provider for domain, hosting, and VPS provisioning, where you purchase such services.
• Cloud infrastructure providers — hosting, database, object storage, and search services that power our platform.
• Authorities — where required by applicable law, court order, or to protect our legal rights.

Some of these providers process data outside the European Economic Area; see Section 11 for information on international transfers.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy and to comply with our legal obligations. Typical retention periods are:

• Account data — retained while your account is active, and for up to 12 months after deletion unless a legal obligation requires longer retention.
• Order, invoice, and tax records — retained for a minimum of 7 years as required by Estonian and EU accounting/tax law.
• Support communications — retained for up to 24 months after the last interaction.
• Server and security logs — retained for up to 12 months for security and fraud-prevention purposes.
• Marketing data — retained only while you remain opted in; deleted promptly when you unsubscribe.

Where data is no longer required, we delete it or anonymize it so it can no longer identify you.

7. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including TLS encryption in transit, encryption of sensitive credentials (such as supplier API keys) at rest using AES-256-GCM, strict role-based access controls, isolated database and object-storage services, and regular security reviews. Payment data is handled exclusively by our PCI-DSS-compliant processor. While we work continuously to safeguard your data, no system can be guaranteed completely secure. In the event of a personal-data breach affecting your rights, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with the GDPR.

8. Cookies & Tracking

Our website uses cookies and similar technologies to operate the store, keep you signed in, remember your cart, and (where you consent) measure usage. Essential cookies required for site functionality cannot be disabled. Full details of the cookies we use, their purposes, and how to manage them are set out in our Cookie Policy.

9. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations.
• Right to restrict processing — limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw consent at any time for processing based on consent (e.g. marketing).
• Right to lodge a complaint — complain to your local data-protection authority or the Estonian Data Protection Inspectorate (aki.ee) if you believe we have mishandled your data.

To exercise any of these rights, contact us at privacy@vteam.tech. We will respond within one month, as required by the GDPR.

10. Children's Privacy

Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If we learn that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us.

11. International Data Transfers

Some of our service providers (for example payment processing and cloud infrastructure) may process personal data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or process data only in jurisdictions deemed to provide an adequate level of data protection. We are happy to provide further information about the safeguards applied on request.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or operations. We will indicate the most recent version by updating the "Last updated" date above and, for material changes, will provide a prominent notice or email. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact & Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or want to contact our Data Protection Officer, write to us: