Privacy Policy How TotulDigital handles personal data about website visitors, customers and the people who use our Services. Updated 8 October 2026 · TD-PRIV-2026-10 1. Who is responsible VDR Tech Limited VDR Tech Limited, trading as TotulDigital — a limited liability company incorporated in Masdar City Free Zone under the Masdar City Companies Registration Regulations 2009 Licence and registration no. MC 14332, issued by the Registrar of Companies of Masdar City Free Zone Registered address: Smart Station SS 548, First Floor, Incubator Building, Masdar City, Abu Dhabi, United Arab Emirates · VAT: not registered for UAE VAT Contact: contact@totuldigital.com · Security: security@totuldigital.com · Data protection: privacy@totuldigital.com For this website, for accounts, billing and support, and for the security of our own systems, VDR Tech Limited is the controller. For the content your organisation puts into the Services — mail, files, calendars, contacts, notes, server contents and monitoring data — your organisation is the controller and we are its processor. That relationship is governed by our Data Processing Agreement; questions about that content should go to your organisation first. We are established outside the European Union and offer services to people in it. We are in the process of appointing a representative in the European Union under Article 27 GDPR. Until the appointment is made, contact us directly at privacy@totuldigital.com. Contact for anything in this policy: privacy@totuldigital.com. 2. Personal data we collect Category | Examples | Source Website visit data | IP address, browser user agent, page requested, time | Your browser, via our web server logs Account data | Name, email address, role, password hash, two-factor secret and hashed recovery codes, device-password hashes | You or your administrator Session and security data | Session identifiers, sign-in times, IP address and user agent of sessions, administrative actions in the audit log | Generated by the Services Billing and contract data | Company name and address, contact person, invoices, payment status | You Support and correspondence | Messages you send us and our replies | You Monitoring data (compliance module) | System events, logs, package inventory, configuration checks of monitored servers | monitoring agents you or we install We do not collect special categories of personal data on purpose. Your organisation may store such data in the Services as controller. 3. Purposes and legal bases Purpose | Legal basis (GDPR Art. 6) | UAE PDPL Providing the Services under our contract | 6(1)(b) contract | Necessary to perform a contract Securing our systems, detecting abuse and fraud, keeping logs | 6(1)(f) legitimate interests in secure and reliable services | Legitimate interest / security Invoicing, accounting and tax | 6(1)(c) legal obligation | Compliance with law Answering enquiries and support requests | 6(1)(b) or 6(1)(f) | Contract / legitimate interest Service and security announcements to account owners | 6(1)(f) | Legitimate interest Defending or exercising legal claims | 6(1)(f) | Legal claims We do not use personal data for advertising, profiling or automated decisions with legal or similarly significant effects, and we do not sell it. 4. How long we keep it Data | Retention Web server request logs | Up to 30 days Sessions | Until sign-out or expiry (Cloud Office 14 days, customer portal and staff console 7 days), then deleted Account data and audit log | For the life of the account; deleted within 30 days after the account ends, unless we must keep it longer by law Billing records | As long as tax and accounting law requires (generally 5 to 10 years) Support correspondence | Up to 3 years after the matter is closed Customer Data (as processor) | As instructed by your organisation; deleted after the 30-day retrieval period when the contract ends 5. Who receives it We share personal data only with the service providers we need to run the Services, under contracts that require them to protect it: Subprocessor | Service | Location of processing | Data involved OVHcloud SAS (2 rue Kellermann, 59100 Roubaix, France) | Dedicated server and datacentre (Strasbourg, SBG3) | France (EU) | All customer data, at rest and in processing Cloudflare, Inc. | Authoritative DNS for our domains (DNS only; traffic is not proxied) | Cloudflare's global network | Domain names and DNS queries; no customer content Internet Security Research Group (Let's Encrypt) | TLS certificates | United States | Host names in certificates; no customer content Our public website and the Cloud Office screens load fonts from Google (fonts.googleapis.com, fonts.gstatic.com) and a styling script from Tailwind (cdn.tailwindcss.com). Your browser contacts those providers directly, so they receive your IP address and browser details; they set no cookies in this configuration. We intend to self-host these files. We disclose personal data to authorities only where we are legally required to, and we tell the person concerned or your organisation where we are allowed to. 6. International transfers Customer Data and the data of our Services are stored and processed in France, in the European Union. Our company is established in the United Arab Emirates, which does not have an adequacy decision from the European Commission. Where personal data of people in the European Economic Area is accessed from the UAE — for example by our staff for support or administration — the transfer is covered by the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with the safeguards described in the Data Processing Agreement. You can ask privacy@totuldigital.com for a copy. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), transfers out of the UAE are made only to jurisdictions or under safeguards it permits. 7. Your rights Depending on the law that applies to you, you have the right to: - access the personal data we hold about you and receive a copy; - have inaccurate data corrected; - have data erased where there is no reason to keep it; - restrict or object to processing based on legitimate interests; - receive data you gave us in a portable format; - withdraw consent where processing is based on consent; - lodge a complaint with a supervisory authority. Write to privacy@totuldigital.com. We answer within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. For content in your organisation's Cloud Office, we will forward your request to your organisation. Supervisory authorities include the authority of the EU country where you live or work — for example CNIL (France) or ANSPDCP (Romania) — and, in the UAE, the UAE Data Office. 8. How we protect it - Encryption in transit (TLS) for the website, Cloud Office, IMAP and SMTP submission. - Passwords stored as strong one-way hashes; optional two-factor sign-in; separate, revocable device passwords for sync clients. - Session cookies marked HttpOnly and Secure; sessions can be ended from Settings. - Mail protected with SPF, DKIM and DMARC (policy reject) and MTA-STS (enforce). - Virtual machines on a private network with no public addresses; only required ports are forwarded. - An audit log of administrative actions; continuous security monitoring. What we do not have yet: We do not yet operate backups or a second site, and we hold no security certifications. We will update this policy when that changes. 9. Cookies Our public pages set no cookies and use no local storage, analytics or advertising trackers. Signed-in areas use strictly necessary session cookies only. See the Cookie Policy for the full list. 10. Changes We will update this policy when our processing changes and show the date at the top. Material changes are announced to account owners by email.