Politica de confidențialitate

1. Who is responsible

For this website, for accounts, billing and support, and for the security of our own systems, VDR Tech Limited is the controller.

For the content your organisation puts into the Services — mail, files, calendars, contacts, notes, server contents and monitoring data — your organisation is the controller and we are its processor. That relationship is governed by our Data Processing Agreement; questions about that content should go to your organisation first.

We are established outside the European Union and offer services to people in it. We are in the process of appointing a representative in the European Union under Article 27 GDPR. Until the appointment is made, contact us directly at privacy@totuldigital.com.

Contact for anything in this policy: privacy@totuldigital.com.

2. Personal data we collect

We do not collect special categories of personal data on purpose. Your organisation may store such data in the Services as controller.

3. Purposes and legal bases

We do not use personal data for advertising, profiling or automated decisions with legal or similarly significant effects, and we do not sell it.

4. How long we keep it

5. Who receives it

We share personal data only with the service providers we need to run the Services, under contracts that require them to protect it:

Our public website and the Cloud Office screens load fonts from Google (fonts.googleapis.com, fonts.gstatic.com) and a styling script from Tailwind (cdn.tailwindcss.com). Your browser contacts those providers directly, so they receive your IP address and browser details; they set no cookies in this configuration. We intend to self-host these files.

We disclose personal data to authorities only where we are legally required to, and we tell the person concerned or your organisation where we are allowed to.

6. International transfers

Customer Data and the data of our Services are stored and processed in France, in the European Union.

Our company is established in the United Arab Emirates, which does not have an adequacy decision from the European Commission. Where personal data of people in the European Economic Area is accessed from the UAE — for example by our staff for support or administration — the transfer is covered by the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with the safeguards described in the Data Processing Agreement. You can ask privacy@totuldigital.com for a copy.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), transfers out of the UAE are made only to jurisdictions or under safeguards it permits.

7. Your rights

Depending on the law that applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have data erased where there is no reason to keep it;
• restrict or object to processing based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

Write to privacy@totuldigital.com. We answer within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. For content in your organisation's Cloud Office, we will forward your request to your organisation.

Supervisory authorities include the authority of the EU country where you live or work — for example CNIL (France) or ANSPDCP (Romania) — and, in the UAE, the UAE Data Office.

8. How we protect it

• Encryption in transit (TLS) for the website, Cloud Office, IMAP and SMTP submission.
• Passwords stored as strong one-way hashes; optional two-factor sign-in; separate, revocable device passwords for sync clients.
• Session cookies marked HttpOnly and Secure; sessions can be ended from Settings.
• Mail protected with SPF, DKIM and DMARC (policy reject) and MTA-STS (enforce).
• Virtual machines on a private network with no public addresses; only required ports are forwarded.
• An audit log of administrative actions; continuous security monitoring.

We do not yet operate backups or a second site, and we hold no security certifications. We will update this policy when that changes.

9. Cookies

Our public pages set no cookies and use no local storage, analytics or advertising trackers. Signed-in areas use strictly necessary session cookies only. See the Cookie Policy for the full list.

10. Changes

We will update this policy when our processing changes and show the date at the top. Material changes are announced to account owners by email.