Privacy & personal information

Who this notice covers

Vitosha Technologies is the confirmed business brand. This notice addresses website visitors, prospective customers, business contacts, and personal information encountered during authorized IT work. The registered legal entity remains to be confirmed.

Our own business records and information held in a customer's systems have different purposes and responsibilities. A customer mandate must define the information we may access, the permitted work, and the respective responsibilities. Temporary viewing can involve personal information even when no copy is retained.

Information involved in our services

Depending on the engagement and the tools eventually selected, the relevant information may include:

• Business contact details: names, roles, organizations, email addresses, and telephone numbers.
• Administrative records: proposals, contracts, billing details, and information needed to document the business relationship.
• Support communications: requests, correspondence, descriptions of issues, and necessary troubleshooting material.
• Technical information: device names, professional account identifiers, IP addresses, configurations, inventories, and limited diagnostic logs.
• Information encountered within customer accounts, email systems, servers, endpoints, backups, or security alerts during authorized work.

Why information may be needed

The intended approach is to limit information to what is necessary for a defined purpose. These purposes can include assessing an enquiry, delivering and documenting agreed services, administering contracts and invoices, protecting systems, and meeting applicable recordkeeping obligations.

Customer information is to be used for the authorized mandate. The service templates prohibit selling entrusted information, using it for advertising, or repurposing it for unrelated activities. They also prohibit copying it to unapproved third-party tools, including public AI services.

How the contact form works

The form collects your name, organization, email address, optional telephone number, service interest, message, language, and privacy acknowledgement so we can assess and respond to your enquiry. No account or payment is required.

When you submit, your browser sends these details over HTTPS to FormSubmit, which forwards them to info@vtiox.ca, our Microsoft Outlook mailbox. FormSubmit processes the submission and may use technical connection data for delivery and spam prevention. FormSubmit states that it keeps a submission archive for 30 days. Email copies in our mailbox are managed separately.

The website does not save form entries in browser local or session storage. Your browser may provide its own autofill features. You can email us directly instead of using FormSubmit. Do not enter passwords, customer logs, identity documents, or sensitive information.

Cookies and technical connection data

The website includes no analytics, advertising trackers, marketing cookies, third-party embeds, or remote fonts. It does not request your location or build a marketing profile. Website assets are served by the same site; submitting the contact form makes a request to FormSubmit.

The website is hosted on Microsoft Azure Static Web Apps. The hosting and form-delivery providers may process connection information such as IP addresses, requested pages, timestamps, and browser details to deliver and protect their services.

Authorized access to customer systems

The service model calls for access limited to the agreed work and to authorized people who need it. Staff and subcontractor confidentiality obligations, remote administration methods, and any software or agent installation must be covered by the appropriate agreement and authorization.

Work should remain in the customer's environment wherever practical. Necessary temporary exports, screenshots, or diagnostic samples must have an authorized purpose, use an approved protected location, and be removed when no longer needed, subject to applicable retention requirements. Access and credentials are to be reviewed and removed when the mandate ends.

Wazuh and ownership of logs

The standard Wazuh model keeps logs, events, alerts, and indexes within customer-controlled infrastructure. Our role is implementation, configuration, customization, integration, tuning, troubleshooting, documentation, training, and authorized support. It does not include hosted SIEM, routine centralized retention of customer logs, or a 24/7 SOC.

The customer determines log sources, endpoint coverage, retention periods, permitted monitoring, and response arrangements. Temporary access for the agreed work does not transfer control of the data. Any exceptional troubleshooting copy must be necessary, authorized, protected, and deleted when its purpose ends, subject to applicable requirements.

Recipients, providers, and processing locations

The website uses Microsoft Azure Static Web Apps for hosting, FormSubmit for form forwarding, and Microsoft Outlook for the receiving mailbox. Other future operational providers may include ticketing, accounting, backup, and administrative-tool providers. Specific storage locations are not established by this notice.

Our international service availability does not mean information is stored only in Québec or Canada. Before using a provider or arrangement involving information outside Québec, the applicable privacy assessment and contractual requirements must be addressed. The actual locations and relevant recipients must be disclosed when the collection arrangements are finalized.

Retention and deletion

FormSubmit states that it retains form submissions for 30 days. Forwarded messages remain in our Outlook mailbox, whose retention is managed separately. The business retention schedule must distinguish enquiry and accounting records from temporary support artifacts and credentials.

The intended rule is to retain information only while needed for its purpose or an applicable legal or contractual requirement, then securely destroy it or anonymize it where permitted and appropriate. Support copies should not become a permanent customer-data archive. Customer Wazuh retention remains a customer decision. Exact operational periods have not yet been approved.

Safeguards and responsibilities

The internal templates specify measures proportionate to the sensitivity and use of information: least privilege, named accounts where feasible, multifactor authentication, protected devices, suitable encryption, approved remote access, and confidentiality obligations.

The designated Privacy Officer is intended to coordinate governance, privacy questions, complaints, assessments, and incident handling. These templates describe controls to implement and verify; their existence is not proof that every operational control is in place or a certification of compliance with Law 25.

Questions, access, correction, and consent

You may request access to or correction of personal information about you, and raise a question or complaint about its handling. Requests may require proportionate identity verification; applicable legal conditions and exceptions can affect the response.

Where processing relies on consent, a request to withdraw that consent must be assessed in light of the applicable requirements and any effect on the requested service. If a request concerns information held for a customer, the intended process is to forward it to that customer and assist within the mandate, rather than independently decide on its disclosure.

For questions about information in your enquiry, email info@vtiox.ca. The designated Privacy Officer and formal handling process remain to be confirmed. Do not send identity documents through the contact form.

Confidentiality incidents and notice updates

The incident-response template provides for reporting, containment, assessment, documentation, and measures to reduce harm and prevent recurrence. Incidents involving customer information are to be coordinated with the customer's designated contact under the agreement and applicable law. Required notifications depend on the incident and the applicable legal criteria.

This notice must be reviewed when collection, service tools, providers, or material privacy practices change. The review date describes this website notice; it is not an effective date for a signed corporate policy.