Personal Data Protection Policy

Table of Contents#

• Purpose, Scope and Responsibility
• Terminology, Acronyms and Abbreviations
• Data Controller Identity and Processing Roles
• Categories of Personal Data
• Legal Basis for Processing
• How We Use Personal Data
• Data Sharing and Disclosure
• Data Security
• Shared Responsibility Model
• Data Retention
• Data Residency
• International Data Transfers
• Your Rights as a Data Subject
• Cookies and Tracking Technologies
• Children's Data
• Policy Updates
• Supervisory Authorities
• Contact Information
• Referenced Legal and Regulatory Articles

Purpose, Scope and Responsibility#

Purpose#

VCloud ("VCloud," "we," "us," or "our") is a cloud infrastructure services provider committed to the responsible, lawful, and transparent processing of personal data. This Personal Data Protection Policy (the "Policy") establishes the principles, obligations, and controls governing how VCloud collects, uses, stores, discloses, and protects personal data across all its operations.

This Policy is designed to ensure compliance with applicable data protection legislation, including but not limited to the General Data Protection Regulation (GDPR) (EU) 2016/679, the UK GDPR as retained under the Data Protection Act 2018, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It applies to all personal data processed in the context of VCloud's services, regardless of where that data originates.

This document serves as the primary reference for VCloud's data protection practices and is intended for customers, data subjects, regulatory authorities, and internal stakeholders.

Scope#

This Policy applies to:

• All personal data collected, processed, stored, or transmitted by VCloud in connection with the provision of its cloud infrastructure services.
• All employees, contractors, agents, and third-party processors acting on behalf of VCloud.
• All customers and users accessing VCloud's platform, website, or services.
• All personal data processed in any format, whether digital or physical.

In the United States, this Policy additionally incorporates the requirements of the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and its implementing regulations at 16 C.F.R. Part 312, enforced by the Federal Trade Commission (FTC). Where COPPA applies, its requirements operate alongside and, where stricter, take precedence over the general provisions of this Policy.

This Policy does not apply to anonymised data that cannot reasonably be used to re-identify a natural person, nor to data processed by customers within their own environments, for which the customer acts as the data controller and assumes full responsibility.

Terminology, Acronyms and Abbreviations#

Data Controller Identity and Processing Roles#

Data Controller Identity#

Kamasi, Inc. is the data controller for all personal data processed through the VCloud platform. As data controller, Kamasi, Inc. determines the purposes and means of processing and bears primary legal responsibility for compliance.

• Legal Entity: Kamasi, Inc.
• Incorporation: Delaware, United States of America
• EU Representative: Available on request (required under GDPR Art. 27)
• Data Protection Officer (DPO): dpo@varisymo.com
• General Privacy Contact: privacy@varisymo.com

Processing Roles#

VCloud operates in different legal roles depending on the processing context, as defined under GDPR Art. 4(7) and Art. 4(8):

Where VCloud acts as a Joint Controller, a summary of the arrangement and each party's responsibilities is available on request at privacy@varisymo.com. Customers retain responsibility for providing adequate notice to their end users and for establishing a lawful basis for their own data collection activities.

Categories of Personal Data#

VCloud processes several categories of personal data in connection with the delivery of its services. Each category is defined below, together with representative examples, the purpose for which the data is processed, and the applicable legal basis under GDPR Art. 6. Where a legal obligation or contractual necessity applies under CCPA, this is noted.

VCloud does not intentionally collect or process special category data as defined under GDPR Art. 9 (e.g., health, biometric, racial or ethnic origin, religious belief, or political opinion). If such data is inadvertently received, it will be deleted without delay.

For the purposes of COPPA compliance (16 C.F.R. § 312.2), "personal information" in the context of children under 13 includes, in addition to the categories listed below: persistent identifiers used to recognise a user over time or across services (including cookies and device identifiers); geolocation data precise enough to identify a street name and city; photographs, video files, and audio files containing a child's image or voice; and any information collected in combination that would permit the physical or online contacting of a specific child. VCloud's platform is not directed at children, and none of the data categories below are intentionally collected from individuals under 13.

Legal Basis for Processing#

All processing of personal data by VCloud is conducted on an established legal basis as required by GDPR Art. 6. The applicable legal bases are set out in the table below. For processing based on legitimate interests, VCloud conducts and maintains Legitimate Interest Assessments (LIAs), which are available on request.

How We Use Personal Data#

Service Delivery#

Personal data is primarily used to operate, maintain, and improve the VCloud platform. This includes:

• Provisioning, scaling, and maintaining cloud resources in accordance with customer configurations and instructions.
• Authenticating user identity, enforcing access controls, and managing user sessions.
• Processing subscription payments and generating tax-compliant invoices.
• Sending critical service notifications including downtime alerts, certificate expiry warnings, and security advisories. These communications are necessary for the performance of the contract and cannot be opted out of while an account is active.

Communications#

VCloud communicates with users through three distinct channels, each with a separate legal basis:

Analytics and Product Improvement#

Aggregated and pseudonymised usage data is analysed to identify usability issues, plan infrastructure capacity, and guide product development. Where A/B testing is conducted on a subset of users, participation is disclosed and an opt-out is available under Settings → Privacy → Feature Testing.

Internal Model Training (Explicit Limitation)#

VCloud may use anonymised, aggregated platform-level telemetry data to improve internal anomaly detection and infrastructure cost recommendation models. VCloud does not, under any circumstances, use customer application data, content, or workloads to train any internal or third-party machine learning models. This restriction is enforced at the infrastructure level, documented in our sub-processor agreements, and subject to regular independent audit.

This commitment reflects the purpose limitation principle under GDPR Art. 5(1)(b), which prohibits processing data for purposes incompatible with the original lawful basis.

Data Sharing and Disclosure#

No Sale of Personal Data#

VCloud does not sell personal data to any third party for monetary or other valuable consideration. VCloud does not share personal data with third parties for the purposes of cross-context behavioural advertising. These represent two distinct and separate commitments under the CPRA (Cal. Civ. Code § 1798.120 and § 1798.121). California residents are notified that neither practice is engaged in and no opt-out mechanism is required. This statement will be updated immediately and prior notice given should our practices change.

Sub-Processors and Infrastructure Partners#

VCloud relies on a limited set of trusted and vetted third-party sub-processors to operate its platform. All sub-processors are contractually bound by Data Processing Agreements (DPAs) meeting GDPR Art. 28 requirements, are subject to Standard Contractual Clauses (SCCs) or equivalent transfer safeguards, and undergo security due diligence assessments.

A complete and current list of sub-processors is available on request at privacy@varisymo.com. Customers will be notified at least 30 days in advance of any material changes to the sub-processor list.

Legal Disclosures#

VCloud may disclose personal data to law enforcement or regulatory authorities where required by a valid and legally binding court order, subpoena, warrant, or applicable law. In all such cases, VCloud will:

• Review the legal validity and proportionality of each request before complying.
• Challenge requests that are overly broad, lacking legal basis, or otherwise in breach of applicable law.
• Notify affected users prior to disclosure wherever legally permitted to do so.
• Log all disclosures and maintain records for audit purposes.

Business Transfers#

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of VCloud's assets, personal data may be transferred to the successor entity. Affected users will be notified at least 30 days in advance of any such transfer. Their rights under this Policy will be maintained by the successor entity, and users will be provided with the opportunity to exercise their data rights prior to the transfer.

Data Security#

VCloud implements technical and organisational security measures proportionate to the risks of processing, consistent with the requirements of GDPR Art. 32 and the "reasonable security" standard under CCPA § 1798.150.

Encryption#

Access Controls#

Access to production systems and customer data is governed by strict controls aligned with GDPR Art. 32(1)(b) and the principle of integrity and confidentiality under Art. 5(1)(f):

• Production infrastructure access is restricted to authorised engineers, protected by hardware-based multi-factor authentication (MFA).
• All administrative access is logged in tamper-evident audit logs; anomalous access patterns trigger automated real-time alerts.
• Customer data is never accessed by VCloud staff without an open, customer-initiated support ticket and the customer's explicit consent, except where strictly required to resolve a critical service-affecting incident. All such accesses are logged and customers are notified following resolution.
• Role-Based Access Control (RBAC) enforces the principle of least privilege across all internal teams. Access rights are reviewed quarterly and revoked upon role change or departure.

Incident Response#

VCloud maintains a formal, documented security incident response programme:

Shared Responsibility Model#

The security of data processed through VCloud's infrastructure is a shared responsibility between VCloud and its customers. The boundaries of responsibility are defined as follows:

VCloud is not liable for security failures, data breaches, or compliance deficiencies arising from customer misconfiguration, insecure application development, or failure to apply available security controls within the customer's area of responsibility. This allocation is formally documented in the Data Processing Agreement (DPA) governing each customer relationship.

Data Retention#

VCloud retains personal data only for as long as is necessary for the purposes for which it was collected, consistent with the storage limitation principle under GDPR Art. 5(1)(e) and CCPA § 1798.100(d). The following retention schedules apply:

Important distinction: Pseudonymised data, where re-identification remains possible using a key held by VCloud, constitutes personal data under GDPR Art. 4(1) and is subject to retention limits. Truly anonymised data, where re-identification is not reasonably possible by any party, falls outside the GDPR's scope and may be retained indefinitely for statistical or research purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard methods. Backup copies containing personal data will be purged within the applicable backup retention window.

COPPA Retention Standard: Where personal information has been collected from a child under 13, whether knowingly or inadvertently, VCloud applies the COPPA retention standard under 16 C.F.R. § 312.10: such data is retained only for as long as is reasonably necessary to fulfil the purpose for which it was collected, and in the case of inadvertent collection, that purpose is exclusively the identification and deletion of the data. No secondary use, aggregation, or archiving of such data is permitted under any circumstance.

Data Residency#

VCloud provides customers with the ability to select their preferred deployment region (e.g., EU-West, US-East, AP-Southeast). VCloud commits to the following:

• Customer data is stored and processed exclusively within the region selected by the customer.
• Cross-region data access is limited to tightly controlled scenarios, namely: responding to a customer-initiated support request, or addressing a critical platform security incident. All such cross-region access is logged, time-limited, and subject to the controls described in the Data Security section.
• Data residency commitments are enforceable through the customer's Data Processing Agreement (DPA).

Customers with specific data sovereignty requirements (e.g., under national law or sector-specific regulation) are advised to review available regions and confirm their configuration with their VCloud account manager.

International Data Transfers#

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, VCloud relies on the following approved transfer mechanisms as required by GDPR Chapter V and the UK GDPR:

All sub-processors engaged in international transfers are subject to the same transfer safeguards, as documented in their respective DPAs. A copy of the applicable SCCs or transfer mechanism documentation is available on request at privacy@varisymo.com.

Your Rights as a Data Subject#

Depending on your location and the applicable law, you hold the following rights in relation to your personal data. VCloud is committed to facilitating these rights promptly and without undue obstacle. We will not discriminate against you for exercising any right available to you (CCPA § 1798.125).

Identity Verification#

To protect the security of personal data, VCloud may require verification of your identity before processing a rights request. We will request only the minimum information necessary to confirm your identity and will not require disproportionate effort. Verification requests will be communicated promptly and will not be used to delay or obstruct the exercise of your rights.

Grounds for Override of Objection Requests#

VCloud may decline to action an objection to processing only where one or more of the following conditions is documented:

• Processing is required to comply with a specific legal obligation binding on VCloud.
• Processing is strictly and demonstrably necessary to prevent fraud or protect the integrity and security of the platform.
• An overriding legitimate interest has been identified in a current and reviewed Legitimate Interest Assessment (LIA), which itself was balanced against the data subject's rights and interests at the time of drafting.

VCloud will provide written justification within 30 days in all cases where it declines to action an objection.

Cookies and Tracking Technologies#

VCloud uses cookies and similar tracking technologies in accordance with the ePrivacy Directive (2002/58/EC), GDPR, and CCPA § 1798.135. A detailed Cookie Policy is available on the VCloud website. A summary of the cookie categories used is provided below.

Children's Data#

General Age Threshold: GDPR (Under 16) [GDPR Art. 8 | UK GDPR Art. 8]#

VCloud's services are not directed at, and are not intended for use by, individuals under the age of 16. In jurisdictions governed by GDPR or UK GDPR, the minimum age for consent to digital services processing is 16 years. VCloud does not knowingly collect personal data from individuals under this threshold.

Where VCloud becomes aware that personal data has been collected from a person under the age of 16 without verifiable parental or guardian consent:

• The data will be deleted within 10 business days of discovery.
• The associated account will be suspended pending identity verification.
• A notification will be issued to the registered contact email and, where available, to a parent or guardian.

If you believe that VCloud has inadvertently collected data from a child under 16, please contact privacy@varisymo.com immediately.

COPPA Compliance: United States (Under 13) [COPPA 15 U.S.C. §§ 6501–6506 | 16 C.F.R. Part 312]#

For users located in the United States, VCloud additionally complies with the Children's Online Privacy Protection Act (COPPA) and its implementing FTC regulations. COPPA imposes specific and non-negotiable obligations on operators with respect to children under the age of 13.

Applicability and Age Threshold#

VCloud's platform is a B2B cloud infrastructure service directed exclusively at business entities and adult professionals. It is not directed at children under 13. VCloud does not knowingly collect, use, or disclose personal information from children under 13.

Notwithstanding this, COPPA obligations are triggered upon actual knowledge that a user is under 13, regardless of intent. VCloud therefore maintains the procedures described below.

COPPA Definition of Personal Information [16 C.F.R. § 312.2]#

For COPPA purposes, "personal information" of a child under 13 includes each of the following, whether collected individually or in combination:

• Full name
• Home or physical address, including street name and city
• Email address or other online contact information
• Telephone number
• Social Security number or government-issued identifier
• Persistent identifiers (including cookies, IP addresses, device identifiers, and customer numbers) where used to recognise a user across sessions or services over time
• Geolocation data sufficiently precise to identify a street name and city or town
• Photographs, video files, or audio files containing a child's image or voice
• Any information about a child collected in combination with any of the above identifiers

VCloud acknowledges that certain data it collects in the ordinary course of service delivery - including IP addresses and session cookies - may constitute COPPA-covered personal information if associated with a known child under 13. Upon discovery of any such association, the procedures in the Actual Knowledge section apply immediately.

Verifiable Parental Consent [16 C.F.R. § 312.5]#

COPPA requires operators to obtain verifiable parental consent (VPC) before collecting, using, or disclosing personal information from children under 13. VCloud does not have a mechanism to accept registrations from individuals under 13 and does not present any consent flow designed for children. Accordingly:

• Account registration requires affirmative confirmation that the registrant is 18 years of age or older.
• No service feature is designed to collect personal information from a child user.
• VCloud does not offer any child-directed feature, mode, or interface.

In the event that VCloud acquires actual knowledge that a child under 13 is using the platform, no further personal information will be collected from that user until the account is suspended and the procedures below are followed.

Actual Knowledge: Internal Handling Procedure [15 U.S.C. § 6502(a)(1)]#

COPPA liability may arise from actual knowledge, not merely intent. VCloud maintains the following internal procedure for all scenarios in which actual knowledge of an under-13 user is obtained (whether through self-disclosure in a support interaction, a parental complaint, automated detection, or any other means):

Upon suspicion (before confirmation):

• The user account is immediately flagged and placed in a restricted state.
• No additional personal information is collected from the account during the review period.
• The compliance team is notified within 4 hours.

Upon confirmation:

• The account is suspended without delay.
• All personal information associated with the account is queued for deletion within 10 business days.
• The parent or guardian identified through available contact information is notified in writing, by email, within 48 hours of confirmation.
• The notification includes: (a) the categories of information collected; (b) how the information was used; (c) confirmation that deletion has been initiated; and (d) contact details for the VCloud privacy team.
• A record of the incident, including discovery date, data categories involved, and deletion confirmation, is retained for internal audit purposes only and for no longer than 12 months.

Parental Rights Under COPPA [16 C.F.R. § 312.6]#

Parents and legal guardians of children under 13 whose personal information has been collected by VCloud hold the following rights, which are distinct from and additional to the general data subject rights above:

• Right to review - the right to request access to the personal information collected from their child, prior to VCloud's deletion of that data.
• Right to deletion - the right to request that VCloud delete personal information collected from their child. VCloud will action such requests within 10 business days.
• Right to refuse further collection - the right to direct VCloud to cease any further collection or use of the child's personal information.
• Right to selective consent - the right to consent to VCloud's collection and internal use of the child's information while refusing consent to its disclosure to third parties, to the extent any such disclosure would otherwise occur.

To exercise any of the above rights, parents or guardians should contact privacy@varisymo.com. VCloud will verify the identity of the requesting parent or guardian before providing access to or confirming deletion of a child's data.

No Conditioning of Participation [16 C.F.R. § 312.7]#

VCloud does not condition access to any service, feature, or functionality on a user - including a child - disclosing more personal information than is reasonably necessary for participation in that activity. No element of VCloud's registration, onboarding, or service delivery process requires excessive or disproportionate data disclosure.

COPPA-Specific Data Retention [16 C.F.R. § 312.10]#

Personal information collected from a child under 13, whether knowingly or inadvertently, is retained by VCloud only for as long as is reasonably necessary to fulfil the purpose for which it was collected. In all cases of inadvertent collection, that purpose is exclusively identification and deletion. No secondary use, analysis, aggregation, archiving, or transfer of such data is permitted. Secure deletion is performed using industry-standard irreversible methods within 10 business days of the confirmed discovery date.

FTC Safe Harbor [16 C.F.R. § 312.11]#

VCloud does not currently participate in an FTC-approved COPPA safe harbor programme. Should VCloud seek to expand services into consumer or education markets where child users may be present, participation in an approved safe harbor will be evaluated and this Policy updated accordingly with advance notice to customers.

Conflict Resolution [COPPA and GDPR Art. 8]#

Where a user is located in the EU or EEA, GDPR Art. 8 applies and the minimum age threshold is 16. Where a user is located in the United States, COPPA applies and the minimum threshold for its specific parental consent obligations is 13. Where both frameworks are potentially applicable (for instance, where a US-resident child is under 16 but over 13), VCloud applies the following rule:

• The under-16 restriction on account creation (GDPR Art. 8) applies globally as the baseline.
• COPPA's parental consent and notification obligations apply specifically and additionally to any US-resident child under 13.
• Where both regimes impose obligations, the stricter standard on each specific point governs.

Policy Updates#

VCloud may update this Policy from time to time to reflect changes in law, regulatory guidance, or our processing practices. We distinguish between two types of changes and apply different notification procedures accordingly:

Supervisory Authorities#

You have the right to lodge a complaint with a competent supervisory authority at any time, without prejudice to any other administrative or judicial remedy (GDPR Art. 77). VCloud encourages data subjects to contact us directly at privacy@varisymo.com in the first instance so that we may endeavour to resolve any concern promptly.

The FTC holds primary enforcement authority for COPPA violations under 15 U.S.C. § 6505. Civil penalties for knowing COPPA violations can reach $51,744 per violation per day (adjusted periodically for inflation under the Federal Civil Penalties Inflation Adjustment Act). VCloud's COPPA compliance procedures are designed to eliminate the conditions for such violations. Complaints regarding VCloud's treatment of children's data may be submitted to the FTC at reportfraud.ftc.gov.

Contact Information#

For any enquiries, rights requests, or concerns relating to this Policy or to VCloud's data protection practices, please use the appropriate channel below:

Referenced Legal and Regulatory Articles#

The following legal provisions are referenced throughout this Policy. Each reference is identified by number, with the title of the provision, a summary of its relevance to this document, and a link to the authoritative official source.