Your Privacy Choices

Your Privacy Choices and Privacy Request Procedure

This document explains the choices you have about personal information handled by Virtik USA, Inc. and the procedure for making a request. It supplements the Privacy Policy (LEG-002) and the California Notice at Collection (LEG-004).

1. Read this first: who holds your information

The single most important thing on this page. Virtik handles personal information in two capacities, and your request goes to a different place depending on which applies.

(a) Virtik decides — send the request to us. Our website, our marketing, your Virtik account, billing records, support correspondence and our own security telemetry. Section 3 onwards applies.

(b) An organization using Virtik decides — send the request to them. Cameras, video, audio, still images, detections, alerts, patrol and geolocation records, incident records, communications, and spatial models inside that organization's tenant. That organization is the controller and business. Virtik processes on its documented instructions and cannot decide your request.

If you are an employee, contractor, visitor or member of the public whose image, location or activity was captured by an organization using Virtik:

• direct your request to that organization;
• if you tell us who they are, we will confirm whether they are a customer where we are permitted to, and we will assist them as the Data Processing Addendum (LEG-010) requires;
• we will not search other customers' tenants looking for you. Doing so would mean scanning many organizations' video and location records about many people in order to answer one person — a larger privacy intrusion than the one being remedied.

2. Browser-level choices you can make immediately

These take effect in your current browser, need no identity verification, and require no request:

Limitation, stated honestly. These are stored on your device, not in an account. They do not travel to another browser, another device, or survive clearing site data. Use the request procedure below for anything that must persist across devices.

3. Rights that require a request

We do not collect sensitive personal information as California law defines it for our own purposes, so the right to limit has nothing to act on today. The control is offered for completeness and becomes meaningful if that changes.

4. How to submit a request

Request form: https://www.virtik.ai/privacy/ccpa By email: privacy@virtik.ai By post: 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States

The request form never reports success for a request it did not store. If the intake cannot store a request, the form tells you that the request was not filed, and you should send it by email instead. A request is filed only when the form returns a reference number.

Submit one right per request so that each can be tracked and answered on its own record. Tell us which right you are exercising, and enough for us to locate your information.

Do not include passwords, government identification numbers, financial information, health information or other sensitive information in a request. Where free text appears to contain such data, our intake sanitises it before the record is stored and flags that redaction occurred.

5. Identity verification

We verify before acting, because acting on an unverified request is itself a disclosure.

Principles. We ask only what is reasonably necessary; we scale the standard to the sensitivity of what is requested, so a deletion request is verified more strictly than a request to know categories; and we will never require you to create an account in order to exercise a right.

What we may ask for. Confirmation of information already held, a reply from an address already associated with the record, or confirmation through your organization's administrator where you are an authorized user.

What we will not ask for through a public form. Identity documents. If documentation is genuinely necessary we will request it separately through a channel able to protect it, and the initial form has no upload field by design.

If we cannot verify you. We will say so, explain what was insufficient, and where the law permits, treat an unverifiable deletion request as an opt-out request instead so that something useful still happens.

6. Authorized agents

An agent may submit on your behalf. We may require evidence of authorization and may contact you directly to confirm it, and we may require you to verify your own identity. Agent details are collected at intake and stored with the request record.

7. Reference and handling of your request

When you submit the request form it shows a request reference in the form PRIV-YYYY-XXXXXXXX. It is randomly generated, not sequential, and cannot be used to enumerate other requests. Retain it — it is how you or an agent follow up, and we use it in all correspondence. The reference shown on the screen is the confirmation that your request was filed.

Privacy-rights requests are received through the privacy request channel (the request form or privacy@virtik.ai) and routed to authorized Virtik personnel, who handle them for the purpose of dealing with the request. We keep a record of each request: the reference, type, requester relationship, the identity fields submitted, the jurisdiction answer, the date and time received and the due date. Related records and correspondence are kept only for as long as necessary to handle the request and to meet applicable legal, security or recordkeeping obligations. Virtik states no fixed deletion period for them (see LEG-022).

We do not store your raw IP address on a privacy request. Where an abuse-prevention identifier is needed, a keyed hash is used, and Virtik states no retention period for it (see LEG-022).

8. Response timing

We will respond within the period that applicable law requires, measured from the date we receive your request, not the date you sent it. For a request under California or another United States state privacy law that period is generally 45 days, extendable once where the law permits. For a request under the GDPR, the UK GDPR or Swiss law it is one month, extendable as those laws permit. The request intake records an internal tracking date of 45 days after receipt for each request it files; that date does not extend a shorter period that applies to you, and where a shorter period applies we work to it.

Where the law permits an extension we will tell you before the original period expires, why, and when to expect a response.

9. Appeals

Where applicable law provides a right to appeal a refusal, we will tell you how to appeal at the time we refuse, and we will not require you to appeal through a channel we have not told you about.

To appeal, write to privacy@virtik.ai with the reference number of your request and the word "Appeal" in the subject line. We will respond to an appeal within the period that applicable state law requires. Where an appeal is denied and the law requires it, we will tell you how to contact your state attorney general or other competent authority.

10. When we may refuse, in whole or part

• we cannot verify you to the standard the request requires;
• a statutory exception applies, for example retention required by law or information needed to detect security incidents or defend legal claims;
• the request is manifestly unfounded or excessive, or repetitive;
• complying would adversely affect another person's rights, including disclosing a third party's personal information; or
• the information is customer-controlled and we are not the controller — see §1.

We will explain the basis for any refusal and, where required, how to appeal or complain.

11. Fraud and abuse prevention

Requests are rate limited per connection and per email address, protected against automated submission, and validated server-side. These controls exist because a privacy request channel is an attractive route for someone trying to obtain another person's information, and because a deletion request submitted maliciously destroys data. They constrain volume, not your rights.

12. Security limitations, stated honestly

Email is not a secure channel. If you email a request, treat it as you would any unencrypted message and do not include sensitive information.

We cannot confirm receipt of something never delivered. If the form does not show you a reference, assume the request was not filed and contact us again.

13. Complaints

You may complain to your supervisory or state authority at any time, and you do not have to come to us first. In the EEA that is the authority where you live or work.

14. Contact

Privacy: privacy@virtik.ai Legal: legal@virtik.ai Post: 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States

Language. This document is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT