Privacy Policy

Last Updated: October 7, 2024

Introduction

This Privacy Statement explains how Virtual Enterprise Architects, LLC collects and uses Personal Data and describes the rights you have with respect to your Personal Data. In this Statement, “VEA,” “we” or “us” refers to Virtual Enterprise Architects, LLC.

VEA processes Personal Data for a variety of purposes. We collect Personal Data directly from you, such as when you submit a form or contact information on our website asking for information or when you register for a VEA sponsored event. We also automatically collect Personal Data when you engage with our websites. Alternatively, we process your Personal Data in the context of providing professional services to our clients, such as conducting security assessments and data analytics on client entrusted data. Finally, we obtain your Personal Data through publicly available sources, such as government records and online resources, as well as through vendors.

This Privacy Statement covers the described methods in which VEA collects Personal Data. By clicking on the below links in the index, you can go to a more detailed explanation of the information VEA collects and the purposes of the collection.

Scope

"Personal Data" is any data that can be used to identify an individual, either alone or when combined with other information that is linked or linkable to a specific individual. Personal Data can directly identify an individual, such as a name, email address, or identification number. Personal Data can also indirectly identify an individual, such as when combined data elements specify a unique individual, such as race, gender, and job role within a work environment. Another example is when data elements specify the physical, behavioral, mental, genetic, economic, cultural, or social identity or activities of a unique individual.

“Sensitive Personal Data” includes the following special categories of personal data:

Government identification card or number
Financial account numbers and access codes
Precise geolocation
Biometric or genetic data when used to identify an individual
Medical information
Criminal records
Racial or ethnic origin
Religious or philosophical beliefs
Union membership
Sex life or sexual orientation
Content of communications if obtained by someone who is not the intended recipient

Your Rights in Relation to the Personal Data We Collect and Process

You have the following rights related to your Personal Data that VEA collects and processes:

Right to request access to your Personal Data maintained by VEA
Right to request amendment or correction of your Personal Data
Right to request deletion of your Personal Data
Right to request data portability or the right to receive a copy of your Personal Data in a structured, commonly used and machine-readable format to transfer to another company
Right to opt-out of marketing communications at any time
Right to request restriction or to object to the processing of your Personal Data
Right to withdraw consent, if you have voluntarily provided, or have consented to provide your Personal Data
Right to complain to a data protection authority

If you want to assert any of the above rights, you may contact us at 888-832-4445 or security@virtual-ea.com. We will respond to your request consistent with applicable law. See Related Privacy Policies for more details on your rights and how to exercise your rights.

In your request, please include the following:

The nature of the request (the type of right you are asserting)
What Personal Data you seek to access, amend, delete, restrict, transmit to another company, or withdraw consent to process

For your protection, we may only respond to requests with respect to the Personal Data associated with the email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable and within the requirements of any applicable law.

Please note that we may need to retain certain information for recordkeeping purposes, to comply with legal obligations, and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records or in backups which will not be removed until the retention period ends.

Minors

VEA does not intend this Site to be directed to individuals under the age of eighteen (18), and we do not knowingly collect, process, disclose, or share the Personal Data of minors from this Site. If you are a minor and believe that you have provided Personal Data, please ask your parent(s) or legal guardian(s) to notify us, and we will delete your Personal Data.

Purpose Specification and Use Limitation

VEA limits the collection, use, retention, and disclosure of Personal Data to what is reasonably necessary and proportionate to achieve the purposes for which the Personal Data was collected or processed. VEA also limits secondary use or disclosure to that which is compatible with the original purpose of the Personal Data collection, or we will get consent to process the Personal Data, unless the processing is permitted or required by law.

Personal Data We Collect and For What Purpose

Individuals who visit virtual-ea.com

Information that individuals provide

We collect information that you provide voluntarily through our site when you provide an online form, register for an event, subscribe to a white paper or newsletter, and reach out with contact information to receive marketing communications. We do not intend to collect Sensitive Personal Data unless you provide it to us. We encourage you not to provide Sensitive Personal Data in free text boxes or communications, but if you do, you acknowledge that you consent to the collection and processing of the Sensitive Personal Data.

If you submit any Personal Data relating to other people to us or to our service providers in connection with the website, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Statement.

If you elect to opt-out of receiving VEA publications or marketing communications, your basic contact details will remain on our opt-out list.

Information that is collected automatically

When you visit our website, we collect certain Personal Data automatically from your device. For example, we may collect:

Broad geographic location (e.g. country, city-level, or zip location)
Company name
Internet Protocol (IP) address
Pixel identifier (ID)
Device type
Email address
How your device interacts with our site, including pages viewed, time you visited, current universal resource locator (URL), and links clicked
Our site also uses various social media plugins.

Purposes for Which VEA Processes the Personal Data of Visitors to the Website

VEA collects and processes the Personal Data of Visitors to our website for the following purposes:

To administer and manage our site
To personalize and improve your browsing experience by displaying content and advertising that may be of particular interest to you
To provide news or information that may interest you through other plug-ins on the site
To analyze the data of visitors to our website and website traffic information
To determine your employer or organization with which you associate
To develop our business and services
To provide marketing communications and materials
To monitor and enforce compliance with applicable terms of use
To conduct quality and risk management reviews
To maintain security
To allow for event and webinar registration, management, and coordination
To allow content download
Any other purpose for which you provide information to VEA

Legal Basis for Processing Personal Data

Explicit consent of the visitor
VEA’s legitimate interest in
Effectively delivering information and services to you
Developing and improving our site and user experience
Marketing, growing, and protecting our business and services

Individuals who engage on social media sites, plug-ins, and tools

Social Media Sites

VEA uses various social media platforms, such as Instagram, Facebook, Youtube or LinkedIn, for recruitment or marketing purposes. We use social media to provide easy access to relevant information about job opportunities and events and to promote our services and brand.

VEA is responsible for the content it publishes using social media platforms, but does not have control over the social media platforms and the way they are administered. When using these social media platforms, you must adhere to the terms of use and privacy policies imposed by the platform providers. If you would like to access this data or invoke your rights to the data, such as the right to correct or object to the processing of the data, you should contact the social media platform provider.

Some social media platforms provide VEA with data relevant to your pages that is aggregated or combined with similar data from other visitors to our social media sites, such as the number of “likes” triggered by our content or the amounts of posts, visitors to the sites, and information downloaded or links clicked.

Social Media Plug-Ins

We use some social media plug-ins on our site that allow you to share information with your social network, view content, and provide you with relevant information. When you interact with these features your internet browser will directly connect you to the relevant social network server to complete the action. The social media provider will know that the page with the plug-in on our site has been visited.

VEA or our service providers may also provide the social media provider with advertisements or marketing materials that they can deliver to individuals who viewed related content on our websites. The social media sites may also use the Personal Data collected in ways consistent with that provider’s notices and terms of use.

We have no control over the data collected by the social media providers through the use of the buttons. VEA does not know the type of data collected or how it is used.

Facebook Plugin

Our site includes plugins for Facebook. For an overview of the Facebook plugins, click here.

When you visit our site, a direct connection between your browser and the Facebook server is established via the plugin. This enables Facebook to collect information from your IP address that you have visited our site. By clicking the Facebook “like button” while on the Facebook account, you will link the content of our site to your Facebook profile. For more information about the content of the data transmitted to Facebook or how Facebook uses the data, see Facebook’s privacy policy.

Instagram plugin

If you are logged into your Instagram account, you can click the Instagram button to link the content of our pages with your Instagram profile. For more information about the content of the data transmitted to Instagram or its use, see Instagram’s privacy policy.

YouTube

YouTube is operated by Google. If you visit one of our pages featuring a YouTube plugin, the YouTube service collects information about which pages you have visited. If you are logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. For more information, see Google’s privacy policy. Social Media Tools

Google Maps

Our site uses the Google Maps service via an application programming interface (API). To use Google Maps, it is necessary to save your IP address. VEA does not control the transfer of your data. For more information, see Google’s privacy policy.

Legal Basis for Processing Personal Data in Social Media, Plug-Ins, and Tools

VEA’s legitimate interest in:

VEA’s legitimate interest in:
Promoting VEA services and brands
Attracting, identifying, and sourcing talent
Improving website experience and optimizing services

Individuals who engage VEA through email correspondence

Email Correspondence

VEA uses tools to protect the security of our information technology (IT) assets, including our email transmissions. Examples include:

Systems that scan incoming emails for suspicious attachments and universal resource locators (URLs) to prevent malware attacks
End-point threat detection tools to detect malicious attacks
Tools that block certain content or websites.

If you send emails to VEA, your emails will be scanned by these tools to maintain VEA’s IT infrastructure security, which means that VEA personnel other than the intended recipient may read your email content.

Legal Basis for Processing Personal Data

VEA’s legitimate interest in:

Protecting our IT infrastructure against unauthorized attacks and data leakage by analyzing email traffic
Maintaining telecommunications within the company

Individual contacts in VEA’s Customer Relationship Management (CRM) systems

We process Personal Data about client contacts, industry partners, and VEA alumni in our CRM system. This system supports VEA business development and, to some extent, marketing efforts. In our CRM systems, we process the following categories of personal data:

Name, email address, phone
Name of employer or organization the individual is associated with
Marketing opt-in or opt-out information if the individual has been identified in VEA’s marketing list of contacts

Legal Basis for Processing Personal Data

Explicit consent of the business contact
VEA’s legitimate interests in
- Managing the relationships with our business contacts
- Providing information about VEA and our services and events

Recruitment

We collect information from and about individuals in connection with employment opportunities at VEA. In general, the data we collect includes resumes or CVs, identification documents, academic records, work history, and employment information.

We use your information to determine qualifications based on education, experience, and skills for available positions at VEA. The information is shared with recruiters, hiring managers, and other persons involved in the recruitment process. VEA may collect further information if you are invited for an interview.

We also collect Sensitive Personal Data from candidates during recruitment and onboarding when employment law obligates us or when candidates consent and voluntarily provide the information, as permitted by applicable law. This information assists VEA in providing a diverse working environment and in providing benefits. For example, VEA may request race or disability information for analyzing the diversity of our workforce or providing reasonable accommodations. In some cases, VEA is required by law to provide diversity information and may need to make an assessment without the help of the candidate or employee.

In addition, we collect Sensitive Personal Data related to criminal background checks on prospective candidates after they receive an offer.

Depending on the country in which you apply, VEA collects Personal Data about candidates from the following sources:

From you directly – for example through the application you submit
From third parties, such as placement firms, recruiters, or job-search websites – for example, when they contact us with your information as a potential candidate
From referrals – for example friends at VEA
From publicly available sources online – for example, your professional profile posted on LinkedIn or on another website
From education institutions – for example the universities listed on your resume
From background screening either by VEA or a VEA service provider

Legal Basis for Processing Personal Data

Explicit consent of the candidate
VEA’s legitimate interest in
- Sourcing talent
- Processing applications for VEA positions or roles
- Hiring and onboarding of candidates
- Carrying out pre-employment background screening
- Complying with legal or regulatory requirements
- Protecting the security of VEA personnel, buildings, and assets, such as by carrying out background checks

Individuals who attend VEA events

As described above, VEA processes event registration through VEA websites and social media applications. As part of the event management, we also process the following Personal Data:

Name
Email address
Company
Title
Country
Any other information you choose to provide in a comment

We do not intend to collect Sensitive Personal Data, unless you provide it to us. We encourage you not to provide Sensitive Personal Data in free text boxes or communications, but if you do, you acknowledge that you consent to the collection and processing of the Sensitive Personal Data.

If you submit any Personal Data relating to other people to us or to our service providers in connection with this Site, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

In registering for an event, you may choose to receive marketing communications from VEA. If you elect to opt-out of receiving VEA publications or marketing communications, your basic contact details will remain on our opt-out list.

Legal Basis for Processing Personal Data

Explicit consent of Participant
VEA’s legitimate interest in:
- Organizing and managing events
- Protecting VEA people, facilities, and assets
- Providing and marketing information about VEA

Photographs and video recordings at VEA events

VEA may take photographs or video recordings at VEA sponsored or co-sponsored events. Participants will be asked to sign a consent for the use of their photographs during registration or at the event. VEA will only use the photographs of participants who have signed consents permitting the use of their images for commercial purposes or marketing.

For some events, VEA may not be able to obtain explicit written consent for photographs and video recordings taken at the event. Instead, VEA will post signage providing notice of the photographs and recordings. VEA will only use these photographs and video recordings internally, unless you have provided a prior written consent to use the photographs and video recordings for marketing or commercial purposes. If you would like to withdraw your consent, you can contact VEA at it@virtual-ea.com.

Legal Basis for Processing Personal Data

Explicit Consent of Participant
VEA’s legitimate interest in taking photographs and video recordings for non-commercial purposes

Clients

When a client engages VEA for services or products, VEA collects and processes Personal Data for legitimate business purposes in connection with those services. VEA may process Personal Data voluntarily provided by our clients or third parties at the request of our clients. This Personal Data includes:

Name
Contact Information, including work address, email address, and telephone number
Company where you work and your role at the company
Financial information
Any other information provided to us for purposes of providing services

Legal Basis for Processing Personal Data

Explicit Consent
VEA’s legitimate interest in:
- Providing services to clients
- Administering the contractual and project relationship
- Complying with accounting and tax requirements
- Marketing and business development
- Complying with legal and regulatory requirements
- Establishing, exercising, or defending our legal rights
- Protecting VEA people, facilities, and assets
- Archiving and analyzing statistical data

Individuals whose personal data we process in providing services to clients

In providing services to government and commercial clients, VEA processes the Personal Data of individuals with whom we do not have a direct relationship (contractual or otherwise). For example, our government or commercial clients may contract with us to perform data analytics, cybersecurity assessments, or any other numerous services. In doing this work, we may have access to the Personal Data collected and maintained by our clients. In some client engagements, VEA collects Personal Data of individuals on behalf of the clients. For example, VEA may conduct a research project on behalf of the client where VEA employees interact directly with individuals and collect their Personal Data. When VEA collects Personal Data directly from the individuals, VEA will ensure that the collection is done lawfully with either the required notice and consent of the individual or with the required legal authority acting on behalf of the client.

United States Government Clients

VEA contracts with several government agencies, offices, and programs. In providing services to the government, VEA must comply with various privacy and security laws, regulations, guidance, and policies that apply to the Personal Data of federal agencies. Similarly, if VEA conducts a clinical research project, VEA may need to comply with the consent requirements under the Federal Protection of Human Subjects and the Health Insurance Portability and Accountability Act.

VEA has several internal controls to ensure that, in collecting and processing the Personal Data of government clients, VEA complies with the privacy and security requirements applicable to the Personal Data and VEA’s services.

Commercial Clients

In providing services to commercial clients, VEA gets legal assurances from our clients that as controllers of the Personal Data they have the legal authority to provide the Personal Data to us for the purpose of providing the services and that the Personal Data that they provide to us has been collected in accordance with applicable law. VEA contractually agrees to process the Personal Data in accordance with applicable laws and to accommodate the rights of the individuals whose Personal Data we process.

Since VEA provides a diversity of services for government and commercial clients, VEA processes several types of Personal Data related to those services, including, but not limited to:

Name
Basic demographic data, such as date of birth, age, marital status, country of residence or citizenship
Contact data, such as phone numbers, postal addresses, and email addresses
Employment data, such as employer name, role or rank, experience, and performance
Health data, such as medical diagnosis, treatment, and insurance information
Financial data, such as account numbers, salary, benefits, and tax information
Biometric data, such as facial images and voiceprints
Protected class data, such as religion, race, ethnicity, sexual orientation, gender
Membership in union or other associations
The Personal Data and Sensitive Personal Data VEA collects, receives, uses, or discloses will be processed only as necessary to provide the services to our client.

Legal Basis for Processing Personal Data

Explicit consent, as required by applicable law, when VEA collects the Personal Data from individuals
As authorized by law
VEA’s legitimate interest in:
- Providing services to our clients
- Complying with contractual legal obligations

Individuals whose personal data we process in developing commercial products or conducting research

VEA collects, receives, and processes Personal Data of individuals to develop and improve commercial products and services.

VEA also obtains data sets for the purposes of conducting research. In some cases, VEA obtains and processes de-identified or anonymized Personal Data, which means that the data cannot be tied to an individual. In other cases, VEA may obtain or process a limited data set, where the data set only has indirect identifiers, or a pseudonymized data set, where the data set is de-identified, but may be re-identified.

The types of Personal Data that VEA may obtain include, but are not limited to:

Mobile device identifiers
Photographs
Audio recordings
Health data
Videos

Legal Basis for Processing Personal Data

Explicit consent, as required by applicable law, when VEA collects the Personal Data from individuals
As authorized by law
VEA’s legitimate interest in:
- Conducting research
- Growing VEA’s business
- Enhancing VEA’s services to his client

Visitors to VEA offices

We collect and process the Personal Data of visitors to VEA facilities to control access to our facilities and information assets and to protect our people, facilities, and assets. We collect and process the following types of Personal Data:

Visitor records and access badges

Visitors must provide name, contact information, country of residence, and date of birth through the VEA pre-registration portal or at the door when entering VEA. Visitors will also have to show a passport or driver’s license to verify the information provided. VEA collects this information to comply with the legal obligation of confirming that the visitor is not on a watch-list prohibiting business with VEA. VEA uses the screening to protect VEA personnel, facilities, and assets.

Wi-Fi and VEA information assets

VEA monitors and logs traffic on our Wi-Fi networks. This allows us to see limited information about a user’s network behavior as well as the source and destination addresses to which the user connects.

Legal Basis for Processing Personal Data

VEA’s legitimate interests in:

Protecting personnel, facilities, and assets
Complying with laws and regulations related to individuals on a restricted list for conducting business

Individuals who pose a potential threat or risk to VEA

VEA collects and processes the Personal Data of individuals who present a potential security threat to VEA people, facilities, assets, business, and reputation. VEA only collects and processes the Personal Data as needed to assess and mitigate the threat.

Legal Basis for Processing Personal Data

VEA’s legitimate interests in:

Protecting personnel, facilities, businesses, and assets
Preventing and detecting crimes
Establishing, exercising, and defending legal claim

Suppliers

VEA collects and processes Personal Data about suppliers, including vendors, subcontractors, and individuals associated with them. We process the Personal Data to manage our contractual relationships and to enable services from our suppliers.

The Personal Data we collect and process generally includes:

Name
Employer name
Contact information (phone and email address)
Communications related to providing the services
Financial information related to payment of services

VEA also collects Personal Data to check for conflict of interest and to conduct background checks required by law or regulations, such as laws related to fraud and corruption and international trade compliance regulations. VEA may also collect Personal Data in doing due diligence prior to engaging a supplier.

Legal Basis for Processing Personal Data

Performance of a contract
VEA’s legitimate interests in:
- Complying with legal or regulatory obligations
- Managing payments, fees, and charges related to the contract for services
- Understanding any conflicts of interest
- Protecting VEA personnel, facilities, assets, and reputations
- Preventing association with criminal or fraudulent activities

Retention

VEA retains PII only as long as needed for the stated processing purpose. VEA’s record retention schedule provides the required retention periods for VEA records based on business and legal requirements, including the need to exercise and defend legal rights. VEA also maintains records for archiving and historical purposes in compliance with retention periods. If Personal Data is not in a record subject to VEA’s retention schedule, VEA policy requires that the Personal Data be deleted when no longer necessary for the stated processing purpose.

VEA Ethics

VEA provides employees, clients, and external third-parties various means to report unethical or illegal behaviors that violate the law, regulations, or VEA policy. Reports can be made directly to the Human Resources at hr@virtual-ea.com.

Security of Personal Data

VEA uses reasonable organizational, technical, and administrative measures to protect the confidentiality, integrity, and availability of the Personal Data that VEA collects, maintains, and processes. VEA limits access to information to those with a need to know to process the Personal Data. VEA also implements policies, procedures, and technical controls to safeguard the Personal Data from unauthorized access, loss, misuse, and improper disclosure.

If you have reason to believe that your Personal Data is no longer secure, please immediately notify us at it@virtual-ea.com. Because email communications are not always secure, please do not include sensitive information in your emails to us.

Security of Personal Data

VEA maintains the accuracy, completeness, and timeliness of the Personal Data we store. We need your help in updating us on your contact details or other Personal Data to have the most up-to-date information. You can contact the staff you usually engage with at VEA or it@virtual-ea.com.

Transfers of Personal Data

VEA centralizes internal operations, including information technology services, human resources, and finances in the United States. Client engagements in countries or jurisdictions outside the United States often involve transfers of Personal Data outside of the client’s country or jurisdiction. These transfers occur due to:

The need to access Personal data by VEA’s internal operations in the United States
The location of VEA employees working on the client engagement outside the client’s jurisdiction
The location of VEA vendors or subcontractors who are located outside of the client’s jurisdiction

This means that your Personal Data may be transferred and processed outside of the country where you may be located. This includes transfers of Personal Data from the European Economic Area (EEA) or United Kingdom (UK) to countries with laws that the EEA, UK, or other jurisdictions have not deemed to provide an adequate level of protection for the processing of Personal data.

VEA has provided appropriate safeguards to protect the confidentiality, integrity, and availability of the Personal Data transferred within VEA entities. VEA has executed data transfer agreements with standard contractual clauses in accordance with EEA and UK privacy laws that allow for global transfers within the VEA organization where the Personal Data is collected or obtained from individuals in the EEA. If you have more specific questions, please contact it@virtual-ea.com.

Service Providers

VEA engages service providers to support our internal operations, including client contracts. We may disclose, and in some cases, transfer Personal Data we collect to our service providers and their affiliates and sub-processors. In other cases, service providers may collect and transfer Personal Data on our behalf. For example, service providers may provide:

Information technology functions, such as information security, data storage, data analytics, business applications, and voicemail
General operational support, such as enterprise management software, customer relationship management software, archiving, and event management
Accounting, finance, and billing support
Compliance risk reviews and assessments, legal hold services, and legal case management
Subcontractor services when we are engaged by a client

In engaging third parties, VEA ensures that our service providers contractually agree to comply with any applicable privacy law requirements, including those related to the collection and transfer of Personal Data outside the jurisdiction in which it was collected. VEA also ensures that they maintain appropriate security safeguards and meet confidentiality requirements related to Personal Data. If you would like to know more about the third parties VEA engages, please contact VEA at security@virtual-ea.com.

Additional Disclosures of Personal Data

VEA discloses Personal Data for the following purposes:

As directed by you or at your consent
Where the disclosure is necessary and appropriate for the purposes described in this policy, including within the VEA entities
If required by applicable law, including laws outside the country where the Personal Data was collected
In connection with a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business assets or stock (including in connection with any bankruptcy or similar proceeding)
To protect, exercise, and defend VEA’s legal claims, safety, or property
To comply with a regulatory or government inquiry, court order, or other legal obligation, including those outside the country where the Personal Data was collected
To cooperate with law enforcement as necessary

VEA is obligated to report certain activities or suspected criminal activity to relevant regulatory authorities and law enforcement. The law sometimes prohibits VEA from informing the individual about the disclosure prior to the disclosure, or at all. Third-party recipients of the Personal Data may include:

Law firms, tax advisors, or auditors
Insurers
Audit regulators
Tax and customs, and excise authorities
Regulatory bodies
Credit reference agencies
Courts, police, and law enforcement agencies
Government departments and agencies
Service providers

Complaints

If you want to report an alleged violation or breach of a privacy law or any other regulation, you should contact us at security@virtual-ea.com. You can also reach out to the CEO at Virtual Enterprise Architects, 1255 Union St NE, 7th Floor-Suite 68, Washington, DC 20002.

You also have the right to complain to the data protection authority in your country or refer the matter to a court of competent jurisdiction or as specified in any applicable engagement agreement with VEA.

If you are located in the EEA, you may lodge a complaint with a data protection authority for your country or region, or where an alleged infringement of applicable data protection law occurs.

Revisions to the Privacy Statement

We may change this Privacy Statement to reflect changes in our practices and services. The “Last Updated” legend at the top of this page indicates when this Privacy Statement was last revised. Any changes will become effective when we post the revised notice on this website. We recommend checking this Statement from time to time to inform yourself of any changes based on the last updated date.