VIRTUS Data Centres: Critical Legal Risks in Privacy & Data Handling Clauses | Erayaha

## When Privacy Policies Create Million-Euro Risks: VIRTUS Data Centres Case Study

When we examined VIRTUS Data Centres' terms, our analysis revealed several legal and logical gaps that could expose the company to regulatory fines of up to €20 million under GDPR, significant litigation costs, and reputational damage. Below, we highlight four critical issues, their business impact, and actionable improvements.

1. Ambiguous Data Use Purposes and Legal Basis The terms state: "Any of the information we collect from you may be used in one of the following ways: To personalise your experience... To improve our website... To administer a contest... To send periodic emails..." However, this clause lacks specificity and fails to identify the legal basis for processing personal data, as required by GDPR (Articles 5, 6). This ambiguity could lead to regulatory scrutiny and costly enforcement actions.

Legal Analysis

high Risk

Removed

Added

Any of the information we collect from you maywill be used in one ofsolely for the following ways: To personalise your experience – your information helps us to better respond to your individual needs. To improve our website – we continually strive to improve our website offerings based on the informationspecific purposes outlined in this section, and feedback we receive from you. To administeronly where there is a contestvalid legal basis under applicable data protection laws (such as consent, promotioncontract necessity, survey or other site featurelegitimate interest). To send periodic emails – seeEach purpose and its legal basis are detailed below, Contact & Communicationin compliance with GDPR Articles 5 and 6.

Legal Explanation

The original clause is overly broad and does not specify the legal basis for each processing activity, as required by GDPR. The revision provides specificity and ensures lawful, transparent processing.

2. Incomplete Right to Be Forgotten Implementation While the terms mention a right to be forgotten, they require users to make written requests and do not specify timelines or procedures for data deletion. GDPR Article 17 mandates prompt action and clear communication. Delays or unclear processes could result in fines and loss of customer trust.

Legal Analysis

high Risk

Removed

Added

Right to be Forgotten - If contacts wish for– Data subjects may request erasure of their Personal Identifiable Information (PII) to be completely removed frompersonal data at any or alltime by contacting VIRTUS. Upon receipt of our systemsa valid request, you may contact VIRTUS will erase the data within 30 days and confirm completion in writing requesting for their information to be removed, which will be completedexcept where retention is required by law, in compliance with GDPR Article 17.

Legal Explanation

The original clause lacks a defined timeline and process, risking non-compliance with GDPR's prompt action requirement. The revision clarifies procedure and timeframe, reducing enforcement risk.

3. Vague Third-Party Data Sharing and Confidentiality The clause, "trusted third parties who assist us... so long as those parties agree to keep this information confidential," is insufficient. GDPR and CCPA require explicit data processing agreements and clear user notification. Without these, VIRTUS risks joint liability for breaches and regulatory penalties.

Legal Analysis

critical Risk

Removed

Added

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third to outside parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agreeexcept to keep this information confidentialthird-party service providers who have entered into written data processing agreements with VIRTUS, ensuring compliance with GDPR/CCPA. Users will be notified of such disclosures and may request a list of third-party processors.

Legal Explanation

The original clause does not require formal data processing agreements or user notification, both of which are mandated by GDPR and CCPA. The revision ensures contractual safeguards and transparency.

4. Unclear Data Retention Policy The policy states, "Your personal information is kept private and stored securely until a time it is no longer required or has no use, as governed by the General Data Protection Regulation (GDPR) guidelines from 2018." This lacks concrete retention periods and criteria, exposing the company to compliance gaps and potential data minimization violations (GDPR Article 5(1)(e)).

Legal Analysis

medium Risk

Removed

Added

Your personal information is kept private and stored securely until a timeretained only for as long as necessary to fulfill the purposes for which it is no longer required or has no usewas collected, or as governedrequired by the Generallaw. Specific retention periods for each data category are documented in our Data Protection Regulation (Retention Policy, available upon request, in compliance with GDPR Article 5(1) guidelines from 2018(e).

Legal Explanation

The original clause is vague and does not specify retention periods or criteria, risking non-compliance with data minimization and storage limitation principles. The revision provides clarity and legal alignment.

Conclusion: Proactive Legal Protection is Essential Our analysis shows that VIRTUS Data Centres faces substantial legal and financial risks due to ambiguous privacy and data handling clauses. Addressing these issues can prevent regulatory fines, litigation costs, and reputational harm. Proactive contract redlining is a critical step in robust risk management.

This analysis is for educational purposes only and does not constitute legal advice. For actual legal guidance, consult with a licensed attorney. This assessment is based on publicly available information and professional legal analysis. See erayaha.ai's terms of service for liability limitations.

Are your contracts exposing your business to hidden liabilities? How often do you review your privacy terms for regulatory compliance? What would a GDPR audit reveal about your data handling practices?