Privacy Policy | VirgoX Marketing

1. Introduction

VirgoX Marketing (“VirgoX,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal data responsibly, securely, fairly, and transparently.

This Privacy Policy explains how VirgoX Marketing collects, uses, stores, discloses, transfers, and otherwise processes personal data through:

The VirgoX Marketing website;
Consultation and contact forms;
Email, telephone, video call, and messaging communications;
Client onboarding and project management processes;
AI voice agents;
Website chat agents;
WhatsApp, SMS, and email automation systems;
Customer relationship management systems;
Calendar and booking integrations;
Lead qualification and follow-up workflows;
Proposal and document-generation systems;
Analytics and reporting systems;
Post-deployment support services; and
Other services supplied by VirgoX Marketing.

VirgoX Marketing is legally operated under the business name VirgoX Marketing and is founded and owned by Anjana Kariyawasam.

This Privacy Policy applies to website visitors, prospective clients, clients, client representatives, contractors, suppliers, business partners, authorized users, and individuals whose personal data may be processed through systems operated or supported by VirgoX.

By accessing virgoxleads.com, submitting information, contacting VirgoX, accepting a proposal, entering into a service agreement, or using a VirgoX service, you acknowledge that you have read and understood this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies when VirgoX:

Collects and uses personal data for its own business purposes; or
Processes personal data on behalf of a client while building, operating, maintaining, or supporting a client system.

It does not replace a client’s own privacy policy.

Clients using VirgoX systems remain responsible for providing appropriate privacy notices to their customers, leads, website visitors, employees, contractors, and other relevant individuals.

3. VirgoX’s Role as Controller or Processor

Depending on the circumstances, VirgoX may act as either a data controller or a data processor.

3.1 VirgoX as a Data Controller

VirgoX acts as a controller when it determines why and how personal data is processed for its own purposes, including:

Managing website inquiries;
Booking consultations;
Communicating with prospective clients;
Managing client relationships;
Processing invoices and payments;
Operating and securing the VirgoX website;
Conducting permitted marketing;
Managing contracts and records;
Providing customer support; and
Meeting legal and regulatory obligations.

3.2 VirgoX as a Data Processor or Service Provider

VirgoX may act as a processor or service provider when processing personal data according to a client’s documented instructions.

This may occur when VirgoX builds, configures, tests, monitors, maintains, or supports:

AI voice agents;
Chat agents;
CRM systems;
Lead qualification workflows;
Automated follow-up systems;
Call or conversation summaries;
Appointment-booking systems;
Lead records;
Customer communication workflows; or
Connected third-party platforms.

When VirgoX acts as a processor, the client is generally the controller and remains responsible for determining the purpose and lawful basis of the processing.

4. Information We Collect

The personal data collected depends on how an individual or business interacts with VirgoX.

4.1 Information Provided Directly

We may collect:

Full name;
Business or trading name;
Job title;
Professional role;
Email address;
Telephone number;
Country, city, or general business location;
Website address;
LinkedIn or professional social media information;
Industry or business category;
Services offered;
Business requirements;
Lead-handling information;
Sales and customer-service processes;
Information provided through contact, consultation, onboarding, support, or feedback forms;
Communications sent by email, telephone, messaging application, or video call;
Billing and invoicing information;
Project instructions;
Technical information;
Business documents;
Brand guidelines;
Scripts;
frequently asked questions;
Customer-service information;
Sales materials;
CRM exports;
Website content;
Workflow documentation;
API or integration details; and
Other information voluntarily supplied to VirgoX.

4.2 Consultation and Sales Information

When an individual books or attends a consultation, demonstration, audit, discovery call, or strategy session, VirgoX may collect:

Business goals;
Business challenges;
Current inquiry channels;
Existing CRM or software platforms;
Approximate lead volume;
Current response and follow-up procedures;
Sales process information;
Service or package information;
Project requirements;
Budget or commercial expectations;
Technical requirements;
Notes taken during the consultation; and
Call recordings or transcripts where recording is enabled, lawful, and properly disclosed.

4.3 Website and Device Information

When an individual visits virgoxleads.com, certain technical information may be collected automatically, including:

Internet Protocol address;
Browser type;
Browser version;
Device type;
Operating system;
Referring source;
Website pages visited;
Time spent on pages;
Dates and times of visits;
Links or buttons selected;
General interaction data;
Approximate location derived from an IP address;
Cookie identifiers;
Session identifiers; and
Analytics and performance information.

4.4 Client and Lead Data

When delivering services to a client, VirgoX may process information supplied by the client or collected through a client-authorized system, including:

Customer or lead names;
Email addresses;
Telephone numbers;
Inquiry details;
Service interests;
Appointment details;
Chat messages;
Call transcripts;
Call recordings, where permitted;
Email, SMS, or WhatsApp communication history;
CRM records;
Lead source information;
Customer preferences;
Customer questions;
Objections or concerns;
Urgency;
Qualification information;
Budget-related information;
Lead classifications;
AI-generated conversation summaries;
Follow-up notes;
Buyer or lead profiles; and
Staff assignment information.

Clients must not provide personal data to VirgoX unless they have the authority and lawful basis to do so.

4.5 Information Received From Third Parties

VirgoX may receive information through platforms connected or authorized by a client, including:

CRM platforms;
Calendar providers;
Voice AI providers;
Messaging platforms;
Email platforms;
Website form providers;
Website hosting providers;
Automation services;
Analytics platforms;
Payment processors;
Cloud storage providers;
Telephony providers;
Customer-support systems; and
Other client-selected integrations.

The information received depends on the permissions, settings, integrations, and functionality selected by the client.

5. How Information Is Collected

VirgoX may collect personal data:

Directly from an individual;
Through the VirgoX website;
Through a consultation or onboarding form;
Through an email or message;
During a telephone or video call;
Through a signed agreement, proposal, or invoice;
Through a client’s CRM or connected platform;
Through an AI voice or chat interaction;
Through cookies and analytics technology;
Through authorized third-party service providers; or
From publicly available professional or business sources where collection is lawful.

6. Use of Information

VirgoX may use personal data for the following purposes.

6.1 Service Delivery

We may use information to:

Respond to inquiries;
Arrange consultations;
Assess business requirements;
Prepare proposals;
Define project scopes;
Create AI agent strategies;
Configure voice and chat systems;
Design qualification workflows;
Develop follow-up sequences;
Configure CRM pipelines;
Connect third-party platforms;
Build calendar and booking workflows;
Draft scripts, prompts, messages, and logic;
Test systems;
Deploy systems;
Monitor agreed functionality;
Diagnose technical problems;
Provide training and guidance;
Deliver post-deployment support; and
Fulfil contractual obligations.

6.2 Client and Contract Management

We may use information to:

Create and administer service agreements;
Manage client onboarding;
Communicate project updates;
Request information or approvals;
Issue invoices;
Track payments;
Maintain project records;
Handle change requests;
Provide support;
Manage renewals or extended support;
Resolve complaints or disputes; and
Maintain financial, tax, accounting, and legal records.

6.3 Security and Fraud Prevention

We may process information to:

Protect VirgoX systems;
Prevent unauthorized access;
Detect fraud or abuse;
Investigate suspicious activity;
Protect client accounts;
Maintain access records;
Enforce contractual rights; and
Protect VirgoX, its clients, and other individuals from harm.

6.4 Service Improvement

VirgoX may use appropriate information to:

Improve workflows;
Improve system reliability;
Improve onboarding;
Identify common technical problems;
Improve support procedures;
Improve AI prompts and conversation structures;
Develop new service capabilities;
Evaluate website performance; and
Understand general service demand.

Where reasonably possible, VirgoX will use aggregated, anonymized, or de-identified information for improvement purposes.

Client data will not be used to train a public or general-purpose AI model operated by VirgoX unless this is separately disclosed and expressly agreed in writing.

6.5 Marketing Communications

Where lawful, VirgoX may use business contact information to:

Follow up after an inquiry;
Provide requested information;
Send service updates;
Share relevant business or educational content;
Inform prospective clients about VirgoX services;
Invite individuals to book a consultation; or
Reconnect regarding a previous business inquiry.

Recipients may opt out of non-essential marketing communications by using an unsubscribe option or emailing anjana@virgoxleads.com.

7. Lawful Bases for Processing

Where applicable law requires a lawful basis, VirgoX may rely on:

Consent;
Performance of a contract;
Steps requested before entering into a contract;
Compliance with a legal obligation;
Legitimate business interests;
Protection of legal rights, security, or property;
Establishment, exercise, or defence of legal claims; or
A client’s documented instructions when VirgoX acts as a processor.

The lawful basis used will depend on the purpose, type of information, and circumstances of the processing.

8. AI and Automated Processing

VirgoX designs and supports systems that may use artificial intelligence or automated processing.

Depending on the agreed configuration, an AI system may:

Respond to an inquiry;
Ask qualification questions;
Record customer-provided information;
Transcribe or summarize a conversation;
Categorize a lead;
Draft follow-up communication;
Recommend a next action;
Create a lead profile;
update a CRM;
Route a customer to a staff member;
Schedule an appointment; or
Identify whether an inquiry requires human attention.

AI-generated content may contain errors, incomplete information, or incorrect interpretations.

VirgoX recommends that clients:

Test systems before launch;
Maintain appropriate human oversight;
Review important AI-generated information;
Provide an escalation route to a human;
Avoid relying solely on AI for high-risk decisions; and
Clearly disclose automated or AI interactions where required.

VirgoX does not intend its standard systems to make final legal, medical, employment, financial, emergency, or similarly high-impact decisions about individuals.

9. Call Recording, Transcription, and Communications

Where enabled, AI voice or communication systems may record, transcribe, summarize, or analyze interactions.

Recording and transcription will only be configured where requested or authorized by the client.

The client is responsible for:

Determining whether recording is lawful;
Providing legally required notices;
Obtaining consent where required;
Establishing retention periods;
Responding to requests from recorded individuals;
Restricting access to recordings; and
Ensuring recordings are not used unlawfully.

VirgoX may access limited communication samples during testing or support when reasonably necessary to identify errors or improve the client’s agreed system.

VirgoX does not sell personal data.

VirgoX may share personal data in the circumstances described below.

10.1 Service Providers and Subprocessors

VirgoX may use trusted service providers for:

Website hosting;
Cloud infrastructure;
AI processing;
Voice and telephony services;
CRM services;
Messaging services;
Calendar scheduling;
Email delivery;
Payment processing;
Analytics;
Automation;
Security;
Project management;
Document storage;
Accounting; and
Professional legal or technical advice.

These providers may process information only to the extent required to perform their services, subject to their contracts, privacy policies, security practices, and applicable laws.

10.2 Client-Selected Platforms

When a client requests a particular integration, information may be transferred to or from that platform.

The client is responsible for reviewing and approving the privacy, security, pricing, and contractual terms of client-selected platforms.

10.3 Legal Disclosure

VirgoX may disclose information where reasonably necessary to:

Comply with applicable law;
Respond to a court order or lawful authority;
Establish or defend legal rights;
Investigate fraud or security threats;
Enforce an agreement;
Protect VirgoX, its clients, or the public; or
Address an emergency involving safety or security.

10.4 Business Restructuring

Personal data may be transferred as part of a legitimate merger, acquisition, restructuring, financing, sale of assets, or transfer of the VirgoX business.

Any recipient will be required to handle the information consistently with applicable confidentiality and privacy obligations.

11. Data Security

VirgoX uses reasonable technical, organizational, contractual, and administrative safeguards appropriate to the nature of the data and services.

Measures may include:

Role-based access;
Limited staff or contractor access;
Strong account passwords;
Multi-factor authentication where available;
Secure cloud infrastructure;
Encryption supported by relevant platforms;
Confidentiality obligations;
Access reviews;
Secure credential management;
Backup and recovery processes;
Security monitoring;
Controlled project handover; and
Removal of unnecessary access following project completion.

No online system, transmission method, software platform, or storage method can be guaranteed to be completely secure.

VirgoX cannot guarantee absolute security and is not responsible for security incidents caused by:

A client’s weak passwords;
Unauthorized client account sharing;
Client device compromise;
A client’s failure to remove former staff access;
Third-party platform vulnerabilities;
Incorrect client configuration;
Client misuse; or
Circumstances outside VirgoX’s reasonable control.

12. Personal Data Breaches

Where VirgoX becomes aware of a confirmed personal data breach affecting information under its control, VirgoX will take reasonable steps to:

Investigate the incident;
Limit further unauthorized access;
Preserve relevant evidence;
Assess the potential impact;
Notify affected clients where appropriate;
Cooperate with relevant service providers; and
Meet applicable notification obligations.

Where VirgoX acts as a processor, VirgoX will notify the relevant client without undue delay after becoming aware of a confirmed breach affecting that client’s personal data, subject to the applicable agreement.

13. User and Data-Subject Rights

Depending on applicable law and VirgoX’s role, individuals may have the right to:

Request information about the processing of their personal data;
Request access to their personal data;
Request correction or completion of inaccurate data;
Withdraw consent where processing depends on consent;
Object to certain processing;
Request deletion or erasure;
Request restriction of processing;
Request a review of certain decisions based solely on automated processing;
Request a portable copy of information where applicable;
Opt out of marketing communications; and
Submit a complaint to the appropriate data protection authority.

Requests may be sent to anjana@virgoxleads.com with the subject line Privacy Request.

VirgoX may request reasonable information to verify the requester’s identity and authority.

A request may be refused or limited where permitted by law, including where information must be retained for contractual, legal, accounting, security, fraud-prevention, or dispute-resolution purposes.

Where VirgoX processes data solely on behalf of a client, VirgoX may direct the individual to the relevant client or assist the client in responding.

14. Cookies and Tracking Technologies

VirgoX may use cookies, pixels, tags, local storage, analytics scripts, and similar technologies.

These technologies may be used to:

Operate the website;
Maintain website security;
Remember preferences;
Understand website traffic;
Analyze visitor interactions;
Measure page performance;
Identify technical errors;
Understand inquiry sources; and
Measure marketing effectiveness where permitted.

Cookies may include:

14.1 Essential Cookies

These support basic website operation, security, form submission, and session functionality.

14.2 Analytics Cookies

These help VirgoX understand how visitors use the website and how website performance may be improved.

14.3 Marketing Cookies

Where enabled and legally permitted, these may help measure advertising or provide relevant follow-up marketing.

Where required, non-essential cookies will not be used until the visitor has provided the required consent.

Users may control cookies through browser settings or any cookie-consent controls available on the VirgoX website.

15. Data Retention

VirgoX retains personal data only for as long as reasonably necessary for the relevant purpose, subject to legal, contractual, accounting, tax, security, and dispute-resolution obligations.

Retention periods may depend on:

The nature of the information;
The purpose for which it was collected;
The duration of the client relationship;
Client instructions;
Contractual requirements;
Applicable legal requirements;
Limitation periods;
Security considerations;
Backup schedules; and
Whether a dispute is pending or reasonably anticipated.

Prospective-client inquiry records may be retained for reasonable follow-up and business-development purposes unless the individual objects or requests deletion.

Client project records, agreements, approvals, invoices, project communications, system documentation, and support records may be retained during the relationship and for a reasonable period afterward.

Personal data held within a third-party platform may remain subject to that provider’s backup, deletion, retention, and account-closure processes.

VirgoX may retain anonymized information that can no longer reasonably identify an individual.

16. International Data Transfers

VirgoX is based in Sri Lanka and may work with international clients and service providers.

Personal data may therefore be transferred to, stored in, accessed from, or processed in countries other than the country in which the individual is located.

Where required, VirgoX will use reasonable safeguards for cross-border processing, which may include:

Contractual data-protection provisions;
Appropriate processor or subprocessor agreements;
Access controls;
Security measures;
Reputable service providers;
Client-approved transfer arrangements;
Recognized contractual transfer mechanisms where applicable; and
Other safeguards permitted by relevant law.

Clients are responsible for identifying any jurisdiction-specific transfer requirements that apply to the data they control, including any additional notices, assessments, contractual clauses, or consent requirements.

17. Post-Deployment Support and Data Access

VirgoX provides an initial 30-day complimentary post-deployment support period, beginning on the production launch date unless a signed Service Agreement specifies another date.

This initial support period may include a defined allowance of support hours or tasks stated in the applicable Service Agreement, proposal, order form, or Service Terms.

The complimentary support period does not include:

Unlimited support;
New systems;
Major workflow changes;
Additional integrations;
New AI agents;
Full redesigns;
Changes to the client’s underlying business model;
Additional service categories;
Out-of-scope platform migration;
Third-party subscription fees;
AI usage costs;
Telephony or messaging charges; or
Work outside the agreed support allowance.

During support, VirgoX may access limited information reasonably necessary to diagnose and correct an issue, including:

System settings;
Error logs;
Workflow records;
CRM test records;
Conversation samples;
Call or chat transcripts;
Integration settings;
Screenshots;
Technical reports; and
Client-supplied support information.

After the first 30 days, support is provided through fixed-rate packages containing a predefined number of support hours, or through another written support arrangement.

Rates, included hours, response expectations, and the scope of each package will be stated in the applicable Service Terms, proposal, or support agreement.

18. Confidentiality and Client Privacy

VirgoX treats non-public client information as confidential.

VirgoX will not publicly disclose or use the following without the client’s explicit written consent:

The client’s identity;
The client’s logo;
Private project details;
Customer information;
Lead information;
Screenshots of client systems;
Private performance information;
Revenue or sales information;
Conversion results;
Internal workflows;
Confidential documents;
Recordings or transcripts; or
Client results in a case study, testimonial, portfolio, presentation, advertisement, or promotional publication.

General skills, experience, methods, and non-identifying knowledge gained while performing services may be retained and used by VirgoX, provided this does not reveal client confidential information or personal data.

19. Sensitive Personal Data

Clients must not provide sensitive personal data unless:

It is reasonably necessary for the agreed service;
The processing is lawful;
Appropriate notices and consents are in place;
Adequate safeguards have been implemented; and
VirgoX has expressly agreed to the processing in writing.

Sensitive information may include:

Health information;
Medical information;
Government identification information;
Biometric information;
Financial account information;
Precise location;
Information about children;
Criminal history;
Religious or political information; or
Other legally protected categories.

Standard VirgoX systems are not intended to store payment card details or passwords unless a specific secure integration has been separately agreed.

20. Children’s Privacy

VirgoX provides business-to-business services and does not knowingly direct its website or standard services toward children.

VirgoX does not knowingly collect personal data directly from children without appropriate legal authority, parental authorization, or another valid basis.

A client must not use a VirgoX system to collect information from children unless the client has informed VirgoX, established a lawful basis, and implemented the safeguards required by applicable law.

21. Client Responsibilities

Clients are responsible for:

Maintaining an accurate privacy policy;
Giving required privacy notices;
Obtaining required consent;
Responding to data-subject requests;
Lawfully collecting customer and lead information;
Maintaining accurate contact preferences;
Respecting opt-outs and unsubscribe requests;
Disclosing AI use where required;
Disclosing call recording where required;
Using customer data only for permitted purposes;
Establishing appropriate retention periods;
Controlling staff access;
Securing client accounts;
Reviewing client-selected third-party platforms; and
Ensuring the client’s use of VirgoX services complies with applicable law.

VirgoX is not responsible for a client’s unlawful, misleading, unauthorized, or non-compliant use of a deployed system.

22. Third-Party Websites and Services

The VirgoX website or systems may include links to or integrations with third-party platforms.

VirgoX does not control and is not responsible for the privacy, security, availability, pricing, data practices, or contractual terms of independent third parties.

Users and clients should review the relevant third party’s policies before providing information or enabling an integration.

23. Complaints

Privacy questions or complaints should first be sent to:

Email: anjana@virgoxleads.com
Subject: Privacy Complaint

VirgoX will review the complaint and make reasonable efforts to respond appropriately.

Individuals may also have the right to submit a complaint to the relevant data protection authority where permitted by applicable law.

24. Changes to This Privacy Policy

VirgoX may update this Privacy Policy to reflect:

Changes to services;
Changes to technology;
New integrations;
Changes to legal requirements;
Changes to data practices;
Security improvements; or
Changes to business operations.

The “Last Updated” date will be revised when the Policy changes.

Where a change materially affects existing clients or the processing of their personal data, VirgoX may provide additional notice through email, the website, or normal client communication channels.

Continued use of the website or services after an updated Policy takes effect constitutes acknowledgment of the updated Policy, to the extent permitted by law.

25. Contact Information

Questions, privacy requests, complaints, or concerns may be sent to:

VirgoX Marketing
Founder and Owner: Anjana Kariyawasam
Location: Colombo, Sri Lanka
Website: virgoxleads.com
Email: anjana@virgoxleads.com

For requests relating to personal data, use the subject line:

Privacy Request