I think you can and my colleage thinks you cannot!
Your colleague is right. You can't declare private virtual methods because there's no point (since there'd be no way to override them)...
But you can override protected virtual methods.