Privacy policy
1. Data controller
In accordance with article 13 of Regulation (EU) 2016/679 (hereinafter, the "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the "LOPDGDD"), the User is informed that the data controller for the personal data collected through https://simufy.com is:
| Company name | SAPRO TRADING, S.L. ("SIMUFY") |
| Tax ID (NIF) | B67553040 |
| Registered office | Ctra. BV-2131 Km. 7,2, 08787 Orpí, Barcelona, Spain |
| Commercial Registry | Barcelona, volume 47166, folio 110, sheet 543317 |
| General email | info@simufy.com |
| Privacy email | privacidad@simufy.com |
| Telephone | +34 93 131 06 62 |
| Data Protection Officer | SIMUFY has not appointed a DPO, as none of the mandatory cases under art. 37 GDPR and art. 34 LOPDGDD applies. Privacy enquiries: privacidad@simufy.com |
2. Group of undertakings
SAPRO TRADING, S.L. forms part of a group of undertakings within the meaning of article 4.19 of the GDPR. In accordance with Recital 48 of the GDPR, SIMUFY may transmit personal data to group companies for internal administrative purposes (centralisation of services, accounting, treasury, audit, shared technology infrastructure, fraud prevention), on the basis of the group's legitimate interest (art. 6.1.f GDPR). These transmissions are governed by intra-group agreements in accordance with arts. 26 and 28 of the GDPR.
SIMUFY will not use the User's data for direct marketing by other group companies engaged in different activities, unless the data subject has given express and specific consent.
The User may object to these transmissions at any time by exercising the right to object under art. 21 GDPR, by email to privacidad@simufy.com.
3. Purposes of processing, legal bases and retention periods
SIMUFY processes the User's personal data for the following purposes:
| Purpose | Legal basis | Retention period |
|---|---|---|
| Management of online sales, delivery, invoicing and performance of the contract. | Art. 6.1.b GDPR — Performance of the contract. Art. 6.1.c GDPR — Legal tax and accounting obligations. |
Contractual relationship + 6 years (art. 30 of the Spanish Commercial Code (CCom) / art. 66 of the General Tax Law (LGT)) + blocking until the limitation period for actions expires. |
| Management of business customers (B2B) and commercial relationships. | Art. 6.1.b GDPR — Performance of the contract. Art. 6.1.f GDPR — Legitimate interest. |
Relationship + 6 years (art. 30 CCom) + blocking until the limitation period for applicable contractual actions expires (art. 1964 Civil Code / art. 943 CCom). |
| Management of pre-orders: tracking of the agreed ETA and status communications. | Art. 6.1.b GDPR — Performance of the contract. | For the duration of the pre-order + limitation periods for contractual actions. |
| Customer service, after-sales service, handling of incidents, complaints and claims. | Art. 6.1.b GDPR — Performance of the contract. Art. 6.1.c GDPR — Legal obligations. Art. 6.1.f GDPR — Legitimate interest. |
5 years after the case is resolved (art. 124 TRLGDCU). |
| Management of guarantees, repairs and the official Fanatec OOW service. | Art. 6.1.b GDPR — Performance of the contract. Art. 6.1.c GDPR — Legal obligations under the TRLGDCU. |
For the applicable guarantee period + 5 years thereafter. |
| Management of returns and withdrawals, including application of the diminished value policy. | Art. 6.1.b and 6.1.c GDPR. Art. 6.1.f GDPR — Legitimate interest in fraud prevention. |
1 year (photographic/video documentation) or 5 years if a claim arises. |
| Sending commercial communications (newsletter, offers, news) about hardware and software for sports and driving simulation. | Art. 6.1.a GDPR — Consent. Art. 21.2 LSSI — Existing customers, regarding similar products. |
Until consent is withdrawn or after 24 months of inactivity. |
| Personalised online advertising and retargeting through third-party pixels (Meta, Google, TikTok, Pinterest). | Art. 6.1.a GDPR — Specific consent (cookie banner). | Maximum 13 months (advertising cookies). |
| Web analytics and optimisation of the user experience. | Art. 6.1.a GDPR — Specific consent (analytics cookies). | Maximum 13 months (Spanish Data Protection Agency (AEPD) criterion). |
| Management of the User account and access security. | Art. 6.1.b GDPR — Performance of the contract. | Until deletion is requested or the account is closed due to inactivity. |
| Fraud prevention, verification of transactions and protection of company assets. | Art. 6.1.f GDPR — Legitimate interest (Recital 47 GDPR). | 5 years after the case is closed. |
| Management of intermediation with financing providers (Klarna, Aplazame) at the User's request. | Art. 6.1.b GDPR — Performance of the contract requested by the User. | For the duration of the transaction and subsequent statutory periods. |
| Booking of sales appointments (Calendly) and pre-sales assistance. | Art. 6.1.b GDPR — Pre-contractual measures. | Up to 12 months after the appointment or until transfer to a customer record. |
| Defence against claims and judicial or administrative proceedings. | Art. 6.1.f GDPR — Legitimate interest. | Until a final decision + applicable limitation periods. |
4. Categories of personal data processed
Depending on the purpose, SIMUFY may process the following categories:
- Identification data: first name, surname, DNI/NIE (Spanish ID/foreigner ID number) where legally required.
- Contact data: email address, telephone, shipping and billing address.
- Professional data (B2B customers): company, position, NIF/CIF (tax ID), professional contact details.
- Transaction data: order history, products, amounts, dates, payment methods.
- Financial data: strictly necessary bank details (account for bank transfer, last 4 digits of the card). Full card details are processed directly by the payment gateways (Shopify Payments, Stripe, PayPal) without SIMUFY having access to them. Credit assessment for deferred payments is carried out by the financial institution as an independent controller.
- Account data: username, password (stored as a hash), preferences.
- Browsing and technical data: IP address, device identifier, browser, operating system, cookies, behaviour on the Website.
- Interaction data: opens and clicks on commercial communications, interactions with adverts.
- Content of communications: emails, tickets, chats with customer service.
- Images and videos arising from the receipt of returns, for the purpose of verifying their contents.
SIMUFY does not routinely process special categories of data (art. 9 GDPR). Should such data occasionally be provided, it will be processed on a specific legal basis and with enhanced security measures.
5. Source of the data
Personal data is usually provided by the User directly through the Website (registration forms, checkout, newsletter, contact, appointment bookings) or in subsequent communications. Some professional contact data may be obtained from publicly accessible sources (LinkedIn, corporate websites) exclusively for B2B prospecting activities, in accordance with Recital 47 GDPR.
6. Recipients of the data and processors
In order to provide its services, SIMUFY discloses personal data to the following recipients, with whom it has entered into the agreements required by art. 28 GDPR:
| Recipient / Processor | Purpose | Location |
|---|---|---|
| Shopify Inc. | E-commerce platform and Website management. | USA (DPF) |
| Odoo S.A. / Eticco | Internal ERP/CRM system. | Belgium / Spain (EU) |
| Shopify Payments / Stripe / PayPal | Payment gateway. Full payment details are processed directly by these gateways without access by SIMUFY. | USA / Ireland (DPF / SCCs) |
| Klarna Bank AB | Deferred payment at the User's request. SIMUFY acts as an independent controller in respect of the data transmitted. | Sweden (EU) |
| Aplazame, S.L. | Deferred payment at the User's request. SIMUFY acts as an independent controller in respect of the data transmitted. | Spain (EU) |
| GLS, UPS, DHL, SEUR and international carriers | Delivery of purchased products. | Spain / EU / international |
| Google Ireland Ltd. / Google LLC | Web analytics (Google Analytics), advertising (Google Ads), infrastructure (Gmail / Workspace). | Ireland / USA (DPF) |
| Meta Platforms Ireland Ltd. | Online advertising and tracking pixel (Facebook/Instagram). | Ireland / USA (DPF) |
| TikTok Technology Ltd. | Online advertising and tracking pixel. Transfer based on Standard Contractual Clauses (SCCs) (TikTok is not certified under the EU-US DPF). | Ireland / Singapore / USA (SCCs) |
| Pinterest Europe Ltd. | Online advertising and tracking pixel. | Ireland / USA (DPF) |
| Klaviyo Inc. | Newsletter delivery, marketing automation and abandoned basket recovery. | USA (DPF) |
| Calendly Inc. | Online booking of sales appointments. | USA (DPF / SCCs) |
| Manufacturers and distributed brands (Fanatec, Simucube, Simagic, Moza, Trak Racer and others) | Management of guarantees, repairs and official service. | EU / international depending on the manufacturer |
| External accounting and tax advisers | Compliance with accounting, tax and corporate obligations. | Spain (EU) |
| Companies of the Vilvaq business group | Internal corporate services (Recital 48 GDPR). | Spain (EU) |
| Competent public administrations and authorities | Compliance with legal obligations (Spanish Tax Agency (AEAT), Social Security (TGSS), law enforcement agencies where appropriate). | Spain (EU) |
SIMUFY does not disclose data to any third parties other than those listed above, except where required by law or with the data subject's express consent.
7. International data transfers
Some processors have their headquarters or infrastructure outside the European Economic Area (EEA). Such transfers are legitimised by:
- EU-US Data Privacy Framework (DPF): adequacy decision of the European Commission of 10 July 2023, applicable to certified entities (Shopify, Google, Meta, Calendly, among others).
- Standard Contractual Clauses (SCCs): approved by Decision (EU) 2021/914, applicable where the entity is not certified under the DPF. In particular, transfers to TikTok Technology Ltd. are based exclusively on SCCs, since TikTok is not certified under the EU-US DPF and is subject to specific oversight by the European Data Protection Board.
- Other appropriate safeguards provided for in arts. 46 and 49 of the GDPR.
The User may request detailed information on the mechanism applicable to each transfer by email to privacidad@simufy.com.
8. Automated decision-making and profiling
SIMUFY uses tools involving profiling or automated decision-making in the following cases:
- Marketing and online advertising segmentation based on browsing and behavioural data. This does not produce significant legal effects. It is based on the consent given through the cookie banner.
- Automated fraud detection system in the purchase process (Shopify Fraud Protect). High-risk orders are reviewed manually by SIMUFY staff, ensuring human intervention in all cases.
- Credit scoring carried out by Klarna and Aplazame when the User requests deferred payment. Such scoring is carried out by the financial institution as an independent controller. SIMUFY acts as an independent controller in respect of the data it transmits to those entities for the intermediation requested by the User; the User may exercise their rights before SIMUFY in relation to that transmission and directly before the financial institution in respect of the scoring. The User has the right to obtain human intervention and to contest the decision before the financial institution.
9. User rights
The User may at any time exercise the following rights recognised by the GDPR and the LOPDGDD:
- Access: obtain confirmation as to whether SIMUFY processes their data and access such data.
- Rectification: request the correction of inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request the deletion of their data when it is no longer necessary or consent is withdrawn (art. 17 GDPR).
- Restriction of processing: request that processing be restricted in the cases provided for in art. 18 GDPR.
- Portability: receive their data in a structured format or request its transmission to another controller.
- Objection: object to processing based on legitimate interest or to processing for direct marketing purposes.
- Withdrawal of consent: withdraw consent given at any time, without retroactive effect.
- Not to be subject to automated decisions: a right recognised in art. 22 GDPR, including the right to obtain human intervention.
- Complaint to the AEPD: lodge a complaint with the Spanish Data Protection Agency.
10. How to exercise your rights
The User may exercise the above rights by email to privacidad@simufy.com or by post to SAPRO TRADING, S.L. — Ref. Privacy — Ctra. BV-2131 Km. 7,2, 08787 Orpí, Barcelona, Spain.
Exercising these rights is free of charge, except for manifestly unfounded or excessive requests (art. 12.5 GDPR). SIMUFY will respond within a maximum of one (1) month, which may be extended by up to two (2) further months in complex cases (art. 12.3 GDPR).
11. Complaint to the AEPD
If the User considers that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Postal address: C/ Jorge Juan, 6, 28001 Madrid
- Telephone: 900 293 183
- Electronic office: https://sedeagpd.gob.es/sede-electronica-web/
- Website: https://www.aepd.es
12. Security measures
SIMUFY applies appropriate technical and organisational measures in accordance with article 32 of the GDPR, including, among others:
- Encryption in transit (HTTPS/TLS) for all Website communications.
- Encryption at rest for systems holding sensitive data.
- Role-based access control and the principle of least privilege.
- Two-factor authentication for administrative access.
- Regular, encrypted and verified backups.
- Logging of critical activities.
- Regular training of staff with access to data.
In the event of a security breach likely to result in a high risk to the User's rights, SIMUFY will notify the AEPD within a maximum of 72 hours and the affected User where appropriate (arts. 33 and 34 GDPR).
13. Minors
The Website's services are intended for persons of legal age (18 years). SIMUFY does not knowingly collect personal data from children under 14. If a minor aged between 14 and 18 has provided data without the authorisation of their legal representatives, the latter may contact privacidad@simufy.com to request immediate deletion.
14. Cookies
The use of cookies and similar technologies is governed by the Cookie Policy.
15. Amendments to the Privacy Policy
SIMUFY may amend this Policy to adapt it to legislative or case-law developments, changes in its operations or recommendations of the AEPD. Substantial amendments affecting the User's rights will be communicated to Users with a registered account by email at least 15 days before they come into force.
16. Applicable legislation
This Policy is governed by Spanish law and by applicable European Union legislation, in particular the GDPR and the LOPDGDD. Disputes relating to data processing shall be resolved by the Courts and Tribunals of the Consumer User's place of residence or, in the case of non-consumer Users, by those of the city of Barcelona.
Last updated: 1 May 2026. Version 3.0.