Privacy Policy
Version 1.1.0 — Effective 7 October 2026
This notice describes how we process personal data of users of the SimRacer World ecosystem (the Paddock web app, the SimRacer World APP mobile app, and the SRW RaceBay and SRW Manager desktop applications), under the Swiss Federal Act on Data Protection (FADP) and, where applicable, Regulation (EU) 2016/679 (GDPR).
1. Controller
New Tech Lab SAGL (on behalf of SimRacer World SAGL, in formation) Strada Ponte di Valle, 8 — 6968 Lugano — Switzerland Email: privacy@simracer-world.com
Upon registration of SimRacer World SAGL in the Swiss Commercial Register, controllership may be assumed by the new entity; users will be informed and the rights described here will not be reduced.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account data | email, display name, password (hashed), Google ID if you use Google sign-in | from you |
| Sporting data | lap times, sessions, telemetry (CSV files), car setups, simulator/car/track | generated by use |
| Economic data | credit balance, order and purchase history, marketplace sales | generated by use |
| Technical data | IP address, access logs, app version, operating system | automatic |
| Founder programme list | email, language, date and version of your consent, where you signed up (page, UTM parameters), hash of your IP address (anti-abuse, deleted after one hour) | provided by you and automatic |
| Visit statistics | landing page, where the visit came from (UTM parameters, referring domain), non-reversible hash of your IP address | automatic, cookie-free |
| B2B data | affiliated center, role (driver / operator / admin) | from you or the center |
We do not process special categories of data (health, opinions, biometrics). We do not carry out profiling with legal effects or solely automated decision-making.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and management, authentication (incl. JWT tokens) | performance of contract |
| Leaderboards, lap comparison, statistics | performance of contract |
| Setup marketplace: publication, sale, delivery to buyers | performance of contract |
| Credit management, orders, B2B invoicing | performance of contract / legal obligation |
| Security, abuse and cheating prevention | legitimate interest |
| Service communications (changes to terms, security) | legitimate interest / legal obligation |
| Promotional communications | consent (withdrawable at any time) |
| Founder programme list: signup, confirmation email, communications about the programme and launch updates | consent (withdrawable at any time) |
| Aggregate visit statistics (where visits come from, landing pages), cookie-free | legitimate interest |
4. Retention
- Account and sporting data (laps, telemetry, setups): kept for as long as your account is active. We apply no automatic expiry: telemetry and setups remain available until you request their deletion or delete your account.
- Deletion on request: you may request deletion of individual content or of your entire account at any time (procedure).
- Exception — sold content: if you sold setups or telemetry on the marketplace, the files delivered to buyers and the transaction records are not deleted: they are necessary for the performance of the contract with buyers (Art. 17(3)(b) GDPR) and for the ten-year accounting retention required by Swiss law (Art. 958f CO). If you delete your account, your identity on those records is anonymised.
- Account deletion: requests trigger immediate deactivation (soft delete) with anonymisation of identifying data; final erasure occurs within 30 days, subject to the retention obligations above.
- Technical logs: maximum 12 months.
- Founder programme list: until you withdraw consent and in any case no longer than 24 months from signup.
- Visit statistics: maximum 12 months.
5. Recipients and processors
Data may be processed by providers acting as processors:
- Hosting and infrastructure: application servers and databases (EU/Switzerland)
- Infomaniak (Switzerland): email services
- Google LLC: only if you use Google sign-in (Google OAuth) — receives the authentication confirmation; subject to its own notices
- Apple Inc. / Google LLC: mobile app distribution and in-app purchases where available
- WooCommerce / simracer.ch shop: processing of credit orders
- Brevo (Sendinblue SAS) (France, EU): sending of Founder programme and launch update emails, only to people who gave consent
We do not sell personal data. We do not transfer data outside Switzerland/EU/EEA except to countries with adequate protection or with appropriate safeguards (standard contractual clauses).
6. Simulation centers (B2B)
If you race at a center using SRW Manager, the center operator sees the operational data of your session (driver name, rig, lap times). For data collected on site by the center (e.g. desk bookings), the center acts as an independent controller. Users of other centers see your personal data masked (**Reserved**), except in public leaderboards you take part in.
7. Your rights
You have the right to obtain: access to your data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time.
To exercise them: privacy@simracer-world.com or, for account deletion, the self-service procedure.
You also have the right to lodge a complaint with a supervisory authority: in Switzerland the FDPIC (Federal Data Protection and Information Commissioner); in the EU your national authority.
8. Security
We apply appropriate technical and organisational measures: expiring JWT token authentication, encryption of stored credentials, HTTPS/TLS transmission, role-based access control, backups. No system is 100% secure: in the event of a breach posing a high risk to your rights we will inform you as required by law.
9. Minors
The services are not intended for children under 16 without the consent of a person with parental responsibility. If you believe a minor has provided us data without consent, contact us.
10. Changes
Material changes to this notice will be notified in-app or by email, with a request for renewed acknowledgement. The current version is always published on this page, with version number and effective date.
Related documents: Terms of Service · Cookie Policy · EULA · Account deletion