§ 01 Introduction
Virtual Performance Tool SRL ("VPT", "we", "us") is committed to protecting your privacy and ensuring your personal data is handled in full compliance with the General Data Protection Regulation (GDPR) and applicable Belgian data protection law. This policy explains what data we collect, how we use it, and what rights you have.
§ 02 Data Controller
Virtual Performance Tool SRL, incorporated under
Belgian law.
Email:
info@virtualperformancetool.com
Company number: BE 0788559520
Registered address: Rue du tir à l'arc 11, 7181 Arquennes, Belgium
For all data protection enquiries, contact us at the email address above.
§ 03 Data We Collect
We collect the following categories of personal data:
- Identity data: first name, last name
- Contact data: email address
- Technical data: IP address (for security monitoring and fraud prevention)
- Authentication data: hashed password, session tokens
- Payment outcome data: subscription status, transaction reference (no raw payment card data — see §7)
- Optional profile data: nickname, Discord ID (provided voluntarily)
- Usage and analytics data: anonymised website usage statistics (via Google Analytics, consent required — see §10)
§ 04 How We Collect Data
We collect data through: (a) registration and account forms when you create an account or subscribe; (b) essential cookies and session tokens required for authentication and maintaining your session; (c) Google Analytics (only with your prior consent) for aggregate website usage statistics.
§ 05 Legal Bases for Processing
We process your data only where a lawful basis exists under GDPR Art. 6:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Account creation and management | Name, email, hashed password | Performance of contract — Art. 6(1)(b) |
| Authentication and session management | IP address, session token | Legitimate interests (security) — Art. 6(1)(f) |
| Payment processing and subscription management | Transaction outcome, subscription status | Performance of contract — Art. 6(1)(b) |
| Security monitoring and fraud prevention | IP address, login activity | Legitimate interests — Art. 6(1)(f) |
| Website analytics | Anonymised usage data (Google Analytics) | Consent — Art. 6(1)(a) |
| Service and account notifications | Email address | Legitimate interests / Consent — Art. 6(1)(a)(f) |
| Optional profile features | Discord ID, nickname | Consent — Art. 6(1)(a) |
§ 06 How We Use Your Data
We use your data to: identify and authenticate users; provide and personalise the VPT service; manage your subscription; monitor account security and prevent fraud; improve our website and services (analytics); and send important service or account notifications.
§ 07 Data Sharing and Processors
We do not sell your personal data. We share data only with the following categories of processors, each bound by data processing agreements compliant with GDPR:
- 2Checkout (Verifone): payment processing. We do not receive or store raw payment card data — only the transaction outcome and subscription status.
- Apple Inc. / Apple Pay: in-app payment processing on iOS and macOS. Governed by Apple's own GDPR-compliant data practices.
- Hosting and infrastructure providers: for storing and serving the application and user data, within or adequately protected outside the EEA.
- Google LLC (Google Analytics): anonymised website usage analytics, only when you have given consent (see §10).
No other third parties receive your personal data.
§ 08 Data Retention
We retain your data for the following periods:
- Account data (name, email, profile): retained while your account is active, plus 2 years after account deletion to handle any residual legal claims.
- Payment and billing records: 7 years from the transaction date, as required by Belgian accounting law (Loi du 17 juillet 1975).
- Security and access logs: 6 months on a rolling basis.
- Consent records: for the duration of the consent and 3 years thereafter, to demonstrate compliance.
After the applicable retention period, data is securely deleted or irreversibly anonymised.
§ 09 Data Security
We protect your data using: bcrypt hashing for passwords; HTTPS/TLS for all data in transit; access controls limiting data access to authorised personnel only; and regular security reviews. If you suspect unauthorised access to your account, contact info@virtualperformancetool.com immediately.
§ 10 Cookies and Analytics
Essential cookies
We use strictly necessary cookies to maintain your authenticated session and manage your subscription state. These do not require consent as they are essential to the service you have requested.
Google Analytics (consent required)
We use Google Analytics to measure website usage and improve our services. Google Analytics collects anonymised data about pages visited, time spent, and traffic sources. This involves cookies and the transfer of data to Google LLC (United States) under the EU–US Data Privacy Framework.
Google Analytics is only activated with your explicit consent, collected via the cookie consent banner on your first visit. You may withdraw consent at any time by clearing your cookies or adjusting browser settings. Without consent, no analytics data is collected or transmitted. For Google's privacy practices see policies.google.com/privacy.
§ 11 Your Rights Under GDPR
Under the GDPR you have the right to: access your personal data; rectify inaccurate data; erasure ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; and rights related to automated decision-making.
To exercise any of these rights, contact info@virtualperformancetool.com. To change your email address, identity verification using your registered email is required. We will respond within 30 days.
You have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit): autoriteprotectiondonnees.be.
§ 12 International Data Transfers
Some processors (Google LLC, Apple Inc., 2Checkout/Verifone) are based in the United States. Transfers to the United States are made under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) or, where applicable, under Standard Contractual Clauses approved by the European Commission. We do not transfer data to countries without adequate protection unless covered by such safeguards.
§ 13 Children's Privacy
VPT is not directed at children. In accordance with Belgian law implementing GDPR, users must be at least 16 years of age to create an account. If a user is under 16, parental or guardian consent is required. We do not knowingly collect data from children under 16. If you believe a child has registered without consent, contact us immediately.
§ 14 Changes to This Policy
We may update this Privacy Policy at any time. Changes are posted on this page with an updated effective date. For significant changes, registered users will be notified via in-app or email notification.
§ 15 Contact Us
Virtual Performance Tool SRL
Email:
info@virtualperformancetool.com
Belgian Data Protection Authority:
autoriteprotectiondonnees.be