Privacy policy

Last updated: 14 November 2026

This policy explains what personal data we process when you use virtuabarcelona.com, what we use it for, on what legal basis, who helps us process it and how you can exercise your rights. It is written to be understood, not to be long.

1. Controller

• Controller: Virtua Arcade SL
• CIF: B67229500
• Registered office: C/Joan Gamper 16, Local 1, 08014 Barcelona
• Email: info@virtuabarcelona.com
• Telephone: +34 938 06 57 57
• Registration: Barcelona Commercial Registry, Volume 46,443, Folio 110, Sheet B-520,184, Entry 1

The full identification details are also in the legal notice.

2. What data we process

We do not process special categories of data (health, ideology, origin…) and we do not ask you for any. We do not sell your data to anyone.

And what you write to us through those two forms is not stored in any database: it lives in the email that reaches us, and nothing more.

3. Why and on what legal basis

4. Who processes your data on our behalf

To be able to provide you with the service we rely on providers that act as processors, with a contract and adequate safeguards. They do not process your data for their own purposes:

• n8n — calculating the price, sending the booking and voucher emails, the Team Building quote form, the contact and events forms on the website, WhatsApp support and the notice about your photos (section 8).
• Airtable — record of bookings, vouchers and codes.
• Supabase — the Virtua app account and its link to your website bookings, and the database of our internal diary (WhatsApp enquiries and, since 27 October 2026, the room, the time and the contact details of the person booking: name, email and phone number).
• Zoho — sending service emails (confirmations, payment links, reminders and notices) and our email service.
• Brevo — sending offers and news, only if you have accepted them.
• Google Analytics — measuring how the website is used, only if you accept.
• Cloudflare — the website server, the proof of your decision about cookies, backups, the photos and videos of your game (section 8), and receiving and monitoring WhatsApp messages.
• WhatsApp (by Meta) — messaging, if you write to us on WhatsApp.
• Anthropic — the artificial intelligence assistant that prepares draft WhatsApp replies (with servers in the USA).

And three that process them on their own account as well. Stripe, the payment gateway for bookings and gift vouchers: it receives your name, your email and your phone number and the purchase details (and, if you request a company invoice, the details for that invoice too). It processes the payment data as an independent controller, to comply with banking regulations and prevent fraud, under its own privacy policy. Only if you have accepted measurement or advertising, the Google Analytics visitor identifier or the identifier of the Google ad click you arrived from also travels to Stripe with your purchase, so that we can know which ad led to that purchase; without your permission, none of that travels.

And Google Ads, only if you accept advertising: knowing whether an ad leads to a booking and showing you ads based on your browsing. If you accepted advertising when buying, we also tell it which purchases come from one of its ads —the click identifier, the date and time, the amount and an order code that is not the payment code— so that it can measure the ad; if you want us to delete it from your purchase, write to us at info@virtuabarcelona.com. It processes that data as an independent controller, also to measure and improve its ads, under its own privacy policy.

And Meta (Facebook and Instagram), only if you accept advertising: knowing whether one of its ads leads to a booking and showing you ads. We collect that data on this website and send it to Meta as joint controllers with Meta, in accordance with the joint controllership addendum to its commercial terms (Meta Controller Addendum); after that, Meta processes it as an independent controller, under its own privacy policy.

We may also disclose data to the competent authorities where there is a legal obligation.

5. Technical providers that receive your IP

When your browser requests a resource from an external provider —an image, a video, a code library—, that provider receives your IP address, because that is how a request on the internet works. In serving that resource they are not processors: they do not store your data on our behalf (Cloudflare is also a processor, but for the purposes described in section 4).

• Cloudflare — server, content delivery network, video playback and site analytics without cookies; it keeps its technical logs for the period set by its own policy.
• Google / YouTube — the videos of the Arcade games, in cookie-free mode.
• Trustindex — the Google and Tripadvisor reviews widget; the profile photos of those who wrote the reviews are requested from Google and Tripadvisor. It is only loaded if you give your consent.

The detail of what each one stores in your browser is in the cookie policy.

6. The relationship with the Virtua app

If you use the Virtua app, your website bookings and vouchers are linked to your app account through your email address, so that you can see them there and for the loyalty programme.

And it also works backwards: if you register in the app with an email address you had already used to book on the website, those earlier bookings are linked to your account. If you do not use the app, this does not affect you: the data stays unlinked.

7. Support via WhatsApp

If you write to us on WhatsApp, Virtua Arcade SL processes your phone number, your profile name and the content of the conversation (including the data you give us in it, such as the date, the number of players or your email address) in order to handle your enquiry and, if you wish, help you prepare your booking. The legal basis is the application of pre-contractual measures at your request and, where applicable, performance of the contract (art. 6.1.b of the GDPR), as well as our legitimate interest in replying to the people who contact us (art. 6.1.f).

To handle your enquiry we use an artificial intelligence assistant that prepares draft replies. No reply is sent without a member of our team reviewing it first, and we do not take automated decisions that produce legal effects concerning you. You can ask us at any time to speak to a person.

We keep the conversation in our customer support system and in our internal diary (used by our team to manage enquiries) for a maximum of 8 days after the last message. Technical system error logs, which may contain fragments of the conversation, are kept for up to 30 days; booking data is kept as set out in this policy. To improve the service, we store, in fully anonymised form, the corrections our team makes to the assistant's drafts for a maximum of 90 days.

To provide this service we rely on providers that act as data processors: Meta (WhatsApp), for messaging; Anthropic, for the artificial intelligence assistant (with servers in the US); n8n, for automating the process; Cloudflare, for receiving and monitoring messages (it keeps a technical copy for a maximum of 2 hours); Supabase, for hosting the database of our internal diary; and, when a booking is confirmed, the providers listed in section 4 of this policy. International data transfers are carried out under the EU-US Data Privacy Framework for providers that have joined it and, in any case, through Standard Contractual Clauses approved by the European Commission.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@virtuabarcelona.com, and lodge a complaint with the Agencia Española de Protección de Datos (aepd.es).

8. The photos and videos of your game

During your game, our team may take photos and videos of the group to give them to you as a keepsake. We process them for that purpose: to hand them over to you. The legal basis is performance of the contract (art. 6.1.b of the GDPR), because it is part of the service. We do not use for advertising any image in which you can be recognised without asking your permission first.

This is how it works: our team uploads the photos and videos to a private store in the European Union (Cloudflare), linked to your booking code and not to your name. We send you an email with a link to a page of ours where you can view and download them. That link expires after 30 days, and anyone who has it can see the photos: if you forward it, think about who you are giving it to.

In that email we ask you, without obliging you, for a Google review: you do not need to leave one to receive your photos. If you press the button, we record, against your booking code, that you have pressed it, only so that we know when to send you the photos; we do not know what you write on Google or whether you end up publishing it. And, if you do not press it, we send them to you as well, after a few days.

We keep the photos and videos for 30 days from when we hand them over to you (automatic deletion runs every day, so it may take a couple of days longer); anything that is never handed over is deleted after 45 days. For this we rely on the processors listed in section 4: Cloudflare (the store and the page), Zoho (the email with the link) and n8n (the notification). If you want us to delete yours sooner, or to exercise any of your rights, write to us at info@virtuabarcelona.com (section 11).

9. International transfers

Some of these providers may process data on servers outside the European Economic Area (for example, in the US). In those cases, transfers are covered by the safeguards provided for in the GDPR (standard contractual clauses of the European Commission or other valid mechanisms). Section 7 gives the details for the WhatsApp support service. Zoho, our email provider, may provide technical support using staff from its group companies in India, Mexico and Colombia.

10. How long we keep your data

We keep your data for as long as it is necessary for the purpose for which we collected it, and at most:

• Bookings and vouchers: for as long as the booking or voucher is valid and, afterwards, 6 years, the period set by law for keeping the documentation of our business activity (article 30 of the Código de Comercio), which also covers the general period for bringing claims (5 years, article 1964 of the Código Civil).
• Invoicing: 6 years, as required by article 30 of the Código de Comercio.
• Team Building quotes and contact or event requests: for the time it takes to deal with them and, if they do not end in a booking, 1 year.
• Commercial communications: until you withdraw your consent or object, or after 3 years without any interaction with them.
• The proof of your decision about cookies: 3 years; after that it is deleted automatically.
• Measurement and advertising: the cookies, as stated in the cookie policy (13 months for Google's, 90 days for Meta's), and they are deleted as soon as you withdraw your “yes”; the data measured, for a maximum of 14 months in Google Analytics.
• WhatsApp conversations: up to 8 days after the last message; technical error logs, up to 30 days; and our team's corrections to the drafts, anonymised, up to 90 days (section 7).
• The emails you write to us: while we deal with your enquiry; if there is a booking, a purchase, an invoice or a claim behind it, up to 5 years from the last message; if not, we review them once a year and delete those that have gone more than 6 months without activity.
• Photos and videos of your game: 30 days from when we hand them over to you (automatic deletion runs every day, so it may take a couple of days longer); anything that is not handed over, 45 days (section 8).

For security, and so as not to lose the service if something fails, we make backups of our systems, kept in the European Union. If you ask us to delete your data, it disappears immediately from the database we use; in the backups it stays blocked —nobody uses it— until it is destroyed, after 6 months at the most. And if we ever had to restore a backup, before putting the system back into operation we would delete again the data of anyone who had asked us to.

11. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, as well as withdraw your consent where the processing is based on it.

To do so, write to us at info@virtuabarcelona.com, stating which right you want to exercise. We will reply within the time limits set by law.

If you consider that we have not dealt with your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

12. Security

We apply technical and organisational measures to protect your data: the website is always served encrypted, access to the systems is restricted, and payment data is processed directly by Stripe, without passing through us.

13. Changes to this policy

If we change this policy, we will update the last-updated date shown at the top. If the change significantly affects how we process your data, we will let you know using the contact details we hold.