Privacy policy of the Virtua app
Last updated: 6 November 2026
This policy explains how Virtua Arcade SL processes the personal data of people who use the “Virtua” loyalty app. It is separate from the website privacy policy: this one covers the app only.
1. Who is the controller
- Company name: Virtua Arcade SL
- CIF: B67229500
- Registered office: C/Joan Gamper 16, Local 1, 08014 Barcelona
- Email: info@virtuabarcelona.com
- Telephone: +34 938 06 57 57
2. What data we process
| Category | What it is | When |
|---|---|---|
| Identification and contact | Email address and, optionally, name and telephone number. If you sign in with Google, Google also gives us your name, which is stored in your sign-in account. Google also sends the link to your profile photo, but we do not store it. | When you register, when you sign in with Google and when you complete your profile. |
| Account identifier | An internal identifier that the app assigns to you so that it can recognise you between visits. On its own, it tells nothing about you. | When the account is created. |
| Birthdays | The day and month of your birthday. We do not store the year of birth. We use it for the birthday gift. | Optional. It is not needed for the welcome gift; without it you can use the app just the same and you only miss out on the birthday gift. |
| Confirmation that you are of legal age | The “I am over 18 years old” box, with the date and time at which you ticked it. | When the account is created (it is mandatory). |
| Loyalty activity | Visits recorded when you scan the QR code at our venue, points, rewards and vouchers obtained, adventures marked as played, and referrals. | Through normal use of the app. |
| Purchases and bookings from the website | The bookings and vouchers you have made or bought on our website, linked by your email address, so that we can show them to you in the app. | If you use the same email address on the website and in the app. |
| Company invoice details | Company name, NIF and tax address. | Only if, when booking a team building session from the “Book” tab, you tick “I want an invoice”. |
| Your device identifier | The identifier (token) that allows push notifications to be sent to you, and your notification preferences. | If you turn on notifications. |
We do not process special categories of data (health, ideology and the like) and we do not collect your location, either in the foreground or in the background. The camera is used only with your permission and only to scan the QR code of your visit: we do not record images or audio.
About the year of birth. Since 6 November 2026 we no longer store it: the current version of the app only asks for the day and month, and any year given before then has been replaced by a fictitious one. If you are still using version 1.0.0, which asks for the full date, please update the app: until you do, the year you enter may be stored until our next clean-up. And some backups made before 6 November keep the old years until they are destroyed, after 6 months at most (section 7).
3. What we use the data for
| What for | Legal basis (GDPR) |
|---|---|
| To create and manage your account and the loyalty programme: counting visits, awarding points and giving out rewards. | Performance of our relationship with you (art. 6.1.b). |
| To notify you of your rewards, vouchers and their expiry, by notification or by service email. | Performance of the relationship, and your consent when you turn on notifications. |
| The welcome and birthday gifts. | Your consent: that is why the birthday is optional (without it you can use the app just the same: the welcome gift does not need it and you only miss out on the birthday one). |
| Commercial communications: offers and news. | Your specific consent, which you can withdraw whenever you wish. |
| To show you in the app the bookings and vouchers you bought on the website. | Performance of our relationship with you. |
4. Who processes your data on our behalf
We do not sell your data. In order to provide you with the service, we rely on providers who act as data processors, under contract and with appropriate safeguards. They do not process your data for their own purposes:
- Supabase — the app account, the cross-matching of your website bookings by email address, and the booking schedule (the room, the time slot and the contact details of the person booking: name, email address and telephone number).
- Expo — sending push notifications.
- Firebase (Google) — delivery of those notifications on Android.
- Apple — delivery of those notifications on iPhone.
- Cloudflare — backups, stored in the European Union.
- n8n — calculating the price, the booking and voucher emails, and creating the app vouchers (welcome, rewards, birthday and referrals) together with their email.
- Airtable — the record of bookings, vouchers and codes, including the app vouchers.
- Zoho — sending service emails.
The last three appear because the “Book” tab of the app is our website booking system: if you book from the app, your booking follows the same path as if you made it on virtuabarcelona.com. In addition, n8n and Airtable create and record the app vouchers (welcome, rewards, birthday and referrals) even if you never open “Book”.
And one that processes them on its own account as well: Stripe, which collects payment when you book or buy a voucher from the app: it receives your name, your email address and your telephone number and the purchase details (and, if you ask for a company invoice, also the details of that invoice: company name, NIF and tax address). It processes the payment data as an independent controller, in order to comply with banking regulations and prevent fraud, under its own privacy policy. It is the only one with whom we share data.
We may also disclose data to the competent authorities when there is a legal obligation.
5. Where some of your data comes from
Not everything we process is given to us by you directly in the app:
- Google — if you sign in with “Sign in with Google”, Google provides us with your email address and your name; it also sends the link to your profile photo, but we do not store it. To sign in, we do not send any data to Google: we receive it. (If you turn on notifications on Android, it is Firebase, from Google, that delivers them to you: we explain this in section 4.)
- Apple — if you sign in with “Sign in with Apple”, Apple provides us with your name and your email address, or the relay email address that Apple generates if you choose to hide yours. To sign in, we do not send any data to Apple: we receive it. (If you turn on notifications on an iPhone, it is Apple that delivers them to you: we explain this in section 4.)
- App Store and Google Play — downloading and installing the app is handled by the stores, which process that data on their own account and under their own privacy policies, not ours.
6. International transfers
Some of the providers in section 4 may process data on servers outside the European Economic Area, for example in the United States. This is the case for Firebase (Google), Apple, Supabase, Stripe and Expo.
In those cases, the transfers are covered by the safeguards provided for by the GDPR: standard contractual clauses of the European Commission or other valid mechanisms.
Zoho, our email provider, may provide technical support using staff of its group companies in India, Mexico and Colombia.
7. How long we keep your data
We keep your data for as long as your account is active and it is needed for the loyalty programme. If you delete your account, we delete your personal data from the app: how to do so is explained in section 8.
We keep, blocked, what a law requires us to keep: the invoicing of your purchases, 6 years (article 30 of the Commercial Code (Código de Comercio)).
And there is something that is not deleted with your app account: the bookings and vouchers that you have made or bought, with your name, email address and telephone number, which are held in our booking register (the same one the website uses). We keep them while the booking or voucher is valid and, afterwards, for 6 years, the period set by law for keeping the documentation of our business activity (article 30 of the Commercial Code, Código de Comercio), which also covers the general period for bringing claims (article 1964 of the Civil Code (Código Civil)), only to comply with that obligation and to be able to handle claims. Once that period has passed, they are deleted.
For security, and so as not to lose the service if something fails, we make backups of our systems, kept in the European Union. If you ask us to delete your data, it disappears immediately from the database we use; in the backups it stays blocked —nobody uses it— until it is destroyed, after 6 months at the most. And if we ever had to restore a backup, before putting the system back into operation we would delete again the data of anyone who had asked us to.
8. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent whenever you wish:
- Delete your account and all your data: from within the app itself, at Perfil → Borrar mi cuenta (Profile → Delete my account). Deletion is permanent and immediate. If you cannot get into the app, we explain the other way in how to delete your account and your data.
- Delete only some of your data and keep your account (for example, your telephone number or your birthday): write to us from the email address of your account, saying what you want deleted. You can also remove your telephone number yourself from the “Yo” tab.
- Any other right or question: write to us.
If you believe we have not properly handled your rights, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Minimum age
The app is intended for people over 18 years of age. When you register, you confirm that you meet that age requirement by ticking the box “I am over 18 years old”, and we keep that confirmation with its date and time. If we detect the account of a minor, we will delete it.
10. Security
We apply reasonable technical and organisational measures to protect your data: encryption in transit, access control and database-level security rules. No system is one hundred per cent infallible, but we work to reduce the risk to a minimum.
11. Changes to this policy
We may update this policy to reflect legal or service changes. We will always publish the current version at this same address, with its update date at the top.
12. Contact
For any privacy question about the app: info@virtuabarcelona.com.