Privacy Policy
1. Name and Address of the Controller
realvirtual GmbH
Finkenweg 36-38
D 76547 Sinzheim, Germany
Phone: +49 7221 7028510
Email: info@realvirtual.io
Managing Director: Dr. Thomas Strigl
2. Name and Address of the Data Protection Officer
Dr. Thomas Strigl
realvirtual GmbH
Finkenweg 36-38
D 76547 Sinzheim, Germany
Phone: +49 7221 7028510
Email: info@realvirtual.io
3. General Information on Data Processing
3.1 Scope of Processing of Personal Data
We collect and use personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The collection and use of personal data of our users takes place regularly only with the consent of the user. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of data is permitted by law.
3.2 Legal Basis for Processing of Personal Data
Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the performance of pre-contractual measures.
Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, fundamental rights and freedoms of the data subject do not override such interests, Art. 6(1)(f) GDPR serves as the legal basis for processing.
3.3 Data Deletion and Storage Duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.
4. Newsletter
We send newsletters via the service provider Newsletter2Go (Sendinblue). For sending the newsletter, we collect the following data: first name, last name, and email address. Registration is done via a double opt-in procedure. You can unsubscribe from the newsletter at any time. An unsubscribe link is included in every newsletter. The legal basis for sending the newsletter is Art. 6(1)(a) GDPR (consent). The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected, i.e., when the user's email address is no longer needed for sending the newsletter, for example after unsubscribing from the newsletter.
5. Provision of the Website and Creation of Log Files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:
- IP address of the user
- Date and time of access
- Websites from which the user's system reaches our website (referrer)
- Websites accessed by the user's system through our website
- Information about browser type and version
- The user's operating system
- Amount of data transferred
The data is stored in the log files of our system. This data is not stored together with other personal data of the user. Storage in log files is done to ensure the functionality of the website. In addition, the data serves to optimize the website and to ensure the security of our information technology systems. The data is rendered unidentifiable by deletion or anonymization after seven days at the latest. The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, the user has no possibility of objection. The legal basis for the temporary storage of data is Art. 6(1)(f) GDPR.
Our website and the public demo of realvirtual WEB (web.realvirtual.io/demo) are delivered via the content delivery network and storage service of Bunny.net (BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia, EU). BunnyWay processes the access data listed above on our behalf as a processor. A data processing agreement under Art. 28 GDPR is in place with BunnyWay.
6. Cookies and Local Storage
Our website does not set any cookies without your consent. On your first visit, a cookie banner asks whether you agree to the use of Google Analytics. Your choice ("Accept" or "Decline") is kept in your browser's local storage (localStorage) so that the banner does not reappear on every page. If you switch the language of the website, the selected language is stored there as well. This information stays in your browser and is not transmitted to us. Storing it is strictly necessary for the functions you request; the legal basis is Section 25(2) No. 2 of the German TDDDG in conjunction with Art. 6(1)(f) GDPR. On our website, cookies are set only by Google Analytics, and only with your consent (Section 7). You can change your choice at any time via the "Cookie Settings" link in the footer of every page.
7. Google Analytics
Our website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is loaded only after you click "Accept" in the cookie banner. Before that, and after you decline, no connection to Google Analytics is made and no cookie is set.
Purpose and data processed. Google Analytics serves audience measurement: it shows us how our website is used, for example which pages are viewed, how visitors reach us, which devices and browsers are used and from which region (approximate location) the access takes place. We also record clicks on links to the Unity Asset Store and to the online demo of realvirtual WEB. We use this information to improve our website and our offering. For this purpose, Google Analytics sets cookies (in particular "_ga" and "_ga_<ID>") that contain a randomly generated identifier of your browser. We have enabled IP anonymization; according to Google, IP addresses are moreover not logged or stored in Google Analytics 4.
Legal basis and withdrawal. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by reopening the banner via the "Cookie Settings" link in the footer of every page and choosing "Decline". After the page is reloaded, Google Analytics is no longer loaded. You can delete cookies that have already been set in your browser settings.
Transfer to the USA. It cannot be ruled out that Google transfers the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).
Storage period. The lifetime of the cookies and the retention of the analytics data are governed by the settings of Google Analytics; analytics data is deleted automatically when the retention period set in our Google Analytics account expires.
Public demo of realvirtual WEB. The public demo at web.realvirtual.io/demo also uses Google Analytics 4. There, Google Analytics is loaded only after you have agreed to its use in a dialog on your first visit; your consent is kept in your browser's local storage. In addition to the usage data listed above, the demo records which model (file name) is opened and which work mode is used. You can withdraw your consent in the demo at any time (Settings › Backup › Privacy, "Withdraw analytics consent"). Otherwise, the information in this section applies accordingly.
For more information on data protection at Google, please refer to: https://policies.google.com/privacy.
8. Contact Form
Our website contains a contact form that can be used for electronic communication. The contact form is provided via the Jotform service, which operates in compliance with the GDPR. Required fields are name and email address. Optional fields include company, phone number, and the message itself. The data entered in the form is transmitted to us by email. Alternatively, you can contact us via the provided email address. In this case, the personal data transmitted with the email will be stored. In this context, no data is passed on to third parties. The data is used exclusively for processing the conversation. The legal basis for the processing of data is Art. 6(1)(a) GDPR, provided the user has given consent. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data from the contact form and data sent by email, this is the case when the respective conversation with the user has ended.
9. Payment Processing
Payment processing for purchases through our website is handled by the payment service provider Stripe (Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA). Stripe is PCI DSS Level 1 certified. When using Stripe, your payment data (e.g., credit card number, expiration date, CVC) is transmitted directly to Stripe. We do not store any complete financial data on our servers. The legal basis for data processing is Art. 6(1)(b) GDPR (contract performance). For more information on data protection at Stripe, please visit: https://stripe.com/privacy.
10. Unity Asset Store
The Starter version of our software is available through the Unity Asset Store. We do not receive any personal customer data from Unity Technologies. All transactions and customer data are managed exclusively by Unity Technologies. You can find Unity Technologies' privacy policy at: https://unity.com/legal/privacy-policy.
11. Embedding of YouTube Videos
We embed YouTube videos on our website using the enhanced privacy mode. The operator of the video platform is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In enhanced privacy mode, no cookies are set and no data is transmitted to YouTube as long as you do not play the video. Only when a video is played is data transmitted to YouTube. We have no influence on this data transfer. For more information on data protection at YouTube, please refer to their privacy policy: https://policies.google.com/privacy. The legal basis for embedding is Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of our content).
12. Login, Download, and News System
Registration is required for access to certain areas of our website (downloads, customer system). The following data is collected: Unity ID or username, email address, and company name. We do not store passwords. Authentication is performed via third-party login systems. The collected data is used exclusively for the provision of the respective service. The legal basis for processing is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest).
13. Forum via UserEcho
Our forum at forum.realvirtual.io is operated via the UserEcho service. When using the forum, data such as username, email address, and posts you create are stored. UserEcho acts as a data processor in accordance with Art. 28 GDPR. For more information on data protection at UserEcho, please refer to their privacy policy. The legal basis for processing is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest).
14. Upload of Your Data
For uploading files (e.g., in the context of support requests), we use the TransferNow service. Uploaded files are automatically deleted after 30 days. TransferNow acts as a data processor in accordance with Art. 28 GDPR. The legal basis for processing is Art. 6(1)(b) GDPR (contract performance).
15. Product Registration and License Activation
The use of our software products (e.g., realvirtual CONNECT, realvirtual WEB) requires registration or license activation – including for free entry-level versions (free tier). In this context, we collect and store the following data: email address, license key or license status, product and product version, the time of registration or activation, and the version of the license terms accepted at that time. The email address is confirmed via a confirmation link (double opt-in); no password is collected. The data is used exclusively for the provision and management of the license and as proof of acceptance of the license terms, and is not passed on to third parties. The legal basis for processing is Art. 6(1)(b) GDPR (contract performance or pre-contractual measures). If you have additionally given your consent during registration, we also use your email address to inform you about product updates and news about our products; the legal basis for this is Art. 6(1)(a) GDPR (consent). You can withdraw this consent at any time with effect for the future, e.g., via the unsubscribe link in every email or by contacting info@realvirtual.io. The data will be deleted as soon as it is no longer required for license management and statutory record-keeping obligations.
16. realvirtual Share
The share function of realvirtual WEB ("realvirtual Share") lets you upload a 3D model and create a link that opens the model in the viewer mode of realvirtual WEB. An upload only takes place when you accept the terms of use in the share dialog (License Terms, Part E) and explicitly trigger "Create link"; nothing is ever uploaded automatically. No user account is required.
Data processed. We process (a) the uploaded model file (GLB) and its content; (b) the name of the model; (c) technical details of the share: share ID, file size, checksum, and time of creation and of expiry; (d) the version of the accepted terms of use and the time of your acceptance; (e) a hash value of the delete key; (f) your email address; (g) your IP address. The IP address is not stored in clear text, only as a hash value salted with a secret key, and is used to limit the number of requests (rate limiting) and to prevent abuse. To prevent automated uploads, your browser solves a computational task (proof of work) issued by the share server before the upload; no third-party services are involved and no cookies are set. The delete key itself is stored only in your browser (local storage, "My shared links" list), as is your acceptance of the terms of use; this information is not transmitted to us, except for the delete key when you trigger a deletion. Please do not upload models that contain personal data (License Terms, Section 16.7).
Email address. When you create a share link, you provide an email address. We store it with the share entry solely to contact you about this share and to follow up on abuse reports (Art. 6(1)(f) GDPR). It is not published, is not part of the link and is not verified. It is deleted together with the share entry, at the latest 90 days after the link expires.
Purpose and legal basis. The processing serves to provide the service under the terms of use (storing the model, creating and delivering the link, deletion) and to record your acceptance of the terms of use; the legal basis is Art. 6(1)(b) GDPR. Processing the IP hash, rate limiting, the bot-prevention task and the handling of reports serve the security of the service and the prevention of abuse and unlawful content; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation free of abuse).
Visibility. A shared model is visible to anyone who knows the link; no sign-in is required. The link is not publicly listed, but it is not protected either. Recipients are not offered a download of the file; however, because the model is transferred to the recipient's browser for display, a recipient can technically obtain a copy. The name of the model is shown together with the model.
Storage location and processor. The share server, the model files and the database are operated with Bunny.net (BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia, EU). BunnyWay processes the data on our behalf as a processor; a data processing agreement under Art. 28 GDPR is in place with BunnyWay. The files are kept in a storage region in Germany without replication outside the EU, the metadata in a database in the EU. When a link is opened, the file is delivered via the Bunny.net content delivery network; Bunny.net processes the IP address of the person opening the link for technical delivery.
Retention and deletion. Each share expires 30 days after upload; the period cannot be extended. An expired share is no longer delivered, and its files are deleted during regular clean-up. You can delete a share yourself at any time before that via "My shared links" in your browser, using the delete key stored there. If you no longer have the delete key, you can ask us to delete the share (info@realvirtual.io). After deletion, file and link are no longer available. The share record (without the model file, with timestamps, version and time of acceptance, email address, hash of the delete key and IP hash) is retained for evidence and abuse prevention for up to 90 days after the original expiry date and then deleted automatically. Counters used for rate limiting are deleted when their time window ends.
Reporting content. Anyone can report a share via "Report this model" in the info box of an opened link. In doing so we process the share ID, the selected reason, an optional message, the time and the salted hash value of the IP address of the person reporting. The report serves to review and, where necessary, block or delete the share; the legal basis is Art. 6(1)(f) GDPR. Reports on a share are deleted 90 days after the shared link expires. Please do not include personal data in the message that is not needed for the review.
17. Rights of the Data Subject
17.1 Right of Access
You have the right to obtain confirmation from us as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request information about the following: the purposes of the processing, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data has been or will be disclosed, the planned duration of storage or the criteria for determining the storage duration, the existence of a right to rectification or erasure, a right to restriction of processing or a right of objection, the existence of a right of complaint to a supervisory authority, and all available information on the origin of the data if the personal data is not collected from the data subject.
17.2 Right to Rectification
You have a right to rectification and/or completion vis-a-vis the controller, insofar as the processed personal data concerning you is inaccurate or incomplete. The controller shall carry out the rectification without undue delay.
17.3 Right to Restriction of Processing
You may request restriction of processing of your personal data under the following conditions: if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data; if the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of their use; if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
17.4 Right to Erasure
You may request that the controller erase the personal data concerning you without undue delay, and the controller shall be obliged to erase such data without undue delay, where one of the following grounds applies: the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; you withdraw your consent on which the processing was based and there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds for the processing; the personal data has been unlawfully processed; or the erasure of the personal data is required for compliance with a legal obligation under Union or Member State law.
17.5 Right to Notification
If you have exercised the right to rectification, erasure or restriction of processing vis-a-vis the controller, the controller is obliged to communicate such rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves a disproportionate effort. You have the right vis-a-vis the controller to be informed about these recipients.
17.6 Right to Data Portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, where the processing is based on consent or a contract and the processing is carried out by automated means.
17.7 Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. The controller shall no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
17.8 Right to Withdraw Consent
You have the right to withdraw your data protection consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
17.9 Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Data protection measures are subject to constant technical evolution. Please inform yourself regularly about our data protection measures by revisiting this privacy policy.