Privacy Policy

1. Data controller

Controller: MB "Sim Academy LT", company code 307434059, VAT code LT100020107411.

Registered office: Ukmergės g. 239-303, LT-07100 Vilnius, Lithuania.

Service location: Ukmergės g. 239, Vilnius, Lithuania. Contact for privacy matters: info@simacademy.lt.

2. Data we process

Depending on how you use the site, we may process:

• Paid checkout: full name, phone number, email, purchased products and quantities, price/amount, payment status, order reference, language and related order information. We do not ask for a gift voucher recipient’s name at purchase.
• Free reservations: full name, phone, email, booking date and time, simulator count/type and an optional comment if you provide one.
• Challenges: first name, last name and result (e.g. lap time), which may be shown publicly on the leaderboard.
• Operational notifications: the same order or booking contact details as needed for customer and internal emails.
• Website analytics: aggregated / technical usage data via Vercel Analytics (see cookies and analytics).

3. Purposes and legal bases

We process data to:

• perform the purchase contract (order, payment, voucher issuance, email delivery) — contract performance;
• handle bookings and customer support — contract performance / pre-contractual steps;
• comply with legal obligations (e.g. accounting and payment rules where applicable);
• pursue legitimate interests (e.g. security, fraud prevention, dispute handling, keeping the site working);
• where required — based on consent (e.g. clearly requested consents in booking or challenge contexts).

Agreeing to the Terms & Conditions at checkout is not consent to all personal-data processing. This Privacy Policy explains processing; where consent is required, it is requested separately or follows from a specific action (for example the booking consent checkbox).

4. Payments (Paysera)

We use Paysera for payments. When payment starts, we send Paysera the buyer’s email, first name (first part of the name entered at checkout), and payment-related information (amount, currency, order identifier, return/cancel/callback URLs, etc.). We do not send the phone number when initiating Paysera payment.

Paysera and related payment providers may process payment data under their own terms. Card or other payment details entered at Paysera are processed in Paysera’s systems — we do not collect them on our servers.

5. Recipients and service providers

Data may be received by providers as needed to operate the service:

• Supabase — storage of orders, bookings, entitlements, challenge results and related records.
• Resend — transactional emails to customers (e.g. PDF vouchers, booking confirmations) and internal operational notifications to staff.
• Vercel — website hosting and Vercel Analytics.
• Paysera — payment processing.
• Our operations staff — administering orders, bookings and customer support.

We do not use other marketing or advertising platforms (such as Meta Pixel or Google Ads) on this website.

6. Cookies and analytics

The site uses Vercel Analytics to understand how visitors use the website (for example traffic). This is not marketing advertising tracking for third-party ad networks.

There is currently no separate cookie-consent banner. Admin and (when enabled) pre-production access session cookies are for staff or protected environments, not customer marketing.

The browser may use sessionStorage for navigation convenience (for example returning to a section on the page). This is not marketing tracking.

7. Public challenge results

If you participate in challenges, your first name, last name and result may be published on the website leaderboard. We inform you in the booking consent and/or on the Challenges page.

8. International transfers

We provide services in Lithuania. The database and email run through cloud providers (Supabase, Resend, Vercel), which may operate infrastructure in the EEA and/or outside the EEA.

Exact server regions and transfer safeguards depend on provider agreements and settings. This policy does not state unverified regions. For clarification, contact info@simacademy.lt.

9. Retention

We keep data as long as needed for the purposes above, legal obligations (including accounting), and legitimate interests.

There is no public automatic personal-data deletion schedule on the site. Voucher expiry (12 months) is product validity, not automatic deletion of personal data.

Specific retention periods for categories (orders, bookings, email logs, challenge results) follow applicable law and internal procedures and may be refined later.

10. Security

We apply organisational and technical measures appropriate to the risk (access control, server-side secrets, payment via Paysera). Absolute security cannot be guaranteed.

11. Your rights

Under the GDPR you may have rights to access, rectify, erase, restrict processing, object, data portability, and to withdraw consent where processing is based on consent.

Contact info@simacademy.lt to exercise your rights. You may also lodge a complaint with the State Data Protection Inspectorate (VDAI).

12. Updates

We may update this Privacy Policy. The current version is published on this website with an update date and version label.