Simple Virtual Tour

1. Data Controller

The data controller is Simple Software di Torza Andrea, Uboldo (VA), Italy, VAT IT04102120120. Contact: affiliate@simplevirtualtour.com. Full billing details are provided where required for invoicing and lawful business purposes.

2. Data We Process

• Account data: username, email address, password hash, role, status, login session data, and password reset tokens.
• Identification and tax data: company name, first name, last name, address, country, VAT number, tax code, or equivalent tax identifier.
• Payment data: IBAN, BIC/SWIFT, account holder name, payout documents, invoices, receipts, payout history, and commission records.
• Affiliate tracking data: referral tokens, click time, referred program, IP address, browser user agent, attribution data, payment transaction identifiers, and webhook logs.
• Technical data: security logs, notification records, email delivery data, and server-side operational data needed to run the portal.

3. Purposes and Legal Bases

• Account creation and program management: to review registrations, provide the affiliate dashboard, manage links, and calculate commissions. Legal basis: contract or pre-contractual steps.
• Payouts, invoicing, and tax compliance: to verify identity, process payments, keep accounting records, and comply with tax obligations. Legal basis: legal obligation and contract.
• Fraud prevention and security: to detect abuse, invalid traffic, duplicate transactions, unauthorized access, or policy violations. Legal basis: legitimate interest and legal claims.
• Transactional emails: to send password reset, account approval, payout, and service notices. Legal basis: contract and legitimate interest.
• Legal claims and compliance: to enforce terms, respond to lawful requests, and defend rights. Legal basis: legal obligation and legitimate interest.

4. Recipients and Processors

Data may be shared with hosting providers, email providers, payment and banking providers, accountants, tax advisors, legal advisors, fraud prevention providers, and public authorities where required by law. These parties receive only the data needed for their role and, where applicable, act under contractual data protection obligations.

5. International Transfers

If service providers process data outside the European Economic Area, transfers are handled using an adequate legal mechanism, such as an adequacy decision, Standard Contractual Clauses, or another safeguard permitted by GDPR.

6. Retention

• Account data are kept while the account is active and for the period needed to manage disputes, fraud checks, and legal claims.
• Tax, invoice, receipt, payout, and accounting data are kept for the statutory retention period required by Italian and applicable tax law.
• Affiliate click and attribution data are kept for the period needed to validate commissions, investigate abuse, and defend claims.
• Password reset tokens and remember-me tokens are kept only until expiry, use, or replacement.

7. Your Rights

You may request access, rectification, erasure, restriction, portability, or objection where available under GDPR. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing. You also have the right to lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

8. Required Data

Some data are required to create an account, verify eligibility, comply with tax and accounting obligations, and process payouts. If you do not provide required data, we may be unable to approve your account or pay commissions.

9. Cookies

The portal uses session, remember-me, and affiliate attribution cookies as described in the Cookie Policy.