Privacy policy

This notice explains how personal data is handled on roleplay-gym.com. It covers this website only. Personal data processed inside the Roleplay Gym platform on behalf of a customer is governed by the data processing agreement signed with that customer.

Who is responsible

The data controller for this website is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], tax ID [VAT / TAX NUMBER], trading as Roleplay Gym, a solution by Xternus.

You can contact us about data protection at hello@roleplay-gym.com.

What we collect

We collect only what you actively submit through the demo request form: your name, work email address, company, job title, team size, buyer profile and any message you write. We also record which page the form was submitted from and the language you were browsing in.

The demo request form is provided by HubSpot and loaded from their servers. Displaying it places cookies from HubSpot and from Google reCAPTCHA, which is used to block automated submissions. No other page on this site sets cookies, and we run no analytics or advertising scripts anywhere. No profile of your browsing is built.

Our hosting provider (Netlify) processes technical connection data such as IP address in server logs for security and delivery purposes, as any web host does.

Why we use it, and on what legal basis

We use the details you submit to respond to your request, arrange and run a demonstration, and follow up about it. The legal basis is the steps taken at your request prior to entering a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR), together with the consent you give when submitting the form.

We will not use your details for unrelated marketing without asking you separately, and we do not sell or rent personal data.

Who it is shared with

Form submissions are stored in our CRM (HubSpot) and are accessible to the Roleplay Gym and Xternus staff who handle demo requests. Our website is hosted by Netlify. Both act as processors under contract. Google receives the technical data reCAPTCHA needs in order to tell automated submissions from genuine ones.

Where a provider transfers data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

Demo request records are kept for up to 24 months from the last contact with you, after which they are deleted or anonymised, unless a longer period is required by law or a commercial relationship has begun.

Your rights

You have the right to access your personal data and to have it corrected, deleted, restricted or transferred, and to object to processing based on legitimate interest. Where processing relies on consent, you can withdraw it at any time without affecting processing already carried out.

To exercise any of these rights, write to hello@roleplay-gym.com. If you are not satisfied with our response, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or the supervisory authority in your country of residence.

Changes to this notice

If this notice changes materially, we will update the date at the top of this page.