Who is responsible
The controller of your personal data is Nuova Digital LLC, which runs MARV Racing, at 28 Geary St, Ste 650 #197, San Francisco, CA 94108, United States. For anything about your data, write to [email protected] or call +40 774 507 044.
This policy covers marvracing.com, our order pages, our order emails and the support emails you send us.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Order details: name, email address, billing country and address as you enter them at checkout, the edition, the amount, VAT, promo code and payment status | To sell and deliver the files, send your confirmation, help you if something goes wrong, and keep accounting and tax records | Performing our contract with you; legal obligations (tax and accounting) |
| Your checkout choices: your request for immediate download and your acknowledgement that the right of withdrawal ends | To show that the right of withdrawal was handled correctly | Legitimate interests (being able to prove it) |
| Delivery records: order reference, number and time of downloads | To deliver the files securely and stop unauthorised sharing of download links | Performing our contract; legitimate interests (protecting our files) |
| Support messages: what you write to us and our replies | To answer you | Performing our contract; legitimate interests (customer service) |
| Technical data: IP address, browser and device type, date and time of requests, in server and security logs | To deliver the site, keep it secure and stop abuse | Legitimate interests (security and reliable service) |
We don’t use analytics, advertising or social media tracking, we don’t build profiles, and we don’t send marketing emails. If that changes, we will ask first where the law requires it, and update this policy.
You don’t have to give us your data, but without an email address and payment we can’t sell or deliver the files.
Payments
Checkout runs on Stripe. Stripe collects your payment details directly and uses them to process the payment, prevent fraud and meet its legal duties, partly as an independent controller under its own privacy policy. Stripe’s fraud checks may decide automatically to block a payment that looks fraudulent; if that happens to you, contact us and we will help.
We receive only what we need for your order, such as your name, email, billing address, amount and payment status, and the last digits and brand of your card in our Stripe dashboard.
International transfers
Nuova Digital LLC is a US company, so your data is processed in the United States, and by our team and providers in other countries. Where data about people in the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on our providers’ certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where they hold it, and otherwise on the European Commission’s Standard Contractual Clauses in their data processing terms. You can ask us for a copy of the safeguards at [email protected].
How long we keep it
- Order and tax records: as long as tax and accounting law requires, which can be up to 10 years for some tax records. Stripe also keeps its own records of your payment.
- Delivery records (cached order data and download counts): deleted automatically within 90 days of your purchase or your last download.
- Order emails: Resend, which sends them, keeps delivery logs for about 30 days.
- Support messages: up to 3 years after our last exchange, unless we need them longer for a claim.
- Server and security logs: kept by Cloudflare for short periods, in line with its own retention.
Your rights
Depending on where you live, you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we don’t need to keep it, for example for tax law;
- restrict how we use it, or object to uses based on our legitimate interests;
- give you your data in a portable format.
Write to [email protected]. We answer within one month and may need to confirm your identity first. Using your rights is free.
If you are in the EEA, the UK or Switzerland and you think we have handled your data wrongly, you can complain to your local data protection authority. We would appreciate the chance to fix it first.
If you live in the United States
Some US states, including California, give residents extra privacy rights, such as the right to know, delete and correct personal information, and to opt out of its sale or sharing. We don’t sell or share personal information for targeted advertising, and we don’t use sensitive personal information. You can use your rights by writing to us; we will not treat you differently for doing so.
Do Not Track. We don’t track visitors across sites, so we don’t change anything in response to Do Not Track or Global Privacy Control signals; there is nothing to switch off.
Security
The site runs on HTTPS only. File download links are signed, tied to your order, created when you click and expire after 15 minutes. The files and order records sit in private storage, and access to our accounts is protected. No system is perfectly secure, but if a breach ever affects your data, we will tell you and the authorities where the law requires.
Children
Our files are sold to adults. We don’t knowingly collect data from anyone under 18 without a parent’s or guardian’s involvement. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the date at the top. Significant changes will be shown on this page before they take effect. Questions: [email protected].