Legal
NederlandsPrivacy policy
Last updated 2026-09-11
Who is responsible
Controller: Muyldermans Racing Software (MRS) — Eenmanszaak (sole proprietorship) - Belgium.
Address: Nationalestraat 114 bus 401, 2000 Antwerpen, Belgium.
Enterprise number (KBO/BCE): 0778.268.018 · VAT: BE 0778.268.018.
Email: sales@mrsoftware.eu.
This notice covers the marketing site mrsoftware.eu, the CFD service MRS Slipstream (slipstream.mrsoftware.eu), the sim-racing pit wall MRS Sim Racing (mrs-simracing-production.up.railway.app), the MRSuite login and demo apps, and the merch shop.
What we collect and why
Marketing site: messages you send us (name, email, optional team or company, message content) so we can reply. A message sent through the contact form is stored on the same server that runs this site; a message sent by mail stays in our mailbox. We also keep standard hosting logs (IP, user-agent, timestamps) for security and abuse prevention.
MRS Slipstream (CFD service): the account we create for your team (username, display name, role), the timeslots we book you into, and the CFD job history for your team. We also process the geometry files you upload and the simulation results we return. We treat all uploaded geometry as your trade secret; an NDA is signed before any upload.
MRS Sim Racing:
- Your account — email address, display name, and your password stored only as a salted one-way hash; the workspaces and teams you belong to and your role in each; and which version of the terms you accepted, and when. Team invite codes are stored only as one-way hashes.
- What your team enters — race names, settings, and the names and ids of the drivers you add to a race. Only add people who know they are being added.
- What the bridge sends from the sim — fuel level and use, laps, flag state, speed, gear, RPM, throttle and brake, position around the lap and the track name. If you let the bridge detect the driver, it uses the name shown in the sim as the driver id.
- Crew links: anyone holding a race's crew link can see its plan, driver names, flag and the car's live position without an account. Revoking the link (“New links”) takes effect immediately.
- We do not keep per-request access logs for Sim Racing — crew links carry a token in the address, and we do not want those in a log. The app records operational events (a race was created, links were rotated, an account was deleted) by id only, without emails or tokens.
Legal basis: providing the service you signed up for (Art. 6(1)(b)) and keeping it secure (Art. 6(1)(f)). Keeping a record of which terms you accepted and when is how we can show what we agreed (Art. 6(1)(f)). Each team's data is kept separate from every other team's.
Merch shop: MRS itself does not take orders. Checkout happens on our print-on-demand partner (see below), which processes your name, delivery address, and payment details as the merchant of record.
Legal bases (GDPR Art. 6)
- Pre-contractual replies and contract performance (Art. 6(1)(b))
- Site security, log retention and abuse prevention (Art. 6(1)(f), legitimate interests)
- Invoicing and accounting duties under Belgian law (Art. 6(1)(c))
- Explicit consent for any optional marketing communications (Art. 6(1)(a))
We do not sell personal data. We do not use your enquiry content, uploaded geometry, or MRSuite AI inputs (Hotfix Agent / Setup Agent) to train general-purpose AI models, and we require our AI provider not to train on your data. MRSuite AI features are AI systems — you are informed when you interact with them.
Processors and sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Railway | Hosting for the marketing site, MRS Sim Racing and the MRSuite/demo apps | EU — europe-west4 (Netherlands) for the marketing site and Sim Racing; EU region where configured for the others. US parent (SCCs) |
| Infomaniak (mail + kDrive) | Business email and internal file storage | Switzerland (EU adequacy decision) |
| Infomaniak Public Cloud | Compute for MRS Slipstream (CFD meshing, solving, and short-lived storage of your uploaded geometry and results) | Switzerland (EU adequacy decision) |
| Gelato | Print-on-demand fulfilment and merchant of record for merch orders (see merch terms) | EU printing hubs; Norwegian company |
| OpenAI, Inc. | Processes prompts you enter into MRSuite AI features (Hotfix Agent, Setup Agent) to generate responses. API tier only; contractually prohibited from training models on your data. | United States (SCCs + DPA) |
| Accountable | Invoicing and Belgian VAT filings | Belgium |
Contact sales@mrsoftware.eu if you need the current sub-processor list in writing for your own compliance review.
International transfers
Our compute and mail providers process data in Switzerland, which the EU recognises under an adequacy decision. Where a provider has a US parent (such as Railway), transfers rely on Standard Contractual Clauses.
Retention
- Enquiries (contact form and email): up to 24 months unless a customer relationship continues
- Slipstream account: for the duration of the engagement, then deletion on request
- Uploaded CFD geometry: processed for the run, retained only for the agreed engagement window, and deleted on request. Meshes are typically purged shortly after each run.
- Simulation results (Cd/Cl, ParaView pack, Excel): retained as agreed; deletion on request
- Sim Racing races: until your team deletes them in the dashboard, which removes them immediately. The car's live position is held in memory only and never stored. Your account: until you delete it under Account in the dashboard (or ask us to). That also removes your personal workspace and any team where you are the only member, with their races; races you created in a team stay with that team.
- Invoices and accounting records: 10 years (Belgian VAT Code Art. 60, as extended from 2023, and accounting law). These are kept even after an erasure request, because the law requires it (GDPR Art. 17(3)(b)).
- Hosting and security logs: up to 90 days, unless needed to investigate an incident
Cookies
We currently use only essential cookies. No analytics, no advertising, no cross-site tracking. If that ever changes, we will show a GBA-compliant consent banner with an equally prominent Reject option before any non-essential cookie is set.
| Cookie | Where | Purpose | Lifetime |
|---|---|---|---|
blog_admin | mrsoftware.eu | Signed HttpOnly session for the site admin | Session |
mrs_slipstream_session | slipstream.mrsoftware.eu | HttpOnly session for your Slipstream account | Up to 14 days |
mrs_sim_session | MRS Sim Racing | Signed HttpOnly session for your Sim Racing account | Up to 14 days |
The Sim Racing dashboard also remembers which workspace you last opened in your browser's local storage. It stays on your device and is never sent to us.
Your rights
You can ask us to access, correct, delete, restrict or port your personal data, and object to processing based on legitimate interests. Email sales@mrsoftware.eu. We answer within one month.
For Sim Racing you can do several of these yourself, under Account in the dashboard: download your data, change your password, and delete your account. If you have forgotten your password, email us from the address you signed up with and we send you a one-time reset link.
Where we rely on your consent, you can withdraw it at any time; this does not affect processing that already took place. The data marked as account data above is needed to give you an account — without it we cannot provide the service. We do not make decisions about you based solely on automated processing, and we do not profile you.
Some data does not come from you directly: a team can add the names of its drivers to a race, and a sim can report a driver's in-game name. If that is you and you want it corrected or removed, ask the team or email us.
Our services are not intended for children under 13, the age of digital consent in Belgium. If you believe a child under 13 has given us personal data, email us and we will delete it.
You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / APD-GBA).
Security incidents
We maintain a written incident-response procedure. If there is a personal-data breach, we notify the APD/GBA within 72 hours (GDPR Art. 33) and, where it is likely to put your rights at high risk, we tell you without undue delay (Art. 34).
Also see terms and merch terms.