Quality downloads for your Flight SimulatorsQUALITY FILES FOR FLIGHT SIMULATORS
Log in
Login into your account
Register
Or login with


Privacy Policy

Last updated: October 26, 2026. Lire cette politique en français

This policy explains how personal data is used when you visit Rikoooo.com, create an account, download flight simulator add-ons, subscribe to Jumbo, make a donation or contact support. It also describes cookies, third-party services and how to exercise your rights. Reading this page or continuing to browse does not constitute consent to processing that requires it.

1. Data controller and contact details

The controller responsible for processing carried out to operate Rikoooo.com is Erik Bender, operator of Rikoooo, 107 chemin du Gaillard-du-Port, 31410 Noé, France.

For any question or request concerning your data, contact This email address is being protected from spambots. You need JavaScript enabled to view it., use the support form or write to the address above, marked “Rikoooo — Personal Data”. You may use English or French. Registered post is not required.

The processing concerned is subject, in particular, to the General Data Protection Regulation (GDPR, Regulation EU 2016/679), the French Data Protection Act of January 6, 1978, as amended, and the rules applicable to cookies and electronic marketing. Providers that determine their own purposes remain responsible for the processing described in their respective policies.

2. Data collected and its sources

The data depends on the features you use. Browsing a page, creating an account and making a payment do not require the same information.

  • Account and sign-in: the name you provide, username, email address, password in a protected form, language, account identifier, registration and sign-in dates, account status and preferences. Sign-in and account recovery mechanisms also use tokens and technical data.
  • Sign in with Google: when you choose this option, profile information authorised through the Google sign-in process, including your Google identifier, name and email address, is used to create or recognise your account. Rikoooo does not receive your Google password. You can review and revoke access in your Google account settings; doing so does not automatically delete your Rikoooo account.
  • Browsing and downloads: IP address, request date and time, pages and files requested, request results, browser and device characteristics communicated when connecting, and the data needed for sessions, security and download permissions. A history may be associated with a signed-in account. An IP address or cookie identifier is not necessarily anonymous.
  • Jumbo and donations: the identity and contact details you provide, chosen plan, amount, currency, dates, transaction status, payment references, billing information and subscription entitlements. The donation form asks, in particular, for a first name, last name and email address; the comment is optional. The payment provider collects the information needed for the chosen payment method and returns the details needed to process the transaction.
  • Support and contributions: contact details, subject, message, attachments and technical information you send, together with the correspondence needed to follow up. Information you voluntarily publish in a public area may be seen and copied by others.
  • Newsletters: email address, any name provided, subscribed lists, subscription and unsubscribe status, and delivery data. The mailing tool includes open and click measurement features, described in section 6.
  • Cookies and third-party services: online identifiers, privacy choices, device information and interactions with the services concerned. Section 5 explains advertising and statistical purposes.

This information comes from you, your browser, your use of the services and, when you use them, sign-in or payment providers. Required fields are identified in the forms: without them, it may not be possible to create an account, handle a request or provide the service concerned. Other information is optional. Do not unnecessarily send passwords, full card numbers, card security codes or sensitive data in a message or attachment.

3. Why data is used and on what legal basis

  • Creating and administering accounts, providing downloads and managing Jumbo: providing the service requested and performing contractual commitments, or taking steps at your request before entering into a contract (GDPR Article 6(1)(b)).
  • Processing payments, donations and related requests: carrying out the transaction requested; complying with accounting and tax obligations for records subject to those requirements (Articles 6(1)(b) and 6(1)(c)).
  • Responding to support requests: performance of the contract for service-related requests; a legitimate interest in answering other questions, resolving problems and retaining the information needed for follow-up (Article 6(1)(f)).
  • Protecting the site and accounts: a legitimate interest in preventing intrusions, abusive downloading, fraud and uses that breach the service terms, diagnosing incidents and keeping files available. This interest must be balanced against your rights.
  • Sending newsletters and promotional information: consent where required by law (Article 6(1)(a)). Creating an account does not, by itself, constitute consent to marketing. Any legal exception for similar services remains subject to its conditions and to the right to object in every message.
  • Measuring audiences and personalising advertising using trackers that are not exempt: prior consent. Partners may present certain separate advertising operations as relying on a legitimate interest; the preferences panel details their purposes and allows you to object. A legitimate interest does not replace consent where consent is required to read or place a tracker.
  • Complying with the law, handling rights requests and establishing, exercising or defending legal claims: a legal obligation or legitimate interest, depending on the nature of the request, obligation or dispute.

Technical checks may automatically reject a request, require verification or restrict suspicious access. If a check prevents you from using the service, contact support to request a review. Advertising targeting may use interest profiles depending on the choices expressed and the partners’ practices; it is separate from the administration of your subscription.

4. Who may receive the data

Access depends on the purpose: authorised Rikoooo administration and support personnel, and providers needed for hosting, file delivery, security, payments and sending messages. Data may also be disclosed to authorities, advisers or competent bodies where justified by a legal obligation, a legally valid request or the establishment, exercise or defence of a legal claim.

  • Cloudflare: traffic delivery and protection, Turnstile anti-bot checks and technical performance measurement. These functions may process IP addresses and information about browsers and requests. See Cloudflare’s privacy policy.
  • Google: Google sign-in when chosen, Google Analytics for audience measurement, Google AdSense for advertising and Google’s advertising privacy choices mechanism. See Google’s privacy policy and its information about partner sites.
  • PayPal and 2Checkout / Verifone: processing transactions when you choose these payment methods. They may process data to meet their own obligations, including fraud prevention and financial obligations. See the policies of PayPal and 2Checkout. For donations by bank transfer or cheque, the banks concerned take part in processing the transaction.
  • Advertising partners: the current list, their purposes and their policies are available in the site’s Google “Privacy and cookie settings” / “Paramètres de confidentialité et de cookies” panel. This list may change.

Rikoooo also uses components integrated into the site, including Joomla for accounts, PayPlans for Jumbo, JDonation for donations and AcyMailing for newsletters. Their installation does not, by itself, mean that their developers receive members’ data. Exchanges with external services depend on the features actually used.

5. Cookies, advertising and managing your choices

A cookie is information stored on your device. Other technologies, such as identifiers, browser storage, tags and pixels, may serve similar functions.

  • Operation and security: sessions, authentication, language choices, remembering privacy preferences, and protection against bots and abuse. Only trackers that are strictly necessary for a requested function or covered by an applicable exemption may be used without consent.
  • Audience and performance: visitor statistics with Google Analytics and technical information with performance tools. Audience measurement is not automatically exempt from consent: this depends on its configuration and the legal conditions.
  • Advertising: Google AdSense and its partners may use identifiers, browsing activity and device information to select and measure advertisements, limit their repetition, analyse audiences and, depending on your choices, personalise advertising and content. The panel may also present specific processing activities, including precise geolocation, subject to the required permissions and consent.
  • External content and services: an embedded video, social sign-in or payment service may transmit information to the provider concerned when it loads or is used.

To manage advertising and partners: open the “Privacy and cookie settings” or “Paramètres de confidentialité et de cookies” button, displayed at the bottom of the page when Google’s mechanism is available. It allows you to review partners, consent, decline consent and manage options, including objections to processing based on legitimate interests. You can revisit your choices. Refusing optional trackers does not delete your account.

Consent must be freely given, specific, informed and affirmative; it must be as easy to withdraw as to give. Withdrawal does not invalidate processing lawfully carried out beforehand. Choices may depend on the browser and device; deleting cookies may require you to express them again. A tracker’s lifetime depends on its function and provider: some expire at the end of the session, while others remain until they expire or are deleted. Consult the panel and the providers’ notices for the available details.

You can also delete or block cookies in your browser and manage location permissions. These settings may affect sign-in and certain features; they do not replace the required consent mechanism. For Google Analytics, Google also provides an opt-out browser add-on. If the panel does not appear or your choices seem not to be respected, report this to This email address is being protected from spambots. You need JavaScript enabled to view it., specifying the browser and page concerned.

6. Newsletters and service messages

Newsletters cover new downloads and Rikoooo news, among other updates. You can unsubscribe using the link in the messages, the preferences offered in your member area or by contacting us. Unsubscribing from the newsletter does not prevent messages needed for an account recovery request, a payment, a subscription or security.

The AcyMailing tool used on the site is configured with statistical tracking features. Depending on the message and applicable settings, a tracking pixel or redirect link may record an open or a click, together with associated technical information. These measurements may be linked to the subscriber; they are not inherently anonymous, and email service protections may make them inaccurate. Trackers subject to consent require agreement that meets the applicable rules. Subscribing to a newsletter does not, by itself, constitute consent to opening or click measurement trackers that require separate consent. You can block remote images in your email application and request further information or object to processing where that right applies.

7. How long data is retained

Retention depends on the use and the applicable obligations. The criteria below distinguish routine operation from records needed for accounting, security or a dispute. An obligation relating to an invoice does not justify retaining an entire account or its history.

  • Account and preferences: while the account is maintained and associated services are provided; after closure, only information still needed to meet a legal obligation, provide evidence of a transaction or handle a dispute is intended to be retained for that purpose.
  • Jumbo, transactions and donations: while the transaction is processed and followed up; invoices and accounting records subject to French law must be retained for ten years from the end of the financial year concerned. Other supporting documents follow the statutory retention or limitation periods applicable to their nature.
  • Support: while the request is handled and during the follow-up needed to resolve it; correspondence relevant to a complaint or dispute may be retained until it is settled and the applicable limitation period expires.
  • Technical logs and downloads: the server’s main web logs are configured for daily rotation with one archive retained. Download histories linked to an account and records specific to security systems follow the lifecycle of the service concerned and diagnostic needs; records related to an incident may be isolated for the duration of the investigation, its resolution and any necessary follow-up. Statistics that have been effectively anonymised may be retained without allowing you to be identified.
  • Newsletters: contact details and preferences during the subscription; the minimum records needed to demonstrate a choice and honour an unsubscribe request may remain to prevent further unwanted messages. The configured retention period for newsletter statistics is 360 days.
  • Cookies and privacy choices: according to the tracker’s lifetime, its purpose and the information provided by the provider or panel; data collected through a cookie may have a retention period different from the cookie’s lifetime.
  • Backups: data deleted from active systems may remain in a backup until it is replaced or expires according to the backup cycle. Any restoration must take account of deletion requests already handled.

You can ask about the periods or criteria applicable to your data. Information retained solely to meet an obligation or handle a legal dispute must be kept separate from routine uses and accessible only to those who need it.

8. Transfers outside the European Economic Area

The use of international providers, including Cloudflare, Google, PayPal and 2Checkout / Verifone, may involve processing or access outside the European Economic Area, particularly in the United States. Rikoooo’s French address should therefore not be taken to mean that all data remains in France.

Where a transfer falls under the GDPR, it must rely on an authorised mechanism: an adequacy decision applicable to the country and recipient, or appropriate safeguards such as the European Commission’s standard contractual clauses, together with the necessary assessments and supplementary measures. The EU–US Data Privacy Framework applies only to organisations with a valid, relevant certification; it does not automatically cover all US providers.

According to their official notices, Cloudflare, Inc. states that it uses the EU–US framework for the transfers concerned and standard contractual clauses for other transfers or as a fallback; Google LLC also states that it participates in this framework and uses standard contractual clauses for transfers not covered by an adequacy decision. PayPal describes binding corporate rules for certain transfers within its group, and adequacy decisions or standard contractual clauses for other transfers. 2Checkout / Verifone refers in particular to adequacy decisions, standard contractual clauses and intragroup agreements, depending on the transfer. These are the mechanisms declared by the providers; their application depends on the service, receiving entity and transfer concerned.

You can contact us for information about the safeguards applicable to processing carried out for Rikoooo and, where applicable, a copy of or information on how to access those safeguards, subject to the protection of confidential information.

9. Your rights and how to exercise them

Subject to the conditions provided by law, you may request:

  • Access to your data and information about its processing.
  • Rectification of inaccurate or incomplete data.
  • Erasure where the data is no longer needed or another legal ground justifies it, subject to applicable exceptions.
  • Restriction of processing in the situations provided for by the GDPR.
  • Objection, on grounds relating to your particular situation, to processing based on legitimate interests; you may object to direct marketing at any time without giving a reason.
  • Portability of the data you have provided, in a structured, machine-readable format, where automated processing is based on consent or a contract.
  • Withdrawal of consent at any time, without affecting the lawfulness of earlier processing.
  • Safeguards concerning decisions based solely on automated processing that produce legal effects or significantly affect you, where applicable, including the ability to challenge a decision and obtain human intervention.
  • Specific instructions following your death concerning the retention, erasure and disclosure of your data, under the conditions provided by French law.

Send your request to This email address is being protected from spambots. You need JavaScript enabled to view it. or use the contact details in section 1. Specify the right concerned and provide the information needed to locate your account or request; using the address linked to the account makes handling it easier. An identity document is not routinely required. Where there is reasonable doubt, proportionate verification may be requested.

You should normally receive a response within one month of receipt. This period may be extended by two months where justified by the complexity or number of requests; you must be informed of the extension and its reasons within the first month. Exercising your rights is generally free of charge. Exceptions for manifestly unfounded or excessive requests are governed by the GDPR. Any refusal must be explained and include information about available remedies.

You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or the competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. Contacting Rikoooo first may help resolve the issue, but does not deprive you of this remedy.

10. Deleting your account

You can use the “Delete my account” command in My Profile when signed in, or request deletion by email. Before deleting the account, retrieve any documents you need. Closure may make the member area, history and account-related access unavailable.

Deleting an account does not necessarily mean that every piece of data is immediately erased from all systems: accounting records, evidence, restrictions needed to honour an objection and backups follow the rules in section 7. For a newsletter, public contribution or transaction that may not be linked to the account, identify the items concerned so they can be located.

Deleting an account does not, by itself, constitute a refund request or cancel a recurring payment authorisation with a provider. If such an authorisation exists, also check it with the provider and contact support about the consequences for Jumbo.

11. Data security and incidents

The site uses HTTPS, authentication mechanisms, access restrictions and measures to protect against attacks and abuse. Security also includes maintenance and backups. Access to information must be limited to the needs of administration, support and the providers concerned. However, no electronic transmission or storage can be guaranteed to be risk-free.

Use a unique password, protect your email account and sign out on a shared device. Report suspicious sign-ins or incidents to This email address is being protected from spambots. You need JavaScript enabled to view it. without sending any secrets. In the event of a personal data breach, obligations to document the breach, notify the supervisory authority and, where required by the risk, inform affected individuals apply in accordance with the GDPR.

12. Children

The site is intended for flight simulator users and may be visited by children. In France, where processing connected with an online service offered directly to a child relies on consent, a child under fifteen must consent jointly with the holder of parental responsibility. This threshold does not, by itself, establish legal capacity to enter into a contract or pay for a subscription; other rules may apply depending on the country.

A parent or legal representative can contact us about their child’s data. If you believe data has been provided without the required authorisation, include the information needed to examine the situation without sending unnecessary sensitive information.

13. Public contributions, add-ons and third-party sites

A username, comment, file or other information voluntarily published in a community area may become accessible to visitors and search engines. Avoid including your address, private contact details or information about other people without a valid reason. Erasure requests are assessed in light of the applicable rights and the nature of the content; Rikoooo does not control copies independently made by third parties.

Downloaded simulator add-ons, installers and software may operate in their own ways and have their own notices. This policy describes processing related to the site and the provision of downloads; it is not a guarantee concerning processing by third-party software. Consult the software’s documentation and permissions.

Links to Discord, Facebook, YouTube or other sites lead to services with their own rules. Your use of those services, and the information you publish there, are also subject to their policies. You do not need to use a social platform to send Rikoooo a request concerning your data.

14. Changes and reference texts

This policy may be updated when the site, its providers or the law changes. The date at the top of the page identifies the published version. A change does not, by itself, constitute new consent: where processing requires agreement, it must be obtained through an appropriate mechanism. Substantial changes requiring specific notice must be brought to your attention by suitable means.

For further information: the GDPR text, rights concerning your data, cookie rules and retention of business records.

Any historical CNIL registration number displayed on the site is neither an approval nor a certification of GDPR compliance.