Privacy policy

1. Data controller

The operator of vim.marketing and the controller of personal data is Vim Global spółka z ograniczoną odpowiedzialnością, address: ul. Marii Curie-Skłodowskiej 3/27, 20-029 Lublin, Polska. Contact: office@vim.global. Registration details: 0001259103, 7123516905, 54542519200000. No data protection officer (DPO) has been appointed. For personal-data enquiries: office@vim.global. Vim Global is the brand used on the website.

2. Data, purposes and legal bases

Card enquiries: name or company name, email, selected design, quantity, language, currency and optional notes. We use these to reply and take steps at the customer’s request before a contract, then to perform the contract (GDPR Article 6(1)(b)). For a company’s contact person, the basis is our legitimate interest in business correspondence and servicing the company’s contract (Article 6(1)(f)).

General and partner enquiries: contact details and correspondence. The basis is our legitimate interest in answering enquiries (Article 6(1)(f)), or pre-contract steps requested by the individual (Article 6(1)(b)), where applicable.

Payments and required records: buyer, payment and invoice details, to perform the contract and meet tax and accounting duties (Article 6(1)(b), (c)). We do not ask for payment card details in the notes field.

Security and claims: necessary technical logs, IP addresses and transaction records, based on our legitimate interest in protecting the site, preventing misuse and establishing, exercising or defending claims (Article 6(1)(f)).The full technical-log fields and hosting retention periods are still being verified.

3. Accounts, video and card recipients

Your purchase includes a greeting card and a page for your personal message. After payment, you’ll receive a link to the card and instructions for adding your words and video. Send the card to someone you care about — they can open your message using the button inside the card.

Select “Open video message” inside the card to open the message. The buyer and recipient use the same button. No sign-in is needed to view it. To add or edit the message, sign in with your login and password.

Personal messages are held in an external service. Provider information and the outstanding review are described below.

Customers may include other people’s names, photos and videos. They must have the necessary rights and legal grounds before publishing them. Data may be accessible to people who receive the link or QR code; an unguessable address is not itself access control. Actual access model: Anyone with the link or QR can open the page without registration. Noindex does not protect access. A viewing link gives no editing rights. One card may be shared with any number of recipients; a separately personalised card requires its own link. For data obtained from another person, the controller must assess the information duty under GDPR Article 14. Customer duties do not remove the controller’s own duties.

4. Recipients and transfers outside the EEA

GoDaddy hosts the website; Google Workspace handles incoming corporate email. Website notifications use the hosting mail transport. Country lookup runs on the server using a local DB-IP database; visitor IP addresses are not sent to the DB-IP API. Personal messages use the external Phygit/White Label service. The exact contracting entities, roles, processing countries and safeguards for transfers outside the EEA are still being verified; the Phygit agreement/DPA is in progress. We do not claim that all data stays in the EEA. Contact office@vim.global for information about recipients and safeguards; this section will be updated as facts are confirmed.

5. Retention

Approved targets are 6 months after closure for enquiries without a purchase, 30 days for ordinary technical logs, and a rotation of up to 35 days for operational backups. Implementation and provider compliance with these periods have not yet been confirmed; these are not promises of automatic deletion already in operation. Contract data is kept for performance, then only as necessary for mandatory records and legal claims. Tax and accounting records follow the applicable statutory periods, which depend on the record category and starting date. Evidence of a particular dispute or incident may be retained separately while needed to resolve it and defend claims. Export and deletion of personal messages after the service ends are being clarified with the external service. Contact office@vim.global for information or an erasure request; backups will be considered in the response.

6. Your rights

Subject to GDPR conditions, you may request access, a copy, correction, deletion, restriction and portability of your data. You may object to processing based on legitimate interests for reasons related to your situation, and to direct marketing at any time. You may withdraw consent without affecting earlier lawful processing. Send requests to office@vim.global. We normally reply within one month; a lawful extension requires notice and reasons. You may complain to the President of Poland’s Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority.

7. Optional data, cookies and automation

Providing contact details is voluntary, but without necessary information we cannot handle your enquiry or perform an order. Notes are optional; avoid unnecessary sensitive data. Remembering language and currency on the main pages requires permission in cookie settings. IP country lookup suggests a currency that you can change. Review of other automated decisions in the external service is not complete. Publication of this policy does not mean that legal review of all external services is complete.