Privacy policy

 

Last updated: 22 September 2026

1. Personal data controller

The controller of personal data processed in connection with the use of the VIMTech online store is:

Volodymyr Martsypaka, conducting business under the name VIMTech
ul. Adama Mickiewicza 3/4
59-800 Lubań, Poland
Email: kontakt@vimtech.pl
Website: https://vimtech.pl

For matters concerning personal data and the exercise of rights under the General Data Protection Regulation (GDPR), you can contact the Controller using the email address or postal address provided above.

2. Scope of this policy

This Privacy Policy describes the processing of personal data relating to individuals who:

  • visit the VIMTech online store;

  • place orders;

  • purchase digital products, physical products or services;

  • download purchased digital files;

  • create a customer account;

  • subscribe to the newsletter or consent to receiving marketing information;

  • contact VIMTech;

  • use forms, features and other services available in the store.

3. Data we may process

Depending on how you use the store, we may process, among other things:

  • first and last name;

  • email address;

  • telephone number;

  • billing address, delivery address and correspondence address;

  • business details, including business name, address and tax identification number, where required to issue an invoice;

  • information about orders, purchased products, payments, returns and complaints;

  • information about digital product downloads, including the order identifier, the file provided, the download time and technical data associated with the download;

  • the contents of correspondence and requests sent to VIMTech;

  • information about consents given, including consent to begin supplying digital content before the withdrawal period expires;

  • customer account data, if an account is created;

  • IP address, device type, browser type, operating system and data about activity in the store;

  • information stored using cookies and similar technologies;

  • data relating to fraud detection, transaction security and protection of the store.

VIMTech does not receive the customer’s full payment card details. These are processed directly by the payment provider in accordance with its security rules and privacy policy.

4. Sources of data

We receive personal data:

  • directly from the person using the store, for example when placing an order, contacting us or subscribing to the newsletter;

  • automatically during use of the website, including through cookies and technical logs;

  • from payment providers where necessary to confirm or process a payment;

  • from service providers used to operate the store;

  • from carriers and logistics providers for products requiring physical delivery.

5. Purposes and legal bases for processing

Order processing and performance of the contract

We process data to:

  • accept and process orders;

  • enter into and perform contracts;

  • accept payments;

  • deliver physical products;

  • provide digital products and their download links;

  • handle returns, complaints and other order-related requests.

The legal basis is Article 6(1)(b) GDPR — processing necessary to enter into or perform a contract.

Tax, accounting and legal obligations

We process data relating to orders, payments and sales documents to fulfil obligations arising from tax, accounting and consumer protection laws.

The legal basis is Article 6(1)(c) GDPR — compliance with a legal obligation to which the Controller is subject.

Handling communications and enquiries

We process data provided in a message to respond and deal with the matter concerned.

The legal basis may be:

  • Article 6(1)(b) GDPR — where the communication concerns entering into or performing a contract;

  • Article 6(1)(f) GDPR — the Controller’s legitimate interest in communicating, providing customer service and responding to enquiries.

Marketing and newsletter

If the user consents, contact details may be used to send information about new products, services, offers or VIMTech’s activities.

The legal basis is:

  • Article 6(1)(a) GDPR — consent;

  • where applicable, also the provisions governing electronic communications and direct marketing.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

Security and fraud prevention

Data may be processed to:

  • protect the store and customer accounts;

  • detect attempted fraud;

  • prevent misuse;

  • protect payments and IT infrastructure;

  • establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR — the Controller’s legitimate interest in ensuring the security of the store and protecting its rights.

Analytics and store improvements

Data about use of the store may be processed to compile statistics, analyse website performance, detect errors and improve the offering.

For technologies requiring consent, the legal basis is Article 6(1)(a) GDPR. In other cases, the legal basis may be Article 6(1)(f) GDPR — the Controller’s legitimate interest in ensuring the proper operation and development of the store.

6. Digital products

When a digital product is purchased, such as an STL, DXF, STEP or other downloadable file, we process the data necessary to:

  • associate the digital product with an order;

  • send a message containing the download link;

  • enable the file to be downloaded;

  • record delivery or download of the product;

  • handle technical issues;

  • protect files and links against unauthorised use;

  • document consent to begin supplying digital content before the withdrawal period expires.

This data is processed to perform the contract, fulfil legal obligations and protect VIMTech’s legitimate interests.

The download link may be associated with a specific order and the customer’s email address. The customer should not share the file or link with third parties if the terms of the licence prohibit this.

7. Is providing data mandatory?

Providing data marked as required when placing an order is voluntary, but necessary to enter into and perform the contract.

Failure to provide required data may prevent, among other things:

  • acceptance of the order;

  • payment processing;

  • issuance of a sales document;

  • delivery of the product;

  • sending a download link for a digital product;

  • consideration of a complaint.

Providing data for marketing purposes is voluntary and is not a condition of making a purchase.

8. Recipients of data

Personal data may be disclosed to entities that help us operate the store, in particular:

  • Shopify and entities providing services within the Shopify platform;

  • payment providers, including Shopify payment providers and PayPal, if the customer chooses the relevant payment method;

  • providers of hosting, email, domains and IT infrastructure;

  • providers of accounting, legal and administrative services;

  • providers of analytics, security and customer service tools;

  • carriers, couriers and logistics providers — only for products requiring physical delivery;

  • providers of Shopify apps used in the store, including apps for delivering digital products and recording required consents;

  • banks and financial institutions;

  • public authorities where disclosure is required by applicable law.

Entities processing data on our behalf may use it only to the extent necessary to provide the services entrusted to them.

9. Shopify, Shopify Network Intelligence and store apps

The VIMTech store operates on the Shopify platform. Shopify processes information necessary to operate the store, handle orders, payments and customer accounts, ensure security and provide platform services.

As Shopify Network Intelligence is enabled, Shopify may also process data about how users interact with the VIMTech store to provide enhanced services, personalise experiences, carry out analytics, measure service effectiveness and — after obtaining the required consent — personalise advertising.

For these purposes, Shopify may use information from the user’s interactions with the VIMTech store, other merchants using Shopify and Shopify services.

Users can manage their consent to the use of optional cookies and similar technologies through the cookie banner and the cookie preferences panel available in the store. Refusing consent to optional technologies does not affect access to the store’s basic features.

The store may use, among other things:

  • the Shopify Digital Products app to store and deliver purchased digital files;

  • the Checkbox Assistant app by Flatto Inc. to display checkboxes and record declarations made during purchase;

  • payment apps and services;

  • analytics, technical, communication and security tools.

The providers of these services may process data to the extent necessary to provide their services, in accordance with the relevant agreements, applicable law and their own privacy policies.

Information about Shopify’s data processing practices is available at: https://www.shopify.com/legal/privacy.

10. Transfers of data outside the European Economic Area

Some service providers, including Shopify and providers of apps, payments or IT tools, may operate outside the European Economic Area or use infrastructure located outside the EEA.

In such cases, data is transferred using mechanisms required by law, such as:

  • an adequacy decision issued by the European Commission;

  • standard contractual clauses approved by the European Commission;

  • other legally permitted safeguards.

Information about the safeguards used can be obtained by contacting the Controller.

11. Data retention

We retain data only for as long as necessary to achieve the purpose for which it is processed.

In particular:

  • order data is retained for the duration of contract performance and subsequently for the period necessary to handle legal claims;

  • accounting and tax documents are retained for the period required by law, generally five years calculated in accordance with the relevant tax provisions;

  • complaint data is retained while the complaint is being handled and until the limitation period for related claims expires;

  • correspondence is retained until the matter is closed and subsequently for a period justified by the possibility of bringing or defending legal claims;

  • data processed on the basis of marketing consent is retained until consent is withdrawn, an objection is raised or the marketing purpose ceases;

  • customer account data is retained while the account is active and, after its deletion, for the period necessary to fulfil legal obligations and protect legal claims;

  • data stored in cookies is retained for the period specified in the settings of the relevant cookie or until consent is withdrawn or the cookie is deleted;

  • information confirming that consent was given may be retained for the period necessary to demonstrate compliance with the law.

After the relevant periods expire, data is deleted or anonymised unless continued retention is required by law.

12. Rights of the data subject

Individuals whose data is processed may have the right to:

  • obtain information about data processing;

  • access their data and receive a copy;

  • have inaccurate data corrected or incomplete data completed;

  • have their data erased;

  • restrict processing;

  • data portability;

  • object to processing based on legitimate interests;

  • withdraw consent at any time;

  • not be subject to a decision based solely on automated processing where it produces legal effects or similarly significantly affects them.

The exercise of certain rights may be subject to restrictions imposed by law. For example, we cannot erase data that we must continue to retain to fulfil tax or accounting obligations.

To exercise your rights, please send a message to: kontakt@vimtech.pl.

Before acting on a request, we may ask for additional information to verify the identity of the person making it.

13. Right to lodge a complaint

Anyone who believes their data is being processed unlawfully has the right to lodge a complaint with:

The President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1A
00-014 Warszawa
https://uodo.gov.pl

We also encourage you to contact VIMTech first so that we can clarify the matter and respond to your concerns.

14. Automated processing and risk assessment

The store, Shopify and payment providers may use automated tools to detect fraud, assess transaction risk and ensure security.

VIMTech does not make decisions about customers based solely on automated processing that would produce legal effects or similarly significantly affect the customer, unless the customer is informed in advance or such action is permitted by law.

15. Cookies and similar technologies

The store uses cookies and similar technologies. These are small pieces of information stored on the user’s device or read when the website is used.

We may use the following types of cookies:

  • essential — necessary for the proper operation of the store, shopping cart, order processing, security and remembering settings;

  • functional — enabling selected user preferences to be remembered;

  • analytics — helping us understand how users interact with the store;

  • marketing — used to measure advertising effectiveness and tailor marketing communications.

Cookies other than essential cookies are used after obtaining the required consent.

Consent can be withdrawn or changed using the cookie preferences panel, if available in the store. Users can also change their browser settings or delete stored cookies.

Blocking essential cookies may cause some parts of the store, the shopping cart or the checkout process to function incorrectly.

16. Links to other websites

The store may contain links to websites, services or platforms operated by other entities. VIMTech is not responsible for the data processing practices of those entities.

Before providing data to another website, we recommend reviewing its privacy policy.

17. Children’s data

The store and the products offered in it are not intended for children who cannot independently enter into a valid contract under applicable law.

If the Controller learns that a child’s data has been provided without the required consent of a parent or guardian, the Controller will take appropriate steps to delete it, unless continued retention is required by law.

18. Data security

We apply appropriate organisational and technical measures to protect data against:

  • unauthorised access;

  • loss;

  • alteration;

  • disclosure;

  • destruction;

  • misuse.

However, no method of transmitting or storing data guarantees complete security. Users should protect their account login details and should not share digital product download links with unauthorised persons.

19. Changes to this Privacy Policy

This Privacy Policy may be updated following changes to:

  • legal provisions;

  • the operation of the store;

  • the scope of services offered;

  • the apps or providers used;

  • data processing methods.

The current version of the Privacy Policy is published in the VIMTech store together with the date of its last update. In the event of significant changes, we may also provide customers with additional information where required or justified.

20. Contact

For matters concerning this Privacy Policy or the processing of personal data, please contact:

VIMTech – Volodymyr Martsypaka
ul. Adama Mickiewicza 3/4
59-800 Lubań, Poland
Email: kontakt@vimtech.pl
Website: https://vimtech.pl