Privacy Policy

I. General provisions

1. This Privacy Policy governs the manner in which the Administrator, i.e. VIMONI Smart Payment Services Sp. z o.o., with headquarters in Kraków 31-864, Życzkowskiego 14, collects, processes and stores personal data necessary for the provision of services electronically through the website in the domain www.vimonisps.pl and www.vimoni.pl (hereinafter: the Website).

2. The Administrator is the administrator of Users' personal data.

3. The processing of personal data shall be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: GDPR).

4. The data collected by the Controller shall be processed lawfully, factually correct, adequate in relation to the purposes for which they are processed and shall not be subject to further processing incompatible with those purposes. They are kept only as long as necessary to achieve the purpose of the processing.

II. Purpose and legal basis of data processing

1. The Administrator processes personal data necessary for the provision and development of the services offered and available through the Website and its individual functionalities.

2. Personal data are processed for the following purposes:

a. Registration of the account, verification of the User's identity and performance of the agreement for the provision of services by electronic means in accordance with the Act of 18 July 2002 on the provision of services by electronic means, including in particular by providing the possibility to use the User's account - on the basis of acceptance of the terms and conditions of the Regulations (Article 6(1)(b) GDPR).
b. Communicating with the User in order to provide him/her with the necessary information and to build a positive and reliable relationship with him/her, which constitutes the Administrator's legitimate interest (Article 6(1)(f) GDPR).
c. Promotion by the Administrator of its own products and/or services and those of its Partners by directing by e-mail marketing information (newsletter), provided that the User has agreed to receive such notifications by e-mail (Art. 6(1)(a) GDPR).
d. To provide access to information on news from the industry directly related to the Administrator's business, provided that the User has consented to receive such notifications by e-mail (Article 6(1)(a) GDPR).
e. For analytical and statistical purposes on the basis of the Administrator's legitimate interest consisting in the verification of User activity and User preferences in order to optimise the services and products as well as the applied functionalities of the Service (Article 6(1)(f) GDPR).
f. Possible establishment, assertion or defence of claims on the basis of the Administrator's legitimate interest in protecting its rights (Art. 6(1)(f) GDPR).

3. In each of the above-mentioned cases (paragraph 2), the provision of data is voluntary, but necessary for the conclusion of an agreement or the use of other functionalities of the Website.

III. Period of processing of personal data

1. Personal data shall be processed for the period during which the person remains an active User of the Website (has a User account), and thereafter for the period necessary to comply with the law, investigate or defend against possible claims, but no longer than 3 years calculated from the date of termination of the agreement on the provision of electronic services.

2. Data processed on the basis of consent shall be processed until the withdrawal of the consent granted, with the proviso that the withdrawal of such consent shall not affect the compliance of the data processing performed prior to such withdrawal.

IV. Information on data processing

1. Personal data, depending on the purpose of processing, may be disclosed to:

a. entities related to the Administrator,

b. entities cooperating with the Administrator,

c. subcontractors, in particular entities providing and operating selected IT systems and solutions,

d. entities handling online payments,

e. entities providing courier and postal services,

f. law firms.

2. Personal data processed by the Administrator will not be transferred outside the European Economic Area or to international organisations.

V. Rights of data subjects

1. The User of the Service has the right:

access to the content of his/her personal data,
rectification of data,
to have his/her data deleted,
restriction of data processing,
data portability,
to object to processing carried out on the basis of law or of the legitimate interest of the controller,
to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.

2. The user has the right to lodge a complaint with the President of the Office for the Protection of Personal Data (Prezes Urzędu Ochrony Danych Osobowych) if he/she considers that the processing infringes his/her rights and freedoms.

3. There is no automated decision-making, including profiling, in the processing of data.

VI. Final provisions

1. The Administrator reserves the right to make changes to this Privacy Policy, at the same time ensuring that the Users' rights under this document shall not be limited.

2. The User shall be informed of any changes to the Policy.