1. Controller and contact
We, VIMGRACE, UNIPESSOAL LDA, are the controller for international services provided through the ShopVimGrace platform. Our NIPC and registration number is 517626829. Our address is Rua Direita, n.º 35, 1.º A, 9050-450 Funchal, Madeira, Portugal. Write to us at or this postal address about your personal data.
In this policy we explain how we process your information as the Portuguese company. The Russian company's services have a separate policy. We do not treat a change of interface language as your consent to share information with another company.
2. Information and purposes
To operate your account, we use your name, contact details, account identifier, access credentials and necessary account records. To handle your orders, we use product, quantity, delivery and billing details, recipient information, order identifiers, amounts, currency and payment status. To answer enquiries and assess claims, we use your correspondence and relevant attachments.
To operate and protect the site, we use IP addresses, browser and device information, request times, error records and security events. We treat these identifiers as personal data where they identify or relate to a person. We obtain information from you, a recipient you identify, and payment and delivery providers as necessary to handle your order.
If you separately join a promotion programme, we use the necessary contractual, identity, tax and payment information under its terms. We request additional programme documents only where needed for participation, rather than from every customer. Do not send unnecessary health information, full card credentials or identity-document copies in an ordinary support message.
3. Legal bases
We process information necessary to take steps at your request and perform a contract under Article 6(1)(b) GDPR. Necessary contact and delivery details are required for the relevant service; without them we cannot complete that service.
We process information to meet our tax, accounting, consumer and other legal obligations under Article 6(1)(c). For security, preventing abuse and establishing or defending claims, we may rely on legitimate interests under Article 6(1)(f). We assess necessity, proportionality and your rights before relying on that basis and use the information within those limits.
For optional marketing and non-essential tracking requiring consent, we obtain your specific prior consent under Article 6(1)(a) and applicable electronic communications law. You may refuse or withdraw consent and still make an ordinary purchase. We do not infer consent from visiting, buying or accepting general terms. Withdrawal does not affect the lawfulness of processing before it.
4. Recipients and location
We give authorised staff and service providers only the information needed for their function: fulfilment and delivery, payment and banking, technical support, accounting or legal assistance. We engage processors under contractual instructions and confidentiality and security obligations. Banks and other independent controllers also meet their own statutory responsibilities. We disclose information to public authorities where there is a lawful requirement or other valid legal basis.
We keep customer information private rather than publishing it because an order was placed. We disclose information to group companies only for specified purposes on a valid legal basis. Before publishing a review containing personal information, we establish an appropriate basis.
We hold international customer databases and backups in the European Economic Area. Before any international disclosure, including remote access, we establish a lawful basis and the safeguards required by Chapter V GDPR. Where relevant, we tell you which safeguards apply and how to obtain a copy. We assess a recipient's entitlement to receive information separately from the location of the database.
5. Retention and security
We retain account information while needed to provide your account and settle related obligations. We keep records required for Portuguese tax and accounting compliance for the statutory period, generally ten years for the relevant invoices and accounting records. For other account and browsing information, we determine retention according to its purpose and legal basis.
We keep enquiry and claim records to handle the matter and, where justified, for the relevant limitation period. We retain security logs for the time needed to maintain the service, investigate an incident or protect a specific claim. We delete or anonymise information processed only with consent when it is no longer needed or consent is withdrawn, unless another lawful retention basis applies.
When you close your account, we retain records required by law. We restrict backup information to recovery and remove it through the applicable retention cycle. If we restore a backup, we preserve any restrictions on further processing.
We protect information with organisational and technical measures proportionate to the risks, including access restrictions and incident procedures. Although no measure guarantees prevention of every incident, we remain responsible for our legal security and notification duties. Keep your access credentials private and notify our support team of suspected misuse.
6. Your rights
Subject to the conditions in GDPR, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and at any time to direct marketing, including related profiling. You may withdraw consent where it is the basis for processing.
Write to us using the contact in section 1 and identify the account or processing concerned. We may request additional identity information where reasonably necessary; we do not routinely require a full identity-document copy. We normally handle requests free of charge and respond within one month. Where the law permits an extension because of complexity or the number of requests, we explain the reasons within the first month and respond within up to two additional months.
If we make a decision based solely on automated processing that has legal or similarly significant effects on you, we first establish the legal basis and safeguards required by Article 22 GDPR. You retain the applicable rights to human intervention and to contest the decision.
You may complain to Comissão Nacional de Proteção de Dados at www.cnpd.pt or another competent supervisory authority, including the authority where you live or work. Contacting us first is helpful but is not a condition for exercising that right.
7. Browser storage and changes
We explain browser storage and your choices in our Cookie policy. When you use an independent payment service or another site, review its separate privacy information. We remain responsible for our own processing.
We publish changes with their effective date. Before processing information for an incompatible new purpose, we establish the required legal basis and provide further information where required. We obtain any necessary new consent separately; a policy update does not replace it.