ShopVimCenter Privacy Notice
28 October 2026
This Notice explains how the Portuguese Company processes personal data for international ShopVimCenter accounts, programme applications, advertising cooperation and remuneration. It also explains the relationship with the ShopVimGrace account. Product purchase processing has its own checkout notice where the purposes or responsible entity differ.
1 Controller and contact
1.1. VIMGRACE, UNIPESSOAL LDA, NIPC 517626829, registered office and correspondence address Rua Direita, n.º 35, 1.º A, 9050-450 Funchal, Madeira, Portugal, is the controller for the ShopVimCenter processing described here. Contact manager@vimgrace.com, or the account support section for privacy requests. The email contact is available without an account. We verify a request proportionately and do not require a public post to exercise a right.
1.2. Where another organisation acts as a controller, joint controller or independent payment provider for a particular function, its identity and role are disclosed before the additional processing begins. A provider may have its own legal obligations rather than act solely on our instructions. Where appointment of a data protection officer is required, the relevant contact details are provided.
2 Information we process and sources
2.1. Account and application data include name or organisation name, contact details, login and verification records, country, legal capacity, programme status, application answers, social channel identifiers and relevant public channel information. The sources are you, your authorised representative, account activity and the public channels identified in an application. Where data are obtained from another source, we provide the information required by law within the applicable period, normally no later than one month and earlier where first contact or disclosure requires it.
2.2. Referral and programme information includes the referring creator code, referral time, a visitor identifier where tracking is consented to, account attribution, programme and level relationships, eligible order references, product calculation points, remuneration entries, corrections, withdrawals, approvals and relevant performance statistics. After registration, account attribution may be stored in our systems to perform the accepted programme. We do not ordinarily disclose buyers’ contacts or other participants’ individual earnings to a creator.
2.3. Payment and compliance information may include payee name, address, date of birth where required, tax residence and identifiers, business registration, invoice or receipt information, bank or payment account details and proportionate identity verification evidence. We collect only the fields needed for the relevant country and payment arrangement and may use an approved verification or payment provider.
2.4. Communications and content include support requests, programme messages, permission records, materials submitted for approval, placement links, available statistics and complaint evidence. Technical information includes IP address, device and browser information, login and security events, cookie choices and limited service logs. Optional browser tracking is described in the Cookie Policy.
2.5. Do not send health records, unnecessary identity documents or other sensitive information in an application or promotional report. If a specific lawful campaign needs additional sensitive or image data, we must explain the purpose, safeguards and legal basis separately before collection.
3 Purposes and legal bases
3.1. Account and application data are processed to provide the requested service, verify access, assess an application, connect the shared account and administer accepted programme terms. The basis is contractual necessity or steps requested before entering a contract, limited to data objectively required for those purposes. For a contact acting for an organisation, the basis is our legitimate interest in communicating with that organisation and administering its participation.
3.2. We process accounting, tax, reporting and legally required identity information to comply with applicable legal obligations. We identify the particular obligation and relevant country before collecting extra information. Creating an account does not make every possible tax or verification document necessary.
3.3. Our legitimate interests include preventing fraud, protecting accounts and intellectual property, checking genuine programme activity, resolving complaints, keeping proportionate business evidence and defending legal claims. We consider your interests and reasonable expectations, minimise the information and provide an objection process. This basis does not replace consent required for nonessential terminal tracking or unsolicited marketing.
3.4. Optional marketing email requires separate consent unless a lawful exception applies and is explained when the contact details are collected. Nonessential referral cookies and browser identifiers require prior consent. Uses of content or a person's likeness require the agreed permission and an applicable data protection basis. Consent may be withdrawn at any time through the stated contact or unsubscribe facility; withdrawal does not affect earlier lawful processing.
4 Shared account and recipients
4.1. Registration may create or connect your ShopVimGrace customer account as explained on the registration screen. We use the minimum account and programme data required for that connection. Closing ShopVimCenter does not automatically erase a customer account or purchase and tax records that must be retained, and privacy requests can cover either service.
4.2. Access is limited to authorised personnel who need it. Relevant recipients may include hosting, backup, email, security, technical support and identity verification providers acting under appropriate instructions; banks and payment providers; accountants, auditors, lawyers and regulators where necessary; and a specifically identified seller or service controller where a lawful connection requires disclosure. We do not grant programme participants a general customer contact database.
4.3. Before a new advertising, analytics or campaign platform receives personal data, we review the purpose, role, legal basis and transfer requirements and update the relevant notice or consent. We do not treat this general category list as permission to activate undisclosed advertising trackers.
5 Locations and international transfers
5.1. If a service involves making personal data available to a recipient outside the European Economic Area (EEA), we disclose the relevant transfer information and put the required safeguards in place before the transfer. This includes remote access by a separate controller or processor outside the EEA. General acceptance of these documents does not authorise unrestricted international access.
5.2. A transfer must be covered by an applicable adequacy decision or another lawful mechanism, such as the European Commission's Standard Contractual Clauses, together with any required assessment and supplementary safeguards. An adequacy arrangement limited to certified organisations may be used only for a covered recipient and processing activity. Exceptional derogations must not be used as a substitute for safeguards for routine transfers.
5.3. You may request information about a relevant transfer and a copy or description of its safeguards through the contact in section 1, subject to lawful redactions protecting others and confidential information. Additional transfer rules apply where required by another applicable law.
6 Retention
6.1. We retain active account information while needed for the service and the accepted programme, then erase or anonymise it unless a documented legal or dispute need requires restricted retention. Deleting a profile does not require destruction of tax documents, payment evidence or records needed for a live legal claim.
6.2. Our ordinary operational limits are: preregistration referral marker up to 30 days; identifiable referral and performance event statistics up to 12 months; routine security logs up to 30 days; rolling backups up to 30 days; and cookie choice up to 6 months. A documented security incident may require limited related evidence for longer. Anonymous aggregate statistics may be kept where reidentification is no longer reasonably possible.
6.3. Minimal evidence of optional marketing consent and withdrawal is retained for up to 3 years after withdrawal or the last marketing communication, where necessary for compliance or claims. It must not be reused for marketing. A minimal suppression record may be retained for as long as needed to honour an objection or withdrawal.
6.4. Accounting records and supporting documents subject to Portuguese record-keeping requirements are generally retained for 10 years. A specific legal requirement or unresolved proceeding may require longer retention of the relevant records. This period does not apply automatically to browsing history, identity images or support messages.
6.5. Pending applications are normally erased or anonymised within 6 months after a final decision unless the applicant requests continued consideration or a documented claim requires limited evidence. Support correspondence is normally retained during the matter and for up to 3 years after closure where needed for service evidence or claims. Unneeded identity images are erased after verification unless a specified legal obligation requires retention. A recorded legal hold is limited to the information and period actually needed.
7 Your rights
7.1. Where the GDPR applies, you may request access and a copy, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. You have an absolute right to object to direct marketing and may withdraw a consent at any time. These rights have legal conditions and exceptions; we explain any refusal and your complaint and judicial remedies.
7.2. We respond without undue delay and, under the GDPR, within one month of receiving a request. Where its complexity or the number of requests requires an extension, we notify you within that month and explain the reason; the extension must not exceed two further months. Requests are normally free. A fee or refusal is permitted only on a lawful basis, with reasons and information about available remedies.
7.3. You may complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados, at https://www.cnpd.pt, or another competent authority under applicable law, including the authority in your EEA habitual residence or workplace. You do not have to complain to us first.
8 Local privacy rights
8.1. Residents of other jurisdictions may have additional access, correction, deletion, consent, objection, appeal and regulator complaint rights. We apply these where the local law covers the processing, rather than assuming the GDPR displaces them. Contact us to identify the applicable request route; mandatory local response periods take priority where shorter.
8.2. Where applicable law provides rights to opt out of sale, sharing or targeted advertising, to use an authorised representative or to appeal a privacy decision, we provide the required means of exercising them and recognise legally applicable opt-out signals. Any covered activity and additional required information are disclosed before that activity begins.
8.3. Consent, information about processing abroad and complaint procedures must also meet any applicable local requirements. Contact us to exercise a right or obtain information about the competent privacy authority. Mandatory local rights are not excluded by the choice of Portuguese contract law.
9 Security and automated processing
9.1. We use appropriate organisational and technical safeguards, including role based access, authentication, controlled supplier access, recovery and incident processes. No system can promise absolute security. We assess and notify personal data breaches as required by applicable law.
9.2. Ordinary referral attribution, mathematical bonus calculation and error flags may be automated. A participant may request an explanation of the relevant transaction record and human review of a disputed result. This does not authorise a solely automated decision with legal or similarly significant effects without the lawful basis, information and safeguards required for that use.
10 Choice and updates
10.1. You may refuse optional marketing and optional cookies and still access the service and make purchases using required service functions. Refusing optional preregistration tracking can prevent recognition of an earlier referral; it does not authorise a cookie wall or imply consent through continued use. Existing lawful account attribution is a separate server record.
10.2. Material changes are published with a clear date and communicated where required. Where a change requires a new consent or other legal basis, it is not applied to that processing until the requirement is met. This Notice provides information and does not itself constitute consent.