VIM-INT-EN-1.3 | Edition dated 16 October 2026

ShopVimCenter Privacy Notice

This Notice explains how the Portuguese Company processes personal data for international ShopVimCenter accounts, programme applications, advertising cooperation and remuneration. It also explains the relationship with the ShopVimGrace account. Product purchase processing has its own checkout notice where the purposes or responsible entity differ.

1 Controller and contact

1.1. VIMGRACE, UNIPESSOAL LDA, NIPC 517626829, registered office and correspondence address Rua Direita, n.º 35, 1.º A, 9050-450 Funchal, Madeira, Portugal, is the controller for the ShopVimCenter processing described here. Contact manager@vimgrace.com, telephone +351 300 509 080, or the account support section for privacy requests. The email contact is available without an account. We verify a request proportionately and do not require a public post to exercise a right.

1.2. If a particular campaign has a different controller, joint controller or independent payment provider, the relevant notice must identify that role before the additional processing begins. A service provider’s independent legal duties do not make it our processor for every purpose. No data protection officer appointment is asserted by this Notice; where an appointment is legally required, the contact details must be published.

2 Information we process and sources

2.1. Account and application information includes name or organisation name, contact details, login and verification records, country, declared legal capacity, programme status, application answers, social channel identifiers and relevant publicly available channel information. We receive this from you, your authorised representative, account activity and the public channels you identify.

2.2. Referral and programme information includes the referring creator code, referral time, a visitor identifier where tracking is consented to, account attribution, programme and level relationships, eligible order references, product calculation points, remuneration entries, corrections, withdrawals, approvals and relevant performance statistics. After registration, account attribution may be stored in our systems to perform the accepted programme. We do not ordinarily disclose buyers’ contacts or other participants’ individual earnings to a creator.

2.3. Payment and compliance information may include payee name, address, date of birth where required, tax residence and identifiers, business registration, invoice or receipt information, bank or payment account details and proportionate identity verification evidence. We collect only the fields needed for the relevant country and payment arrangement and may use an approved verification or payment provider.

2.4. Communications and content include support requests, programme messages, permission records, materials submitted for approval, placement links, available statistics and complaint evidence. Technical information includes IP address, device and browser information, login and security events, cookie choices and limited service logs. Optional browser tracking is described in the Cookie Policy.

2.5. Do not send health records, unnecessary identity documents or other sensitive information in an application or promotional report. If a specific lawful campaign needs additional sensitive or image data, we must explain the purpose, safeguards and legal basis separately before collection.

3 Purposes and legal bases

3.1. We process account information to provide the requested service, verify access, administer applications, operate the shared account and perform accepted programme terms. The legal basis is performance of a contract or steps requested before entering one, to the extent the processing is objectively necessary. For a contact acting for an organisation rather than as a contracting individual, our legitimate interest is communicating with the organisation and administering its participation.

3.2. We process accounting, tax, reporting and legally required identity information to comply with applicable legal obligations. We identify the particular obligation and relevant country before collecting extra information. Creating an account does not make every possible tax or verification document necessary.

3.3. Our legitimate interests include preventing fraud, protecting accounts and intellectual property, checking genuine programme activity, resolving complaints, keeping proportionate business evidence and defending legal claims. We consider your interests and reasonable expectations, minimise the information and provide an objection process. This basis does not replace consent required for nonessential terminal tracking or unsolicited marketing.

3.4. Optional commercial email uses your separate consent under the programme’s policy, unless a particular lawful exception has been verified and explained. Nonessential referral cookies or browser identifiers before registration use prior consent. Content and likeness uses are governed by the agreed permission and the separate lawful basis stated for personal data. Withdrawing consent does not affect processing lawfully carried out before withdrawal.

4 Shared account and recipients

4.1. Registration may create or connect your ShopVimGrace customer account as explained on the registration screen. We use the minimum account and programme data required for that connection. Closing ShopVimCenter does not automatically erase a customer account or purchase and tax records that must be retained, and privacy requests can cover either service.

4.2. Access is limited to authorised personnel who need it. Relevant recipients may include hosting, backup, email, security, technical support and identity verification providers acting under appropriate instructions; banks and payment providers; accountants, auditors, lawyers and regulators where necessary; and a specifically identified seller or service controller where a lawful connection requires disclosure. We do not grant programme participants a general customer contact database.

4.3. Before a new advertising, analytics or campaign platform receives personal data, we review the purpose, role, legal basis and transfer requirements and update the relevant notice or consent. We do not treat this general category list as permission to activate undisclosed advertising trackers.

5 Locations and international transfers

5.1. We use contracted infrastructure providers for service hosting, backups and email, subject to appropriate data protection and security arrangements. Our processing arrangements may involve recipients or authorised access outside the EEA. The safeguards below apply to any such transfer. You may request the relevant recipient and safeguard information from our privacy contact.

5.2. Where personal data is transferred outside the EEA, we use a valid adequacy decision or another lawful safeguard, normally the applicable European Commission Standard Contractual Clauses with a transfer assessment and supplementary measures where required. An EU US Data Privacy Framework adequacy route is available only for an actually certified recipient and covered data and activities. Routine transfers do not rely on an unlimited consent to worldwide access.

5.3. You may ask for information about the applicable safeguard and a copy or description, with lawful redactions to protect others and confidential security information. UK, Swiss and other local transfer requirements must also be addressed where applicable.

6 Retention

6.1. We retain active account information while needed for the service and the accepted programme, then erase or anonymise it unless a documented legal or dispute need requires restricted retention. Deleting a profile does not require destruction of tax documents, payment evidence or records needed for a live legal claim.

6.2. Our ordinary operational limits are: preregistration referral marker up to 30 days; identifiable referral and performance event statistics up to 12 months; routine security logs up to 30 days; rolling backups up to 30 days; and cookie choice up to 6 months. A documented security incident may require limited related evidence for longer. Anonymous aggregate statistics may be kept where reidentification is no longer reasonably possible.

6.3. Minimal proof of optional marketing consent and withdrawal may be kept for up to 3 years after withdrawal or the final marketing communication, for compliance and claims purposes, without reuse for marketing. A minimal suppression record may remain as long as reasonably needed to honour your opt out; it must not be used to target you.

6.4. Accounting records and supporting documents falling under Portuguese statutory retention are generally retained for 10 years under the applicable record keeping rules, or longer where a specific obligation or unresolved tax or legal proceeding requires it. This does not justify retaining every click, identity image or support message for 10 years. We apply the schedule to each category and review necessity.

6.5. Pending applications are normally erased or anonymised within 6 months after a final decision unless the applicant requests continued consideration or a documented claim requires limited evidence. Support correspondence is normally retained during the matter and for up to 3 years after closure where needed for service evidence or claims. Unneeded identity images are erased after verification unless a specified legal obligation requires retention. A recorded legal hold is limited to the information and period actually needed.

7 Your rights

7.1. Where the GDPR applies, you may request access and a copy, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. You have an absolute right to object to direct marketing and may withdraw a consent at any time. These rights have legal conditions and exceptions; we explain any refusal and your complaint and judicial remedies.

7.2. We normally respond within 1 month. If a request is complex or numerous, the GDPR permits an extension of up to 2 further months; we tell you within the initial month and explain why. Requests are ordinarily free. A fee or refusal is limited to legally permitted cases such as manifestly unfounded or excessive requests, with reasons and a review route.

7.3. You may complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados, at https://www.cnpd.pt, or another competent authority under applicable law, including the authority in your EEA habitual residence or workplace. You do not have to complain to us first.

8 Local privacy rights

8.1. Residents of other jurisdictions may have additional access, correction, deletion, consent, objection, appeal and regulator complaint rights. We apply these where the local law covers the processing, rather than assuming the GDPR displaces them. Contact us to identify the applicable request route; mandatory local response periods take priority where shorter.

8.2. Where a US state privacy law applies, relevant rights may include access, correction, deletion, portability, appeal and opting out of sale, sharing or targeted advertising. We describe any covered activity and the available choices in a supplementary notice before that activity begins, provide the legally required request methods and recognise applicable opt out signals. You may contact our privacy contact to exercise a right or appeal a decision where the law provides an appeal.

8.3. Where Canadian privacy law covers the processing, we apply the relevant meaningful consent, limited purpose, access, correction and accountability requirements. You may contact us about a request, a privacy decision or the safeguards for processing outside Canada, and may complain to the competent federal or provincial privacy authority. Any required additional provincial notice is provided for the relevant service.

9 Security and automated processing

9.1. We use appropriate organisational and technical safeguards, including role based access, authentication, controlled supplier access, recovery and incident processes. No system can promise absolute security. We assess and notify personal data breaches as required by applicable law.

9.2. Ordinary referral attribution, mathematical bonus calculation and error flags may be automated. A participant may request an explanation of the relevant transaction record and human review of a disputed result. This does not authorise a solely automated decision with legal or similarly significant effects without the lawful basis, information and safeguards required for that use.

10 Choice and updates

10.1. You may refuse optional marketing and optional cookies and still access the service and make purchases using required service functions. Refusing optional preregistration tracking can prevent recognition of an earlier referral; it does not authorise a cookie wall or imply consent through continued use. Existing lawful account attribution is a separate server record.

10.2. We publish material changes with a clear date, notify users where necessary and obtain fresh consent where a changed purpose requires it. The publication date and version are displayed with the live Notice.