1. Controller and contact details
The controller of personal data processed in connection with the vimsehs.pl website and the Provider's own processes is Vesta Usługi i Szkolenia Marcin Makowski, ul. Wrzosowa 33, 84-300 Lębork, Poland, VAT ID (NIP) 841-161-18-09, Polish business registry number (REGON) 771244908.
For all matters concerning data protection, including the exercise of the rights described below, you may contact us at kontakt@v-ims.pl or in writing at the registered address.
No data protection officer has been appointed. Data protection requests are handled by the business owner at the contact address indicated above.
2. Two roles: controller and processor
With regard to website visitors, people contacting us through the form, and representatives of customers and business partners, we act as the controller — we decide on the purposes and means of processing.
With regard to data entered into the VIMS platform by a customer organization — for example employee data, training participants, people involved in incidents or subcontractors — the customer is the controller. We process that data as a processor, solely on the customer's instruction and within the scope set out in the data processing agreement.
This distinction matters in practice: if you are an employee of an organization using VIMS and wish to exercise your rights regarding data held in the system, the correct recipient of your request is your employer as controller. We will forward such requests to the relevant organization.
3. Purposes, legal bases and scope of processing
- Handling enquiries from the contact form — name, e-mail address, organization name, message content. Basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (our legitimate interest in business correspondence).
- Creating and maintaining platform user accounts — e-mail address, account identifiers, authentication data, trusted device information. Basis: Art. 6(1)(b) GDPR (performance of a contract).
- Ensuring the security of the service — a security event log covering sign-in code delivery and verification, permission changes, data exports and reveals of specially protected data. Basis: Art. 6(1)(f) GDPR (protecting data and the service against unauthorized access).
- Billing, invoicing and accounting — customer billing data and contact persons. Basis: Art. 6(1)(c) GDPR (tax and accounting obligations) and Art. 6(1)(b) GDPR.
- Recording acceptance of legal documents — the person, document version and date of acceptance. Basis: Art. 6(1)(c) and (f) GDPR (accountability).
- Handling support requests and complaints — contact details of the reporting person and the description of the request. Basis: Art. 6(1)(b) and (f) GDPR.
- Website visit statistics based on analytics cookies — aggregated traffic data, without profiling and without linking to identifying data. Basis: Art. 6(1)(a) GDPR (your consent given in the cookie banner).
- Establishing, pursuing and defending claims — data required to evidence the course of the cooperation. Basis: Art. 6(1)(f) GDPR.
- Lone-worker monitoring (Lone Worker module) — geographic coordinates (GPS) of the device collected during an active monitoring session, including while the screen is locked and the application is running in the background or is not in use; device motion sensor readings (accelerometer and gyroscope), session status and alarm events. Location is disclosed to designated emergency contacts and responsible persons within the organization only in the event of an alarm (fall detection, lack of movement or SOS) or at the monitored person's request. Basis: Art. 6(1)(d) GDPR (protection of the person's vital interests) and Art. 6(1)(c) and (f) GDPR in connection with the duty to provide safe working conditions. A monitoring session starts only through the User's informed action and ends when it is disarmed.
- Development of fall and inactivity detection algorithms — anonymized motion feature vectors and the device model only, without a personal identifier, organization reference or location data. This data does not permit identification of a natural person. Basis: Art. 6(1)(f) GDPR (development and improvement of the effectiveness of safety functions).
- Confirmation of rounds, inspections and supervision, including fire-watch duties — optional geographic coordinates of the confirmation location, date and time, and the confirming person. Location is read once when the record is saved, and its absence does not prevent the event from being registered. Basis: Art. 6(1)(c) and (f) GDPR (demonstrating completion of inspection activities).
- Maintaining occupational accident and near-miss documentation — identification data of the injured person required by official document templates, including the Polish PESEL number and the type, series and number of an identity document, as well as a description of the circumstances, injuries sustained and health consequences. Basis: Art. 6(1)(c) GDPR in connection with Polish Labour Code provisions on determining the circumstances and causes of accidents at work and, for health data, Art. 9(2)(b) GDPR.
- Issuing personal protective equipment and workwear to persons outside the employee register (visitors, external-company personnel and drivers) — name, represented company or reason for the visit, details of issued equipment and a signature confirming receipt. Basis: Art. 6(1)(f) GDPR (safety of persons present on the premises and accountability for entrusted equipment).
- Recording a signature made on a device screen — an image of the handwritten signature together with the date and the activity it confirms (receipt of equipment, training confirmation or declaration). A signature is not collected where the person confirms the activity while signed in to their own Account. Basis: Art. 6(1)(c) and (f) GDPR (accountability).
3a. V-IMS mobile app — location data (Lone Worker module)
The V-IMS mobile app (Android) collects, transmits and stores precise device location (GPS) to enable the Lone Worker feature — protecting people who work alone through fall and inactivity detection and SOS alerts.
Location is collected only during an active monitoring session started by the User, including in the background — while the app is closed, minimized or the screen is locked. Outside an active session the app does not collect location in the background. Location may also be read once, in the foreground, when a round or inspection is confirmed.
- Data collected: precise location (GPS coordinates and accuracy), device motion sensor readings (accelerometer, gyroscope), session status, battery level and alarm events.
- Purpose: exclusively protecting the life and health of the User — detecting a fall or lack of movement, sending an SOS alert and passing the location to designated emergency contacts within the User's organization.
- Sharing: location is shared only with the designated emergency contacts and responsible persons of the User's organization and with our processors hosting the service in the EEA. It is not sold, not used for advertising or profiling and not shared with other third parties.
- Retention: for the duration of the session and afterwards for up to twelve months to clarify alarm events, unless it becomes part of the organization's accident documentation.
- User control: the User starts and disarms each session; the app shows information about the data collected before the system permission is requested; location permission can be withdrawn at any time in Android settings, which disables the Lone Worker feature.
4. Retention periods
- Contact form correspondence — up to three years from the end of the correspondence, unless a contract results from it.
- User account data — for the term of the agreement with the organization and then up to thirty days after it ends, unless the data processing agreement provides otherwise.
- Security event log — for the term of the agreement and afterwards for the period required for accountability, no longer than twenty-four months.
- Billing and accounting documents — five years from the end of the year in which the tax obligation arose.
- Data processed for claims — until the statutory limitation periods expire.
- Analytics data from cookies — as stated in the cookie table, no longer than twenty-four months.
- Location and telemetry data from a Lone Worker session — for the duration of the monitoring session and afterwards for the period necessary to clarify alarm events, no longer than twelve months, unless it becomes part of accident documentation maintained by the organization.
- Anonymized motion feature vectors used to improve fall detection — indefinitely, because they do not permit identification of a natural person.
- Occupational accident and incident documentation maintained in the platform — for the period specified by the customer as controller, in accordance with the employer's obligation to retain accident documentation.
- Records of equipment issued to persons outside the employee register and signatures made on a screen — for the period necessary to account for entrusted equipment and until the applicable limitation periods expire, as determined by the controller.
5. Recipients and processors
Data may be transferred to providers of services necessary to operate the website and platform: cloud and database infrastructure providers, e-mail and transactional messaging providers, website hosting providers and — to the extent required by law — our accounting office and legal advisers.
Every processor acting on our behalf operates under a data processing agreement and only to the extent necessary to deliver the service.
We do not sell personal data, do not share it with advertising networks or data brokers, and do not use it to build marketing profiles.
6. Processing location and transfers outside the EEA
VIMS platform and website data is processed in infrastructure located within the European Economic Area.
We do not envisage routine transfers to third countries. Should such a transfer become necessary, it will only take place under a mechanism provided for in Chapter V GDPR and this document will be updated accordingly.
7. Your rights
- The right of access to your data and to obtain a copy of it.
- The right to rectification of inaccurate or incomplete data.
- The right to erasure where we have no basis for further processing.
- The right to restriction of processing.
- The right to data portability for data processed under a contract or consent.
- The right to object to processing based on legitimate interest.
- The right to withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal.
- The right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
- The right to delete a platform user Account — a request may be submitted in the application, at app.v-ims.pl/usun-konto or by e-mail to kontakt@v-ims.pl. The Account and associated authentication data are deleted within thirty days after the request is confirmed. Account deletion does not cover data that the organization, as controller, is required to retain under applicable law.
8. Automated decisions and profiling
We do not take decisions based solely on automated processing that would produce legal effects for natural persons.
Algorithm-assisted functions in the platform — such as pre-reading the content of a safety data sheet — are supportive only. Their output is presented for human verification and is not recorded as a final finding without user confirmation.
Content submitted to AI functions and generated responses are not used by us to train, fine-tune or improve public or generally available AI models. In BYOK mode, processing by the selected model provider is governed by the agreement between the customer and that provider.
Fall and inactivity detection in the Lone Worker module takes place on the User's device and only triggers an alarm, which is always subject to human assessment: the monitored person may cancel the alarm before it is sent, and designated emergency contacts decide what action to take. Monitoring data is not used to make decisions producing legal effects for an employee, assess work performance or pursue disciplinary purposes.
12. Data security
We apply technical and organizational measures proportionate to the risk: encryption in transit, mandatory two-step authentication for platform accounts, database-level isolation of each organization's data, role-based access control, protection of attachments against access that bypasses permission checks, and a security event log.
A detailed description of the architecture and safeguards is published on our “Security and IT architecture” page, including an explicit list of functions we do not currently offer.
In the event of a personal data breach we act in accordance with Art. 33 and 34 GDPR and, when acting as processor, notify the controller without undue delay.
13. Changes to this policy
We update this policy when the scope of our services, the tools we use or applicable law change. The date of the last update and the version number are stated at the top of the document.
The current version is published at vimsehs.pl/en/privacy-policy together with the downloadable files.