Privacy Policy
This Privacy Policy explains how VIMPOL processes personal data when you use our website, contact us or use our customs services. It is issued under Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR; in Polish: RODO) and Polish data protection law.
1. Data Controller
The controller of your personal data is VIMPOL Spółka z ograniczoną odpowiedzialnością, Produkcyjna 105A, 15-680 Białystok, Poland, entered in the National Court Register (KRS) under number 0001114429, NIP 9662194404, REGON 529083798.
For any question about your personal data, contact us by e-mail at This email address is being protected from spambots. You need JavaScript enabled to view it. , by phone at +48 698 010 746, or by post at the address above.
We have not appointed a Data Protection Officer. All data protection matters are handled through the contact details above.
2. Whose Data We Process
- contact persons and representatives of our business clients;
- clients who are private individuals or sole traders; drivers carrying goods covered by our customs services;
- consignors and consignees of goods; job applicants;
- visitors to our website.
3. What Data We Process
- identification data: first name and surname;
- contact data: phone number, e-mail address, messenger account;
- professional data: job title and company name;
- driver data: details of the passport or other identity document, vehicle and trailer registration numbers;
- customs and tax identifiers: EORI number, NIP of a private individual or sole trader; bank account number;
- data contained in invoices, CMR consignment notes and customs documents; for job applicants: data contained in the CV and application;
- for website visitors: technical data such as IP address, browser type and cookie identifiers.
4. Where We Get the Data
We collect most data directly from you: through the contact form on our website, by e-mail, by phone, through messengers (WhatsApp, Telegram, Viber) or in person at our offices. Some data reaches us from other parties involved in the shipment. For example, a carrier or freight forwarder may send us a driver's details, and a client may send us details of the consignor or consignee. This is necessary to prepare and submit customs declarations and other documents for the shipment.
5. Purposes and Legal Bases
- Answering enquiries and providing consultations — Article 6 (1) (b) GDPR (steps taken at your request before entering into a contract) or Article 6 (1) (f) GDPR (our legitimate interest in replying to messages).
- Preparing offers, concluding and performing contracts — Article 6 (1) (b) GDPR; for contact persons of business clients and for drivers, Article 6 (1) (f) GDPR (our legitimate interest in performing the contract with our client).
- Preparing and submitting customs declarations and other documents to customs, veterinary, phytosanitary and quality inspection authorities — Article 6 (1) (c) GDPR (legal obligations under customs law, including the Union Customs Code) and Article 6 (1) (b) or (f) GDPR.
- Invoicing, accounting and tax obligations — Article 6 (1) (c) GDPR in connection with Polish accounting and tax law.
- Establishing, pursuing and defending legal claims, including debt collection — Article 6 (1) (f) GDPR.
- Sending news and offers about our services — Article 6 (1) (f) GDPR (direct marketing of our own services). We send such messages by e-mail, phone or messenger only with your consent where Polish law requires it (the Electronic Communications Law — Prawo komunikacji elektronicznej). You can withdraw consent or object at any time.
- Recruitment — Article 6 (1) (c) GDPR in connection with Article 22¹ of the Polish Labour Code for the data required by law, and Article 6 (1) (a) GDPR (your consent) for any other data you include in your application.
- Operating and securing the website — Article 6 (1) (f) GDPR. Website statistics (Google Analytics) and measuring and personalising our advertising (Google Ads, including remarketing) — Article 6 (1) (a) GDPR, only with the consent you give in the cookie banner.
6. Is Providing Data Mandatory?
Providing data is voluntary, but without the data required by customs and tax law we cannot prepare customs declarations, perform the contract or issue invoices. In recruitment, providing the data listed in the Labour Code is required to take part in the process.
7. Who Receives the Data
- customs authorities: the National Revenue Administration in Poland (KAS), HM Revenue and Customs in the United Kingdom (HMRC), and the customs authorities of Hungary and Slovakia;
- veterinary, phytosanitary and quality inspection authorities;
- providers of IT services that support our work: e-mail and office software, cloud storage, CRM, customs declaration software, website hosting;
- Google Ireland Limited as the provider of Google Analytics and Google Ads, only if you accept analytics and advertising cookies; inspection and survey companies, where a shipment requires it;
- accounting, legal and banking service providers, where needed to perform our obligations;
- courts and other public authorities, where the law requires it.
Messenger providers (WhatsApp, Telegram, Viber) process data you send through their apps under their own privacy policies.
8. Transfers Outside the European Economic Area
- United Kingdom — on the basis of the European Commission's adequacy decision, renewed on 19 December 2025 and valid until 27 December 2031.
- Ukraine — where the transfer is necessary to perform a contract with you or concluded in your interest, including customs formalities on routes to and from Ukraine (Article 49(1)(b) and (c) GDPR).
- Other countries — some of our IT service providers, including Google, may process data outside the EEA, in particular in the USA. In such cases transfers are based on a European Commission adequacy decision or on standard contractual clauses approved by the Commission.
9. How Long We Keep the Data
- customs documents and related correspondence — for the period required by customs law, at least 3 years from the end of the year in which the customs declaration was accepted, and longer if needed until claims arising from the contract become time-barred;
- accounting and tax documents — for the periods required by Polish accounting and tax law, generally 5 years from the end of the relevant year;
- contract data — until claims arising from the contract become time-barred under the Polish Civil Code;
- enquiries that did not lead to a contract — 12 months from our last contact;
- data used for marketing — until you object or withdraw your consent;
- job applications — until the end of the recruitment process; we do not keep CVs for future recruitment;
- website data — cookies as described in section 13 (session cookie until you close the browser, analytics cookies up to 2 years, advertising cookies up to 90 days); statistics in Google Analytics up to 14 months; server logs kept by our hosting provider only as long as needed to keep the website secure and fix technical problems.
10. Your Rights
You have the right to:
- access your data and receive a copy (Article 15 GDPR);
- have your data rectified (Article 16 GDPR);
- have your data erased (Article 17 GDPR);
- restrict processing (Article 18 GDPR);
- data portability (Article 20 GDPR);
- object to processing based on our legitimate interest, including direct marketing (Article 21 GDPR);
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR);
- lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
11. Automated Decision-Making
We do not make decisions about you based solely on automated processing, including profiling.
12. Data Security and Confidentiality
We protect personal data with technical and organisational measures appropriate to the risk. Only authorised staff have access to the data, and every employee is bound by a written confidentiality agreement.
13. Cookies
Our website uses cookies, small text files stored on your device. Strictly necessary cookies keep the website working and do not require consent. We use three types of cookies. Strictly necessary: a session cookie set by our content management system, which keeps the website and the contact form working and is deleted when you close your browser. Analytics: Google Analytics cookies (_ga, _ga_*), stored for up to 2 years, which show us how visitors use the website so that we can improve it. Advertising: Google Ads cookies (_gcl_au, _gcl_aw and similar), stored for up to 90 days, which measure the results of our ads and allow us to show our ads to people who have visited the website. Analytics and advertising cookies are set only after you accept them in the cookie banner. You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page. You can also block or delete cookies in your browser settings, although some parts of the website may then not work correctly.
14. Social Media
We run a company page on LinkedIn. When you interact with it, LinkedIn processes your data under its own privacy policy, and we may receive aggregated statistics about visits to our page.
15. Changes to This Policy
We may update this Privacy Policy when the law, our services or our tools change. The current version is always available on this page, with its effective date shown at the top.