1. Who We Are and How to Reach Us
Vilmate Sp. z o.o. (“Vilmate”, “we”, “us”, or “our”) is a nearshore software development company providing web, mobile, and eCommerce development services to clients primarily in the United States and Europe.
We are the data controller for personal data collected through this website (vilmate.com) and related contact forms.
Registered address: Vilmate Sp. z o.o., 86/410 Hoża Street, 00-682 Warsaw, Poland
Data protection contact: [email protected]
2. Personal Data We Collect
We collect personal data in the following situations:
When you fill out a contact form, request an estimate, or book a call, we collect:
2.1 Data you provide directly
- Full name
- Email address
- Phone number (optional, when provided)
- Company name and role (optional, when provided)
- Project description and budget range
- Marketing consent status (whether you opted in to receive business communications)
2.2 Data collected automatically
When you browse our website, we may collect:
- IP address and approximate geographic location (country/city level)
- Browser type, device type, and operating system
- Pages visited, time spent, and navigation behavior
- Referring URL (how you found us)
- Cookie identifiers (see Section 5 for details)
2.3 Data from third-party tools
We use the following tools that may process data on our behalf:
- Google Analytics — website traffic analysis
- Google Tag Manager — tag and script management
- HubSpot CRM — contact management and marketing automation
- Hotjar — session recording and heatmaps to understand how visitors use our website
- LinkedIn Insight Tag — campaign measurement and audience insights
- Google reCAPTCHA — spam and abuse protection on our forms
- Cloudflare — content delivery and website security
3. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
- Responding to your enquiry or project request
- Preparing and sending a personalised service proposal
- Scheduling calls or meetings with our team
- Sending relevant business communications, where you have given consent
- Improving our website performance and user experience
- Complying with legal obligations
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA) and United Kingdom, we process your personal data on the following legal bases under GDPR Article 6:
- responding to business enquiries, protecting the security of our systems, and understanding how our website is used.Legitimate interests (Art. 6(1)(f)):
- sending marketing communications and placing non-essential cookies. You may withdraw consent at any time.Consent (Art. 6(1)(a)):
- where we are required to retain or process data under applicable law.Legal obligation (Art. 6(1)(c)):
- processing data necessary to deliver services where a contractual relationship exists.Performance of a contract (Art. 6(1)(b)):
5. Third Parties and Data Transfers
We may share your personal data with the following categories of recipients:
- Service providers acting as data processors on our behalf (e.g. HubSpot, Google, Hotjar, LinkedIn, Cloudflare)
- Subcontractors and partner companies, only when establishing cooperation and with your explicit knowledge
- Legal or regulatory authorities, if required by law
We do not sell your personal data to third parties.
Some of our service providers are based outside the EEA (including in the United States). Where personal data is transferred to a third country, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.
6. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website. Cookies are small text files stored on your device that help us provide and improve our services.
Types of cookies we use:
- Essential cookies: required for the website to function. Cannot be disabled.
- Analytics cookies: help us understand how visitors interact with our website (e.g. Google Analytics).
- Marketing/preference cookies: used to personalise content and, where applicable, serve relevant information.
On your first visit, you will be asked to accept or decline non-essential cookies via our cookie consent banner. You can change or withdraw your preferences at any time using the “Manage consent” option available at the bottom of every page, or through your browser settings.
For full details on the cookies we use, their purpose, and duration, please see our Cookie Policy.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Right of access: request a copy of the data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure: request deletion of your personal data.
- Right to restriction: ask us to limit how we use your data.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Note that certain requests (e.g. erasure) may affect our ability to process your enquiry or deliver services.
If you are located in the EEA or UK and believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
- Enquiry data (no contract formed): retained for up to 24 months from last contact.
- Client project data: retained for the duration of the engagement plus 2 years as required for legal and financial compliance.
- Marketing consent records: retained until you withdraw consent or request erasure.
- Website analytics data: retained per the settings of the respective analytics tool (see Cookie Policy).
9. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
- Access controls limiting data to authorised personnel only
- Confidentiality agreements (NDAs) with staff and contractors
- Secure infrastructure and regular security reviews
Vilmate holds ISO 27001 certification, which reflects our commitment to information security management.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.
Continued use of our website after changes are posted constitutes your acknowledgment of the updated policy.
Questions People Ask Before They Share Their Data
No. We never sell, rent, or trade your personal data. The information you share with us is used only to respond to your enquiry and, where you’ve agreed, to send relevant business communications.
You don’t have to provide it. If you do, it means you’re comfortable being contacted by phone for follow-up on your project request. If you’d rather communicate only by email, just leave the field blank.
We keep your enquiry data for a limited period (up to 24 months) in case you reach out again or we have a relevant update. After that, it’s deleted. You can ask us to remove it earlier at any time.
Not automatically. There is a separate checkbox on our forms for marketing consent. If you don’t check it, we’ll only contact you about your specific enquiry.
Email us at [email protected]. We’ll respond within 30 days. For deletion or access requests, we may need to verify your identity before acting.
Yes. Some are essential for the website to work; others help us understand how people navigate our site. You can control non-essential cookies through your browser settings or via our cookie consent banner. Full details are in our Cookie Policy.
Yes. We use these tools under data processing agreements that require them to handle your data according to GDPR standards. They act on our instructions, not independently.
Yes. Under GDPR, you have the right to access, correct, delete, or move your data, as well as object to certain types of processing. See Section 7 of this policy for the full list. If you feel we’ve mishandled your data, you can also file a complaint with your national data protection authority.