1. Definitions
- Provider — Vesta Usługi i Szkolenia Marcin Makowski, ul. Wrzosowa 33, 84-300 Lębork, Poland, VAT ID (NIP) 841-161-18-09, contact address: kontakt@varilo.eu.
- VIMS platform (System) — the Varilo Integrated Management System software made available by the Provider as a browser-based service at app.v-ims.pl.
- Website — the informational site at v-ims.pl together with its subpages.
- Customer — a business, organizational unit or other entity entering into an agreement with the Provider for the use of the System in the course of its activity.
- User — a natural person granted access to the System by the Customer within its Organization (employee, contractor, subcontractor).
- Organization — the Customer's separated data space in the System, containing its registers, documents and tasks.
- Account — an individual set of User data enabling access to the System after authentication.
- Customer Data — all data and content entered into the System by the Customer or its Users, including incident registers, risk assessments, documents and attachments.
- Agreement — the agreement for the provision of access to the System concluded between the Provider and the Customer, of which these terms form an integral part.
- Terms — this document.
2. General provisions and scope of the service
The Provider grants the Customer access to the System through a web browser, without the need to install software on the Customer's infrastructure. The service covers hosting and maintenance of the System, its updates and support handling to the extent described in these Terms and in the Agreement.
The System supports the management of occupational safety, environmental protection, fire safety, quality and compliance processes. The System does not replace statutory obligations or decisions made by the Customer's own functions, and it does not constitute legal advice or occupational safety consultancy.
The service is addressed to entities conducting business or professional activity. The Agreement is not a consumer contract and the System is used in connection with the Customer's activity.
The scope of modules made available, the number of Users and the commercial terms are agreed individually and confirmed in the Agreement, an offer or an order accepted by the Provider.
3. Technical requirements
Using the System requires a device with internet access, a current web browser with JavaScript and browser storage enabled, and an active e-mail address assigned to the Account.
Signing in requires two-step authentication. After the e-mail address and password are provided, the System sends a one-time code to the Account's e-mail address. The code is valid for ten minutes, the number of attempts is limited, and a new code can be requested after a short cooldown. A User may mark a device as trusted, which reduces how often the code is required for a defined period.
Disabling essential cookies or local storage in the browser prevents signing in and using the service.
4. Conclusion of the Agreement, registration and access
The Agreement is concluded when the Provider confirms that an Organization has been made available to the Customer — on the basis of a signed Agreement, an accepted order or an accepted offer, depending on the agreed mode of cooperation.
Registering an Account requires acceptance of these Terms and acknowledgement of the personal data processing information. The acceptance is recorded in the System together with the document version and date.
Creating an Account does not automatically grant access to Organization data. Joining an Organization requires approval by its owner or administrator. Until approval is granted, the User has no access to operational data.
The Customer is responsible for granting and revoking permissions for its Users, including prompt revocation of access for individuals who have ended their cooperation with the Customer.
5. Rules for using the System
The Customer and its Users must use the System in accordance with the law, these Terms and the intended purpose of the service, protect their authentication credentials and refrain from sharing Accounts with third parties. Each Account is assigned to one natural person.
It is prohibited to interfere with the operation of the System, in particular to attempt unauthorized access to data of other Organizations, to circumvent access controls, to perform automated bulk data extraction, or to conduct load or security testing without the Provider's prior written consent.
The Customer undertakes not to enter unlawful content into the System, nor data exceeding the purpose of the processes carried out in it. The Customer decides independently on the scope of personal data entered into the System and is responsible for its adequacy.
The Provider may temporarily restrict access to a User's Account where there is a justified suspicion of a security breach, informing the Customer without undue delay.
6. Fees, invoices and payments
Use of the System is subject to fees agreed with the Customer in the Agreement, an offer or an order. Value added tax at the applicable rate is added to the agreed amounts.
Settlement is based on an invoice issued by the Provider. Invoices are delivered electronically to the billing e-mail address indicated by the Customer, to which the Customer consents by concluding the Agreement.
Access to the System for a given billing period is activated or maintained once the payment has been credited to the Provider's bank account, unless the parties agree otherwise.
Where payment is delayed by more than fourteen days, the Provider may suspend access to the System until the arrears are settled, after sending a prior reminder to the Customer's e-mail address. Suspension of access does not mean deletion of Customer Data.
The Provider may change the fees for a subsequent billing period, informing the Customer at least thirty days before the planned change. A Customer who does not accept the change may terminate the Agreement as described in these Terms.
7. Term, termination and end of cooperation
The Agreement is concluded for an indefinite period, unless the parties agree on a fixed term.
Either party may terminate the Agreement with one month's notice, effective at the end of the calendar month following the month in which notice was given. Notice must be given in writing or sent to the other party's e-mail address.
The Provider may terminate the Agreement with immediate effect in the event of a gross breach of these Terms by the Customer or its Users, in particular actions endangering the security of other Organizations' data, after an unsuccessful request to cease the breach.
Before the Agreement ends, the Customer may download an archive of its Organization data directly from the System. This right is available to the Organization owner and administrator, and each export is recorded in the security event log.
After the Agreement ends, Customer Data is deleted or returned in the manner and within the period set out in the data processing agreement. The Provider does not retain data as leverage for renewing the cooperation.
8. Availability, maintenance and changes to the System
The Provider aims to keep the System continuously available, subject to interruptions resulting from maintenance, updates and events beyond the Provider's control, including failures at infrastructure and telecommunications suppliers.
The Provider does not publish a guaranteed availability level as a commercial standard. Where the Customer requires a contractual commitment in this respect, its terms are agreed individually in the Agreement.
The Provider may develop the System, add and modify functions and withdraw functions replaced by newer solutions. Changes may not materially reduce the agreed scope of the service without informing the Customer at least thirty days in advance.
9. Intellectual property and Customer Data
All rights to the System, including its software, interface, documentation, the VIMS and Varilo trademarks and materials published on the Website, remain with the Provider or the entities from which the Provider obtained the relevant rights.
For the term of the Agreement the Customer receives a non-exclusive, non-transferable right to use the System to the extent necessary to run its own processes. This right does not include copying, decompiling, resale or making the System available to third parties, except for serving the Customer's own clients under the model provided for occupational safety service providers, where such scope has been agreed in the Agreement.
Customer Data remains the property of the Customer. The Provider uses it solely to deliver the service, handle support requests and meet statutory obligations.
The Provider may use aggregated, anonymized technical information about how the System is used in order to develop it, provided that such information does not allow identification of the Customer or of natural persons.
10. Liability
The Provider is responsible for the proper provision of the service in accordance with these Terms and the Agreement. The Provider is not responsible for the consequences of decisions taken by the Customer on the basis of data held in the System, nor for the compliance of the Customer's processes with the law.
The Provider is not liable for the consequences of authentication credentials being disclosed to unauthorized persons by the Customer or a User, for the content and scope of data entered into the System, or for lack of access caused by circumstances attributable to the Customer, including its network and device configuration.
The Provider's liability for damage caused to the Customer is limited to the fees paid by the Customer for the twelve months preceding the event giving rise to the claim. This limitation does not apply to damage caused intentionally or where limitation of liability is not permitted by law.
The parties exclude liability for lost profits to the extent permitted by law.
11. Security and personal data protection
The Provider applies the technical and organizational measures described in the Privacy policy and in the data processing agreement, in particular database-level isolation of each Organization's data, encryption in transit, access control and a security event log.
With regard to personal data entered into the System, the Customer acts as controller and the Provider as processor. The processing conditions are set out in the data processing agreement annexed to the Agreement.
System data is processed in infrastructure located within the European Economic Area.
12. Complaints and incident reporting
Complaints and reports of malfunctions should be sent to kontakt@varilo.eu, indicating the Organization, a description of the problem, when it occurred and, where possible, a screenshot.
The Provider handles a report within fourteen days of receipt and, in matters requiring further investigation, informs the Customer of the expected resolution date.
Reports concerning critical unavailability of the System are handled first, regardless of the order of receipt.
13. Changes to these Terms
The Provider may amend these Terms in the event of changes in the law, changes to the scope or manner of providing the service, the introduction of new System functions, or organizational changes at the Provider.
The Customer is informed of amendments by e-mail to the address assigned to the Organization or by a notice in the System, at least fourteen days before the changes take effect.
If the Customer does not accept the amendments, it may terminate the Agreement with one month's notice. Continued use of the System after the changes take effect constitutes their acceptance.
14. Final provisions
These Terms and the Agreement are governed by Polish law. Disputes arising from the Agreement are submitted to the court having jurisdiction over the Provider's registered seat.
If any provision of these Terms is invalid, the remaining provisions remain in force and the parties will replace the invalid provision with one of similar economic effect.
The relationship between the parties is governed jointly by: these Terms, the Privacy and cookie policy, and the data processing agreement.
Version 1.0 of these Terms applies from 2026-09-26. The current version is published at v-ims.pl/en/terms.