Privacy Policy
How VR Master s.r.o. processes personal data of Dimenzum studio users and why.
Controller
VR Master s.r.o., Odbojárov 7, Michalovce, Slovensko, company ID 54154065. Send questions about personal data to [email protected].
This policy applies to people who use the Dimenzum studio (clients, agencies and their users). Customers who open experiences are covered by the separate Privacy in experiences notice.
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account and service | name, email, organisation, role, language, password in hashed form | contract, Art. 6(1)(b) GDPR | for the contract and 3 years after it ends |
| Subscription and invoices | billing details, VAT ID, payment history; card details are processed only by Stripe and never seen by us | legal obligation, Art. 6(1)(c) GDPR | 10 years under accounting law |
| Security and change history | records of sign-ins and changes to projects and settings (who and when) | legitimate interest, Art. 6(1)(f) GDPR | for the contract, at most 3 years |
| Service emails | email, language | contract | for the contract |
| Support | message content and attachments | contract and legitimate interest | 3 years after resolution |
We send marketing emails only with consent, which you can withdraw at any time. We do not use profiling or automated decision-making.
Cookies
The studio uses only two strictly necessary cookies: sign-in (dimenzum_session) and chosen language (dimenzum_lang). We do not use analytics or advertising cookies, so we do not ask for cookie consent.
We do not store IP addresses in our database. When pages are delivered, our server and the Cloudflare network process them briefly in technical logs to protect against attacks.
Who receives data
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | server and database | Germany, EU |
| Cloudflare, Inc. | network, attack protection, model storage | global, protected by standard contractual clauses and the EU-US framework |
| Stripe Payments Europe, Ltd. | payments and invoices | Ireland, EU (transfers to the US under standard contractual clauses) |
| [missing: poskytovateľ e-mailov] | sending emails | as per the provider agreement |
We do not sell data. We disclose it to public authorities only where required by law.
How we protect data
Encrypted connections (HTTPS), hashed passwords (scrypt), role-based access, change logs, regular backups and limits on sign-in attempts.
Your rights
You have the right to access, rectify and erase your data, restrict processing, data portability, to object and to withdraw consent. You can delete your account yourself under My account, and owners can download organisation data in its settings. Send other requests to [email protected]; we respond within 30 days.
If you believe we handle data incorrectly, you can lodge a complaint with the Slovak Office for Personal Data Protection (dataprotection.gov.sk) or the supervisory authority in your country of residence.
Effective from 1.11.2026.
In case of conflict between language versions, the Slovak version prevails.