Privacy Policy

Last updated: September 16, 2026

How Vending Sport collects, uses and protects the personal data of partners who use this portal.

1. Who we are

VENDING SPORT d.o.o. (OIB 50998046815, MBS 081269579), with its registered office at Draganići 18, 10000 Zagreb, Croatia, is the data controller responsible for the personal data processed through this partner portal. For any privacy question, or to exercise your rights, contact us at info@vendingsport.com.

2. What data we collect

• Account details: your name, email address, and a securely hashed password.
• Company details: company name, business address, VAT identification / OIB, and contact phone number.
• Banking details: IBAN and bank name, used for orders and invoicing.
• Reservation activity: the machines you reserve, quantities, prices and order status.
• Technical data: a session cookie that keeps you signed in, and basic server logs (such as IP address and timestamps) needed to operate and secure the service.

3. Why we use it, and our legal basis

• To create and manage your partner account and provide the portal — performance of a contract (Art. 6(1)(b) GDPR).
• To process reservations, orders, pricing and invoicing — performance of a contract.
• To secure the service, prevent fraud and abuse, and keep records — our legitimate interests (Art. 6(1)(f) GDPR).
• To comply with accounting, tax and other legal obligations — legal obligation (Art. 6(1)(c) GDPR).

We do not use your data for advertising, and we do not sell it.

4. How we protect your data

We apply appropriate technical and organisational measures. Passwords are stored only as hashes, never in readable form. Sensitive fields — your IBAN and VAT / OIB — are encrypted at rest. Access to partner data is limited to authorised Vending Sport administrators, and connections to the portal are protected with TLS encryption.

5. Who we share it with

We share data only with service providers that help us run the portal, acting as our processors under contract:

• our hosting provider, which stores the application and database within the European Union;
• our email provider (Resend), used to send transactional messages such as account and password emails.

Some providers may process data outside the European Economic Area; where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses. We may also disclose data where required by law.

6. How long we keep it

We keep your account and company data for as long as your partner account is active. After an account is closed, we retain data only as long as necessary for our legitimate business purposes and to meet legal, accounting and tax obligations, after which it is deleted or anonymised.

7. Your rights

Under the GDPR you have the right to access, correct, delete or receive a copy of your personal data, and to restrict or object to certain processing. To exercise any of these, contact us at info@vendingsport.com. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr).

8. Cookies

This portal uses a single essential cookie to keep you signed in during your session. It is required for the service to function and is not used for tracking or advertising.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised; significant changes will be communicated through the portal.

10. Contact

Questions about this policy or your data: info@vendingsport.com, or write to us at Draganići 18, 10000 Zagreb, Croatia.