Machines
Products
Places
Locations
About Us

Explore Alnos Vending

Learn More

Get Started

GuidesFAQ
Contact

PL · EN

Alnos Vending Privacy Notice

Last updated: 9 October 2026

This notice explains how Alnos Vending processes the personal data of people who visit www.alnosvending.pl, contact us (using the forms on the website – Golden Ticket, Support, Careers – by email, phone, WhatsApp or social media), report a fault or apply for a job, or work with us on behalf of businesses and site owners. It is the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council; in Polish: RODO).

1. Who Is the Controller of Your Data

The controller is Alnos Vending spółka z ograniczoną odpowiedzialnością (a Polish limited liability company; "Alnos Vending", "we", "us").

  • Registered office and address: ul. Jana i Jędrzeja Śniadeckich 20D/7, 35-006 Rzeszów, Poland
  • Correspondence address: Borowina Sitaniecka 49D, 22-400 Zamość, Poland
  • KRS 0001172105 – District Court in Rzeszów, XII Commercial Division of the National Court Register
  • NIP (tax ID) 5170459183, REGON 541693056, share capital PLN 5,000.00
  • Email: hello@alnosvending.pl
  • Phone: +48 84 300 10 10

Data protection officer. We have not appointed a data protection officer (DPO), because we are not required to. For anything about personal data, write to hello@alnosvending.pl (ideally with the subject "Personal data") or to our correspondence address.

2. Key Points in Brief

  • We process the data you give us yourself (e.g. in a form on the website, in an email or a WhatsApp message) and basic technical data from the website (hosting server logs).
  • We do not sell data, and we do not send marketing messages without your prior consent.
  • We use only essential cookies from the Wix platform. We do not run Google Analytics, advertising pixels or a cookie-consent banner – because there are no cookies that require consent. Details: Cookie Policy.
  • Some of our providers (e.g. Wix, WhatsApp, Microsoft, SpaceXAI) may transfer data outside the European Economic Area (EEA), including to the USA. See section 7.
  • You have the rights described in section 9, including the right to complain to the President of UODO (the Polish data protection authority).

3. Purposes, Legal Bases and Retention Periods

3.1. The “Golden Ticket” Form and Email

You can send a machine enquiry (“Golden Ticket”) using the form on the Contact page or by email to hello@alnosvending.pl. The form runs on Wix Forms (Wix.com Ltd. as our processor). We save the submission in the Wix dashboard, and a copy is emailed to request@alnosvending.pl. We save the contact details from the form (first and last name, email, phone, company) as a contact in the Wix system so that we can continue the correspondence.

  • What data: first and last name, email, phone (optional), company name, city, team size / number of people on site, the types of machines you are interested in, the content of your message and any other data you choose to give in the email and, for the form, the page language and the address of the page the enquiry was sent from.
  • Purpose: replying to your enquiry, preparing an offer, agreeing terms of cooperation.
  • Legal basis:
    • Article 6(1)(b) GDPR – where you act on your own behalf (e.g. as a sole trader) and ask for an offer, or conclude or perform a contract with us;
    • Article 6(1)(f) GDPR – our legitimate interest in answering enquiries and in business contact, where you write on behalf of a company or institution.
  • How long: until the matter is dealt with and, if no cooperation follows, for up to 12 months from the last contact. If we conclude a contract, we keep the data as described in section 3.5.

3.1a. Service Requests (the “Support” Form)

You can report a machine fault, a missing product or a payment problem using the form on the Support page, by phone or by email to help@alnosvending.pl. The form runs on Wix Forms. We save the submission in the Wix dashboard, and a copy is emailed to help@alnosvending.pl.

  • What data: first and last name, email, phone, the name of the business or organisation where the machine stands, the machine's address and city, the machine ID, the type and description of the problem (e.g. date, time and amount of a payment), an optional photo, and the page language and page address.
  • Purpose: handling the request, repairing the machine, dealing with complaints and refunds.
  • Legal basis: Article 6(1)(b) GDPR (the sales contract made at the machine); Article 6(1)(c) GDPR (handling a consumer complaint); Article 6(1)(f) GDPR (our legitimate interest in keeping machines working and in contact with the host site, where you write on behalf of a company).
  • Photos: please make sure the photo shows no people and no documents with personal data. You can email a photo of the fault to help@alnosvending.pl, quoting the machine ID. A photo sent by email is kept in our Microsoft 365 mailbox, which only authorised Alnos Vending staff can access.
  • How long: service requests – up to 12 months after the request is closed; complaints and data needed for accounting – until the limitation periods for claims and the periods required by tax and accounting law expire (section 3.8).
  • Out-of-court dispute resolution: Alnos Vending does not agree to out-of-court resolution of consumer disputes (ADR). A request sent with the “Support” form is not a request for such a procedure.

3.2. Phone

Our number +48 84 300 10 10 runs on Microsoft Teams Phone.

  • What data: your phone number, the date, time and duration of the call, and what you tell us during the call and we note down to deal with your matter.
  • Purpose and legal basis: as in section 3.1 (Article 6(1)(b) or (f) GDPR).
  • Recording: we do not record phone calls. If this changes, we will tell you at the start of the call.
  • How long: notes – as in section 3.1; call history – up to 12 months.

3.3. WhatsApp Business

Details of contact via WhatsApp are in section 4.

3.4. Recruitment (the “Careers” Form and Email)

You can apply using the form on the Careers page or by email to careers@alnosvending.pl. Please email your CV to careers@alnosvending.pl with your name in the subject line. We don't advertise specific positions – in your application you tell us what work you're interested in. The form runs on Wix Forms (Wix.com Ltd. as our processor). We save the application in the Wix dashboard, and a copy is emailed to careers@alnosvending.pl. A CV sent by email is kept in our Microsoft 365 mailbox, which only authorised Alnos Vending staff can access. We do not add candidates to our contacts system (CRM). Please don't include a photo – we don't need one.

  • What data: first and last name, phone, email, location, the kind of work you are interested in, CV, and the information you choose to give.
  • Purpose: considering your application and running the recruitment.
  • Legal basis:
    • Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code – the data an employer may require from a job candidate;
    • Article 6(1)(b) GDPR – steps taken at your request before entering into a contract (an employment contract or a civil-law contract);
    • Article 6(1)(a) GDPR (consent) – additional data you give on your own initiative, and taking part in future recruitment if you give separate consent to that. You can withdraw consent at any time;
    • Article 6(1)(f) GDPR – establishing, pursuing or defending claims related to recruitment.
  • Please don't include a photo, and don't put special-category data (e.g. about your health), criminal-record data or your PESEL number in your CV or the form.
  • How long: until the recruitment ends (when we tell you our decision on your application) and then for up to 3 months (in case of claims). If you consent to future recruitment – for up to 12 months from your application, or until you withdraw consent if earlier.

The form has two separate consents (both voluntary and unticked by default; you can send the application without them): to the processing of additional data you choose to give beyond the data in Article 22¹ of the Labour Code (Article 22¹a of the Labour Code) – without this consent we only take the Article 22¹ data into account; and to taking part in future recruitment – in that case we keep your data for up to 12 months from your application. You can withdraw either consent at any time by writing to careers@alnosvending.pl or hello@alnosvending.pl.

3.5. Working with Businesses and Site Owners (Contact Persons and Representatives)

This covers people who represent our customers, business partners and site hosts (owners or managers of places where machines may be installed), or who are named as contact persons.

  • What data: first and last name, position, business email and phone, company name; we may receive these from you or from the company you work for or represent.
  • Purpose and legal basis:
    • concluding and performing a contract – Article 6(1)(b) GDPR (if you are a party to the contract);
    • day-to-day business contact and establishing, pursuing or defending claims – Article 6(1)(f) GDPR (our legitimate interest);
    • tax and accounting obligations – Article 6(1)(c) GDPR.
  • How long: for the term of the contract, and then until the limitation periods for claims and the document retention periods required by tax and accounting law expire (usually 5 years from the end of the year in which the tax payment deadline fell).

3.6. Social Media

We run Alnos Vending profiles on Facebook, Instagram, LinkedIn, X (Twitter), YouTube and Threads. Our website only contains links to these profiles – we do not embed plug-ins or players that send data to these services before you click on them.

  • What data: your profile name and picture, the content of comments, reactions and messages you send us, and other data publicly visible on your profile.
  • Purpose and legal basis: running our profiles, informing people about our business, replying to comments and messages – Article 6(1)(f) GDPR (our legitimate interest).
  • Page statistics (joint controllership): the platform operators give us aggregated statistics about how users interact with our profiles. For this we are joint controllers (Article 26 GDPR), as the Court of Justice of the EU held in case C-210/16 Wirtschaftsakademie:
    • Facebook, Instagram and Threads: with Meta Platforms Ireland Limited, under the "Page Insights Controller Addendum": https://www.facebook.com/legal/terms/page_controller_addendum. Meta is responsible for the main obligations towards users, including handling their rights;
    • LinkedIn: with LinkedIn Ireland Unlimited Company, under the "Page Insights Joint Controller Addendum": https://www.linkedin.com/legal/l/page-joint-controller-addendum. LinkedIn is responsible for the main obligations towards users, including handling their rights.
    • You can exercise your rights directly with the platform operator or with us – we will pass your request on.
  • Apart from the statistics, the platform operators are separate controllers and process data under their own rules: Meta – https://www.facebook.com/privacy/policy, LinkedIn – https://www.linkedin.com/legal/privacy-policy, X – https://x.com/privacy, YouTube / Google – https://policies.google.com/privacy.
  • How long: as long as the comment or message is visible on our profile, or until you make a successful objection; messages that lead to cooperation – as in section 3.1 or 3.5.

3.7. Cookies, Hosting and Server Logs

The website runs on the Wix platform (Wix.com Ltd.). We use only essential cookies needed for the website to work, for security and for the session. They do not require consent (Article 399(3) of the Act of 12 July 2024 – Electronic Communications Law / Prawo komunikacji elektronicznej). We do not use analytics or marketing cookies and we do not show a cookie-consent banner.

The forms on the website (Golden Ticket, Support, Careers) run on Wix Forms. Only after you click “Send” does your browser get an anonymous visitor identifier (token) from Wix and save it in the browser's local storage (localStorage), so that the form can be sent. This technology is strictly necessary to provide the service you ask for, so it does not require consent (Article 399(3) of the Electronic Communications Law). We protect the forms from spam with a hidden field and a minimum completion time, and Wix also filters spam automatically. This is not used for profiling or for making decisions about you. We don't use reCAPTCHA or any other cookies to protect against spam.

  • What technical data: IP address, date and time of the request, browser and device type, URL visited and session identifiers stored in essential cookies – to the extent Wix records them in server logs and hosting infrastructure.
  • Purpose and legal basis: running the website, security and diagnostics – Article 6(1)(f) GDPR (our legitimate interest).
  • How long: according to each cookie's lifetime (usually session cookies – until you close the browser) and Wix's log retention.
  • More information, including the cookie list: https://www.alnosvending.pl/polityka-plikow-cookie.

If we later add analytics or marketing tools, we will update this notice and the Cookie Policy and – where required – ask for consent before switching them on.

3.8. Legal Obligations and Claims

Independently of the purposes above, we may process data:

  • to meet obligations under the law, e.g. tax and accounting law – Article 6(1)(c) GDPR – for the period required by law;
  • to establish, pursue or defend claims – Article 6(1)(f) GDPR – until the limitation periods expire.

3.9. Marketing

We do not run a newsletter. We do not send commercial information (including direct marketing) by email, text message, phone or messaging apps, including WhatsApp, without your prior consent (Article 398 of the Polish Electronic Communications Law). If you give such consent, you can withdraw it at any time, and we process the data until you withdraw it (Article 6(1)(a) and (f) GDPR).

4. WhatsApp Business

How it works. At Alnos Vending, Jacob Sloan (number +48 84 300 10 04) and Aleksandra Sloan (number +48 84 300 10 05) use WhatsApp. Each of them uses the WhatsApp Business app on their own phone (iPhone). We reply to messages from people who have written to us first, and continue those conversations. Our first reply includes a link to this notice: alnosvending.pl/rodo.

  • What data: your phone number, your WhatsApp profile name and picture (to the extent visible), the content of messages, attachments (photos, documents, voice notes), and technical message data (date and time, delivery and read status).
  • Purpose: replying to your enquiry, preparing an offer and taking steps before a contract, contact during cooperation, handling requests.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract, and performing a contract if you are a party to it) or Article 6(1)(f) GDPR (our legitimate interest in answering enquiries and in business contact, where you write on behalf of a company).
  • Offers and contracts are not sent as chat text – we send them as PDF documents.

WhatsApp's role.

  • In the EEA, the WhatsApp Business app is provided by WhatsApp Ireland Limited (a Meta company) under the "WhatsApp Terms for WhatsApp Business App".
  • WhatsApp messages are end-to-end encrypted – WhatsApp has no access to their content. Conversations are stored on the participants' devices, which on our side means Jacob Sloan's and Aleksandra Sloan's phones.
  • For the customer contact data we make available to WhatsApp in the app (e.g. phone numbers), WhatsApp Ireland Limited acts as our processor, under the "WhatsApp Business Data Processing Terms".
  • Otherwise, WhatsApp Ireland Limited is a separate controller of your WhatsApp account data and of data about your use of the service (e.g. metadata: when and with whom you communicate). It processes these under its own terms and privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.

Transfers outside the EEA. WhatsApp Ireland Limited may transfer data to the USA and other countries outside the EEA, in particular to WhatsApp LLC and Meta Platforms, Inc. (USA). The safeguard is the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework – WhatsApp LLC and Meta Platforms, Inc. are certified under it (checked on https://www.dataprivacyframework.gov on 7 Oct 2026) – and, where needed, the standard contractual clauses adopted by the European Commission.

iCloud backups. We do not switch on automatic WhatsApp backup to iCloud on the phones used for business contact. Conversations stay on the devices (end-to-end encryption).

How long we keep chats. We keep conversations on Jacob Sloan's and Aleksandra Sloan's phones. If a conversation does not lead to a contract, we delete it by hand 12 months after the last message. If it leads to a contract, we keep the information needed as described in section 3.5. If you ask, we will delete a conversation earlier, unless we must keep it for legal reasons.

How to opt out. If you do not want to receive messages from us, write "STOP" or block our number in WhatsApp. Deleting the chat on your phone does not delete our copy – if you want us to delete it, tell us on WhatsApp or at hello@alnosvending.pl.

No marketing without consent. We do not send marketing messages or unsolicited offers via WhatsApp to anyone who has not given prior consent (Article 398 of the Polish Electronic Communications Law). We keep a record of every such consent.

5. Vending Machines

Once we launch our machines, information about data processing linked to using a machine (e.g. transaction cameras, payments, complaints) will be made available on the machine itself (e.g. via a QR code).

6. Who We Share Data With

Data may be received – only to the extent needed for the purpose concerned – by:

  • Wix.com Ltd. (Israel) – as our processor: website hosting and operation, server logs and forms (Wix Forms), including storing submissions and contacts, and sending email notifications. Wix uses sub-processors, including in the USA (section 7). Israel has a European Commission adequacy decision;
  • Microsoft Ireland Operations Limited – Microsoft 365 (email, Teams, Teams Phone, file storage);
  • WhatsApp Ireland Limited – WhatsApp Business app (section 4);
  • Biuro Rachunkowe „SPINACZ” Agata Kowalczyk – bookkeeping, invoices and settlements;
  • SpaceXAI LLC (USA) – AI assistants (Grok Bot) that help handle company correspondence and Teams work when such content is made available to them in company tools;
  • legal and tax advisers – where needed;
  • postal operators and courier companies – when we send documents or parcels;
  • public authorities and courts – where the law requires it.

Providers that process data on our behalf do so under data processing agreements and only on our instructions. We do not sell data.

7. Transfers Outside the European Economic Area

Some providers (or their subcontractors) may process data outside the EEA:

  • USA – Meta Platforms, Inc., WhatsApp LLC, Microsoft Corporation and SpaceXAI LLC. The safeguard is the European Commission's decision of 10 July 2023 on the EU–US Data Privacy Framework (for certified companies – the list is at https://www.dataprivacyframework.gov) and – in particular for SpaceXAI LLC and where needed for other recipients – the standard contractual clauses adopted by the European Commission (module 2 or 3 of Decision 2021/914);
  • Israel – Wix.com Ltd., under the European Commission's adequacy decision. Onward transfers by Wix to subcontractors in the USA and other countries (including Wix.com Inc. and Amazon Web Services) – including form submissions – take place under the European Commission's decision of 10 July 2023 on the EU–US Data Privacy Framework (for certified subcontractors) or under standard contractual clauses and other safeguards in Wix's Data Processing Addendum – Users (https://www.wix.com/about/privacy-dpa-users) and Wix's sub-processor list.

You can ask us for information about these safeguards and for a copy of the relevant documents – write to hello@alnosvending.pl.

8. Retention Periods – Summary

  • Enquiries (the “Golden Ticket” form, email, phone, WhatsApp) that do not lead to cooperation – up to 12 months from the last contact.
  • Service requests (the “Support” form) – up to 12 months after the request is closed; complaints – until the limitation periods for claims expire.
  • Contracts and settlements – for the term of the contract, and then until the limitation periods for claims and the periods required by tax and accounting law expire.
  • Recruitment – until the recruitment ends plus 3 months; with consent to future recruitment – up to 12 months.
  • Social media – as long as the content is visible on our profile.
  • Cookies and logs – as in section 3.7 and the Cookie Policy.
  • Data processed on the basis of consent – until consent is withdrawn (and then only as long as needed to show that consent was given).
  • Data processed on the basis of legitimate interest – until a successful objection.

After these periods we delete or anonymise the data.

9. Your Rights

You have the right to:

  • access your data and receive a copy (Article 15 GDPR);
  • rectification (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability – where we process data by automated means on the basis of consent or a contract (Article 20 GDPR);
  • object to processing based on our legitimate interest (Article 6(1)(f) GDPR) on grounds relating to your particular situation; we always comply with an objection to direct marketing (Article 21 GDPR);
  • withdraw consent at any time – without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR);
  • lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl (Article 77 GDPR).

To exercise your rights, write to hello@alnosvending.pl or to our correspondence address. We will reply without undue delay and within one month at the latest. We may ask for information needed to confirm your identity.

10. Do You Have to Provide Data

Providing data is voluntary. However, without the data needed to reply (e.g. an email address and a description of your enquiry) we will not be able to reply to your enquiry, prepare an offer, or conclude and perform a contract. In recruitment, the data listed in Article 22¹ of the Labour Code is needed to take part; any other data you give voluntarily.

11. Automated Decisions and Profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

The automatic spam filter in the Wix forms is not a decision within the meaning of Article 22 GDPR. If you think your submission may not have reached us, write to the email address shown next to the form.

12. Security

We use technical and organisational measures appropriate to the risk, including an encrypted connection to the website (HTTPS) and access control for company accounts, and only people who need access to data have it.

13. Links to Other Websites

The website contains links to other services (e.g. our social media profiles). Once you go there, their operators' privacy rules apply.

14. Changes to This Notice

We update this notice when the law or the way we process data changes. The current version is always available on this page, with the date of the last update. The previous version applied from 26 March 2025.

This English version is a translation. If there is any discrepancy, the Polish version prevails.