MachinesCoffee MachineSnacks & DrinksVending CoolersTouchscreenProductsPlacesLocationsZamośćLublinRzeszówAll CitiesAbout UsGuidesFAQContact

PL · EN

Alnos Vending Privacy Notice

Last updated: 8 October 2026

This notice explains how Alnos Vending processes the personal data of people who visit www.alnosvending.pl, contact us (by email – including via the “Golden Ticket” button, phone, WhatsApp or social media), or work with us on behalf of businesses and site owners. It is the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council; in Polish: RODO).

1. Who Is the Controller of Your Data

The controller is Alnos Vending spółka z ograniczoną odpowiedzialnością (a Polish limited liability company; "Alnos Vending", "we", "us").

  • Registered office and address: ul. Jana i Jędrzeja Śniadeckich 20D/7, 35-006 Rzeszów, Poland
  • Correspondence address: Borowina Sitaniecka 49D, 22-400 Zamość, Poland
  • KRS 0001172105 – District Court in Rzeszów, XII Commercial Division of the National Court Register
  • NIP (tax ID) 5170459183, REGON 541693056, share capital PLN 5,000.00
  • Email: hello@alnosvending.pl
  • Phone: +48 84 300 10 10

Data protection officer. We have not appointed a data protection officer (DPO), because we are not required to. For anything about personal data, write to hello@alnosvending.pl (ideally with the subject "Personal data") or to our correspondence address.

2. Key Points in Brief

  • We process the data you give us yourself (e.g. in an email or WhatsApp message) and basic technical data from the website (hosting server logs).
  • We do not sell data, and we do not send marketing messages without your prior consent.
  • We use only essential cookies from the Wix platform. We do not run Google Analytics, advertising pixels or a cookie-consent banner – because there are no cookies that require consent. Details: Cookie Policy.
  • Some of our providers (e.g. WhatsApp, Microsoft, SpaceXAI) may transfer data outside the European Economic Area (EEA), including to the USA. See section 7.
  • You have the rights described in section 9, including the right to complain to the President of UODO (the Polish data protection authority).

3. Purposes, Legal Bases and Retention Periods

3.1. Email and the “Golden Ticket” Enquiry

There is no web form on the website. The machine enquiry (“Golden Ticket”) opens your email client with the address hello@alnosvending.pl and a message template. You can also email us directly at that address.

  • What data: first and last name, email, phone (optional), company name, city, team size / number of people on site, the types of machines you are interested in, the content of your message and any other data you choose to give in the email.
  • Purpose: replying to your enquiry, preparing an offer, agreeing terms of cooperation, handling service requests and complaints.
  • Legal basis:
    • Article 6(1)(b) GDPR – where you act on your own behalf (e.g. as a sole trader) and ask for an offer, or conclude or perform a contract with us;
    • Article 6(1)(f) GDPR – our legitimate interest in answering enquiries and in business contact, where you write on behalf of a company or institution;
    • Article 6(1)(c) GDPR – where the law places an obligation on us (e.g. handling a consumer complaint).
  • How long: until the matter is dealt with and, if no cooperation follows, for up to 12 months from the last contact. If we conclude a contract, we keep the data as described in section 3.5.

3.2. Phone

Our number +48 84 300 10 10 runs on Microsoft Teams Phone.

  • What data: your phone number, the date, time and duration of the call, and what you tell us during the call and we note down to deal with your matter.
  • Purpose and legal basis: as in section 3.1 (Article 6(1)(b) or (f) GDPR).
  • Recording: we do not record phone calls. If this changes, we will tell you at the start of the call.
  • How long: notes – as in section 3.1; call history – up to 12 months.

3.3. WhatsApp Business

Details of contact via WhatsApp are in section 4.

3.4. Recruitment Applications (Email)

There is no separate “Careers” page or form on the website. If you send us a CV or application at hello@alnosvending.pl:

  • What data: first and last name, phone, email, location, position, CV, and the information you choose to give.
  • Purpose: running recruitment for the chosen position.
  • Legal basis:
    • Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code – the data an employer may require from a job candidate;
    • Article 6(1)(b) GDPR – where we recruit for work under a civil-law contract (steps taken at your request before entering into a contract);
    • Article 6(1)(a) GDPR (consent) – additional data you give on your own initiative, and taking part in future recruitment if you give separate consent to that. You can withdraw consent at any time;
    • Article 6(1)(f) GDPR – establishing, pursuing or defending claims related to recruitment.
  • Please do not include special-category data (e.g. about your health) or your PESEL number in your CV unless we ask for it.
  • How long: until the recruitment ends and then for up to 3 months (in case of claims). If you consent to future recruitment – for up to 12 months from your application, or until you withdraw consent if earlier.

3.5. Working with Businesses and Site Owners (Contact Persons and Representatives)

This covers people who represent our customers, business partners and site hosts (owners or managers of places where machines may be installed), or who are named as contact persons.

  • What data: first and last name, position, business email and phone, company name; we may receive these from you or from the company you work for or represent.
  • Purpose and legal basis:
    • concluding and performing a contract – Article 6(1)(b) GDPR (if you are a party to the contract);
    • day-to-day business contact and establishing, pursuing or defending claims – Article 6(1)(f) GDPR (our legitimate interest);
    • tax and accounting obligations – Article 6(1)(c) GDPR.
  • How long: for the term of the contract, and then until the limitation periods for claims and the document retention periods required by tax and accounting law expire (usually 5 years from the end of the year in which the tax payment deadline fell).

3.6. Social Media

We run Alnos Vending profiles on Facebook, Instagram, LinkedIn, X (Twitter), YouTube and Threads. Our website only contains links to these profiles – we do not embed plug-ins or players that send data to these services before you click on them.

  • What data: your profile name and picture, the content of comments, reactions and messages you send us, and other data publicly visible on your profile.
  • Purpose and legal basis: running our profiles, informing people about our business, replying to comments and messages – Article 6(1)(f) GDPR (our legitimate interest).
  • Page statistics (joint controllership): the platform operators give us aggregated statistics about how users interact with our profiles. For this we are joint controllers (Article 26 GDPR), as the Court of Justice of the EU held in case C-210/16 Wirtschaftsakademie:
    • Facebook, Instagram and Threads: with Meta Platforms Ireland Limited, under the "Page Insights Controller Addendum": https://www.facebook.com/legal/terms/page_controller_addendum. Meta is responsible for the main obligations towards users, including handling their rights;
    • LinkedIn: with LinkedIn Ireland Unlimited Company, under the "Page Insights Joint Controller Addendum": https://www.linkedin.com/legal/l/page-joint-controller-addendum. LinkedIn is responsible for the main obligations towards users, including handling their rights.
    • You can exercise your rights directly with the platform operator or with us – we will pass your request on.
  • Apart from the statistics, the platform operators are separate controllers and process data under their own rules: Meta – https://www.facebook.com/privacy/policy, LinkedIn – https://www.linkedin.com/legal/privacy-policy, X – https://x.com/privacy, YouTube / Google – https://policies.google.com/privacy.
  • How long: as long as the comment or message is visible on our profile, or until you make a successful objection; messages that lead to cooperation – as in section 3.1 or 3.5.

3.7. Cookies, Hosting and Server Logs

The website runs on the Wix platform (Wix.com Ltd.). We use only essential cookies needed for the website to work, for security and for the session. They do not require consent (Article 399(3) of the Act of 12 July 2024 – Electronic Communications Law / Prawo komunikacji elektronicznej). We do not use analytics or marketing cookies and we do not show a cookie-consent banner.

  • What technical data: IP address, date and time of the request, browser and device type, URL visited and session identifiers stored in essential cookies – to the extent Wix records them in server logs and hosting infrastructure.
  • Purpose and legal basis: running the website, security and diagnostics – Article 6(1)(f) GDPR (our legitimate interest).
  • How long: according to each cookie's lifetime (usually session cookies – until you close the browser) and Wix's log retention.
  • More information, including the cookie list: https://www.alnosvending.pl/polityka-plikow-cookie.html.

If we later add analytics or marketing tools, we will update this notice and the Cookie Policy and – where required – ask for consent before switching them on.

3.8. Legal Obligations and Claims

Independently of the purposes above, we may process data:

  • to meet obligations under the law, e.g. tax and accounting law – Article 6(1)(c) GDPR – for the period required by law;
  • to establish, pursue or defend claims – Article 6(1)(f) GDPR – until the limitation periods expire.

3.9. Marketing

We do not run a newsletter. We do not send commercial information (including direct marketing) by email, text message, phone or messaging apps, including WhatsApp, without your prior consent (Article 398 of the Polish Electronic Communications Law). If you give such consent, you can withdraw it at any time, and we process the data until you withdraw it (Article 6(1)(a) and (f) GDPR).

4. WhatsApp Business

How it works. At Alnos Vending, Jacob Sloan (number +48 84 300 10 04) and Aleksandra Sloan (number +48 84 300 10 05) use WhatsApp. Each of them uses the WhatsApp Business app on their own phone (iPhone). We reply to messages from people who have written to us first, and continue those conversations. Our first reply includes a link to this notice: alnosvending.pl/rodo.

  • What data: your phone number, your WhatsApp profile name and picture (to the extent visible), the content of messages, attachments (photos, documents, voice notes), and technical message data (date and time, delivery and read status).
  • Purpose: replying to your enquiry, preparing an offer and taking steps before a contract, contact during cooperation, handling requests.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract, and performing a contract if you are a party to it) or Article 6(1)(f) GDPR (our legitimate interest in answering enquiries and in business contact, where you write on behalf of a company).
  • Offers and contracts are not sent as chat text – we send them as PDF documents.

WhatsApp's role.

  • In the EEA, the WhatsApp Business app is provided by WhatsApp Ireland Limited (a Meta company) under the "WhatsApp Terms for WhatsApp Business App".
  • WhatsApp messages are end-to-end encrypted – WhatsApp has no access to their content. Conversations are stored on the participants' devices, which on our side means Jacob Sloan's and Aleksandra Sloan's phones.
  • For the customer contact data we make available to WhatsApp in the app (e.g. phone numbers), WhatsApp Ireland Limited acts as our processor, under the "WhatsApp Business Data Processing Terms".
  • Otherwise, WhatsApp Ireland Limited is a separate controller of your WhatsApp account data and of data about your use of the service (e.g. metadata: when and with whom you communicate). It processes these under its own terms and privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.

Transfers outside the EEA. WhatsApp Ireland Limited may transfer data to the USA and other countries outside the EEA, in particular to WhatsApp LLC and Meta Platforms, Inc. (USA). The safeguard is the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework – WhatsApp LLC and Meta Platforms, Inc. are certified under it (checked on https://www.dataprivacyframework.gov on 7 Oct 2026) – and, where needed, the standard contractual clauses adopted by the European Commission.

iCloud backups. We do not switch on automatic WhatsApp backup to iCloud on the phones used for business contact. Conversations stay on the devices (end-to-end encryption).

How long we keep chats. We keep conversations on Jacob Sloan's and Aleksandra Sloan's phones. If a conversation does not lead to a contract, we delete it by hand 12 months after the last message. If it leads to a contract, we keep the information needed as described in section 3.5. If you ask, we will delete a conversation earlier, unless we must keep it for legal reasons.

How to opt out. If you do not want to receive messages from us, write "STOP" or block our number in WhatsApp. Deleting the chat on your phone does not delete our copy – if you want us to delete it, tell us on WhatsApp or at hello@alnosvending.pl.

No marketing without consent. We do not send marketing messages or unsolicited offers via WhatsApp to anyone who has not given prior consent (Article 398 of the Polish Electronic Communications Law). We keep a record of every such consent.

5. Vending Machines

Once we launch our machines, information about data processing linked to using a machine (e.g. transaction cameras, payments, complaints) will be made available on the machine itself (e.g. via a QR code).

6. Who We Share Data With

Data may be received – only to the extent needed for the purpose concerned – by:

  • Wix.com Ltd. (Israel) – website hosting and operation and server logs. Israel has a European Commission adequacy decision;
  • Microsoft Ireland Operations Limited – Microsoft 365 (email, Teams, Teams Phone, file storage);
  • WhatsApp Ireland Limited – WhatsApp Business app (section 4);
  • Biuro Rachunkowe „SPINACZ” Agata Kowalczyk – bookkeeping, invoices and settlements;
  • SpaceXAI LLC (USA) – AI assistants (Grok Bot) that help handle company correspondence and Teams work when such content is made available to them in company tools;
  • legal and tax advisers – where needed;
  • postal operators and courier companies – when we send documents or parcels;
  • public authorities and courts – where the law requires it.

Providers that process data on our behalf do so under data processing agreements and only on our instructions. We do not sell data.

7. Transfers Outside the European Economic Area

Some providers (or their subcontractors) may process data outside the EEA:

  • USA – Meta Platforms, Inc., WhatsApp LLC, Microsoft Corporation and SpaceXAI LLC. The safeguard is the European Commission's decision of 10 July 2023 on the EU–US Data Privacy Framework (for certified companies – the list is at https://www.dataprivacyframework.gov) and – in particular for SpaceXAI LLC and where needed for other recipients – the standard contractual clauses adopted by the European Commission (module 2 or 3 of Decision 2021/914);
  • Israel – Wix.com Ltd., under the European Commission's adequacy decision. Onward transfers by Wix to subcontractors in the USA and other countries (including Wix.com Inc., Amazon Web Services) take place under standard contractual clauses or other appropriate safeguards in Wix's Data Processing Addendum – Users (https://www.wix.com/about/privacy-dpa-users) and Wix's sub-processor list.

You can ask us for information about these safeguards and for a copy of the relevant documents – write to hello@alnosvending.pl.

8. Retention Periods – Summary

  • Enquiries (email, phone, WhatsApp) that do not lead to cooperation – up to 12 months from the last contact.
  • Contracts and settlements – for the term of the contract, and then until the limitation periods for claims and the periods required by tax and accounting law expire.
  • Recruitment – until the recruitment ends plus 3 months; with consent to future recruitment – up to 12 months.
  • Social media – as long as the content is visible on our profile.
  • Cookies and logs – as in section 3.7 and the Cookie Policy.
  • Data processed on the basis of consent – until consent is withdrawn (and then only as long as needed to show that consent was given).
  • Data processed on the basis of legitimate interest – until a successful objection.

After these periods we delete or anonymise the data.

9. Your Rights

You have the right to:

  • access your data and receive a copy (Article 15 GDPR);
  • rectification (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability – where we process data by automated means on the basis of consent or a contract (Article 20 GDPR);
  • object to processing based on our legitimate interest (Article 6(1)(f) GDPR) on grounds relating to your particular situation; we always comply with an objection to direct marketing (Article 21 GDPR);
  • withdraw consent at any time – without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR);
  • lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl (Article 77 GDPR).

To exercise your rights, write to hello@alnosvending.pl or to our correspondence address. We will reply without undue delay and within one month at the latest. We may ask for information needed to confirm your identity.

10. Do You Have to Provide Data

Providing data is voluntary. However, without the data needed to reply (e.g. an email address and a description of your enquiry) we will not be able to reply to your enquiry, prepare an offer, or conclude and perform a contract. In recruitment, the data listed in Article 22¹ of the Labour Code is needed to take part; any other data you give voluntarily.

11. Automated Decisions and Profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

12. Security

We use technical and organisational measures appropriate to the risk, including an encrypted connection to the website (HTTPS) and access control for company accounts, and only people who need access to data have it.

13. Links to Other Websites

The website contains links to other services (e.g. our social media profiles). Once you go there, their operators' privacy rules apply.

14. Changes to This Notice

We update this notice when the law or the way we process data changes. The current version is always available on this page, with the date of the last update. The previous version applied from 26 March 2025.

This English version is a translation. If there is any discrepancy, the Polish version prevails.