Privacy policy

This Privacy Policy governs the processing of the personal data that we collect through selfservicevending.com, in compliance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and with French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (Loi Informatique et Libertés).

1. Data controller

• Company name: LDA, Société par actions simplifiée (SAS), owner of the Self Service Vending brand
• Registration: SIREN 791 402 050 — RCS Amiens
• Intra-Community VAT number: FR18791402050
• Registered office: 18 B Rue de Flandres, 80700 Tilloloy (France)
• Legal representative: Thibaut Lambert, President
• Contact: via the contact form or by post to the registered office
• Data Protection Officer (DPO): not appointed

2. Personal data we process

The personal data we process are those provided directly by the user through:

2.1. Contact form

• First name and surname.
• Email address.
• Telephone number (optional).
• Company or project (optional).
• Product of interest and intended location.
• The content of any message the user wishes to send us.

2.2. Email communications

Any information that the user voluntarily sends us by email when replying to our communications.

2.3. Browsing the Website

Technical data arising from the use of the Website (IP address, browser type, operating system, pages visited, date and time) collected by means of cookies and similar technologies, in accordance with our Cookie Policy.

3. Purposes of processing

We process personal data for the following purposes:

• Handling enquiries and quotation requests: responding to requests for information, preparing commercial proposals and maintaining communication with the user.
• Management of the business relationship: should the user become a customer, administering the contract, deliveries, technical support and invoicing.
• Compliance with legal obligations: accounting, tax and administrative obligations.
• Improvement of the Website: statistical analysis of the use of the Website in order to improve its content and the service offered (only if the user consents to analytics cookies).
• Commercial communications: only if the user expressly consents, sending information about new solutions, catalogue news or promotions.

4. Legal basis for processing

• Consent of the data subject (Art. 6(1)(a) GDPR): for handling enquiries submitted through the form, sending commercial communications and the use of non-essential cookies.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): for managing the business relationship when the user requests information with a view to contracting a service.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR): to meet accounting, tax and commercial-law obligations.
• Legitimate interest (Art. 6(1)(f) GDPR): for the basic analysis of the functioning of the Website and the prevention of fraudulent use.

5. Retention period

We will retain personal data for as long as is necessary to fulfil the purpose for which they were collected and to determine any liabilities that may arise from that purpose and from the processing of the data. Specifically:

• Enquiries not dealt with or not leading to a business relationship: up to 12 months from the last contact.
• Customers: for as long as the business relationship continues and, thereafter, for the applicable statutory periods (in general, up to 5 years for contractual obligations and up to 6 years for accounting and tax obligations).
• Commercial communications: until the user withdraws their consent.

6. Recipients and disclosures of data

Personal data will not be disclosed to third parties except where required by law. They may, however, be processed by providers acting as data processors, with whom the appropriate data processing agreements have been signed in accordance with Article 28 GDPR. These providers routinely include:

• Web hosting provider.
• Email service provider.
• Web analytics services (if the user consents to analytics cookies).
• External accounting and tax services.

7. International transfers

As a general rule, no international transfers of data outside the European Economic Area (EEA) are made. Should any provider (for example, for analytics or email) involve an international transfer, that transfer will be made exclusively to countries with an adequate level of protection recognised by the European Commission or, failing that, with the safeguards provided for in Articles 46 et seq. GDPR (standard contractual clauses).

8. Rights of the data subject

Any person has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects may exercise the following rights:

• Right of access: to know which personal data we process and to obtain a copy.
• Right to rectification: to request the correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): to request the deletion of the data where certain circumstances apply.
• Right to object: to object to the processing of their data, particularly where the data are processed for commercial purposes.
• Right to restriction of processing: to request the restriction of the processing of their data.
• Right to data portability: to receive the data they have provided in a structured, commonly used and machine-readable format, and to transmit them to another controller.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right not to be subject to automated individual decision-making (including profiling) producing legal effects concerning the data subject.

To exercise these rights, the user may contact the data controller in writing, at the postal address indicated in section 1 or through the contact form. Proof of identity will only be requested if there are reasonable doubts as to the user's identity.

9. Complaints to the supervisory authority

As the controller is established in France, the lead supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority (3 Place de Fontenoy, TSA 80715 — 75334 Paris Cedex 07 · www.cnil.fr).

In accordance with Article 77 GDPR, the user may also lodge a complaint with the supervisory authority of the Member State in which they reside. In Spain, this is the Agencia Española de Protección de Datos (AEPD), the Spanish Data Protection Agency (Calle Jorge Juan, 6 — 28001 Madrid · www.aepd.es). The user may do so if they consider that the processing of their personal data does not comply with the regulations in force or if their request to exercise their rights has not been satisfied.

10. Security measures

We have adopted the technical and organisational measures necessary to guarantee the security of personal data and to prevent their alteration, loss, or unauthorised processing or access, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, in accordance with Article 32 GDPR.

11. Processing of minors' data

The Website is intended for persons who have reached the age of majority. Personal data of minors under the age of 14 are not requested or deliberately processed. Should it come to light that a minor has provided their data without the consent of their legal representative, those data will be deleted immediately.

12. Changes to the policy

The controller reserves the right to amend this policy in order to adapt it to legislative or case-law developments, as well as to industry practice. In such cases, it will announce the changes introduced on the Website reasonably in advance of their implementation.

If you have any questions about this Privacy Policy or wish to exercise your rights, you can do so via the contact page or by post to the address indicated in section 1.