Privacy Policy

The controller is Mirkoz Vending BV, registered under company number BE 1040.465.649, Belgium.

For any questions about this policy or about your personal data, you can reach us at info@mirkozvending.com. We have not appointed a data protection officer; given the nature and scale of our processing activities, this is not legally required.

We only process the data we need:

• Contact and customer details: name, company name, email address, telephone number, billing and delivery address, VAT number — when you request a quote, place an order or contact us.
• Communications: the content of emails, WhatsApp messages and telephone notes needed to follow up on your enquiry.
• Billing and payment details: invoices, payment references and outstanding balances. We do not process card numbers ourselves; payments at our machines are handled by the payment terminal of an external payment service provider.
• Technical data when you visit our website: limited, anonymised usage information and the cookie preferences you set yourself. You will find more detail in our Cookie Policy.

We do not collect special categories of personal data (such as health or biometric data) and do not direct our services at minors.

We process your data solely for the following purposes:

• Quotes and customer contact — performance of (pre-)contractual measures (Art. 6(1)(b) GDPR).
• Delivery, installation, maintenance and warranty handling — performance of the contract (Art. 6(1)(b) GDPR).
• Invoicing and accounting — legal obligation (Art. 6(1)(c) GDPR).
• Managing our customer relationship and legitimate direct marketing to existing customers — legitimate interest (Art. 6(1)(f) GDPR), always with a simple way to unsubscribe.
• Non-essential cookies and similar technology — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings on our website.

We do not use your data for automated decision-making or profiling with legal effects.

We never sell your data. We only share it with service providers who process it on our behalf, in each case under a data processing agreement:

• Vercel — hosting of this website.
• Supabase — secure database for the website content and the accounts of our administrators.
• Resend — sending of transactional emails (such as quotes and confirmations).
• Google — display of our business reviews and, only with your consent, statistics on website usage.
• Accounting and payment service providers — for invoicing and the handling of payments.

In addition, we share data where a legal obligation requires it, for example with the tax authorities or in the context of a judicial investigation.

Some of our service providers process data (in part) outside the European Economic Area, including in the United States.

In that case we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses, supplemented with additional safeguards where necessary. You can request a copy of the relevant safeguards via info@mirkozvending.com.

We do not keep personal data longer than necessary:

• Quote requests without follow-up: no more than 2 years after the last contact.
• Customer and contract data: up to 10 years after the end of the contract (limitation period for contractual claims).
• Invoices and accounting records: 7 years, as required by tax law.
• Cookie preferences and consent records: no more than 24 months.

Once the retention period has expired, data is erased or irreversibly anonymised.

We take appropriate technical and organisational measures: encrypted connections (TLS) across the entire website, storage with certified European and international cloud providers, strict access control with individual administrator accounts, and the principle that staff only have access to the data they need.

We report a data breach posing a risk to your rights to the Belgian Data Protection Authority in accordance with the GDPR and, where required, to you.

With regard to your personal data, you have the right to:

• Access — a copy of the data we process about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — deletion of your data where the law permits.
• Restriction — have processing temporarily frozen during a dispute.
• Portability — receive your data in a commonly used format.
• Objection — object to processing based on legitimate interest, and always to direct marketing.
• Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand.

Email your request to info@mirkozvending.com. We will respond within one month at the latest; for complex requests, that period may be extended by two months, in which case we will notify you. We may ask for proof of identity to avoid disclosing data to the wrong person.

Not satisfied with how we handle your data? Please let us know first via info@mirkozvending.com — we will be glad to work with you towards a solution.

You also always have the right to lodge a complaint with the Belgian Data Protection Authority: Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be. If you live in another EU country, you can also contact your local supervisory authority.

We update this privacy policy when our services or the law require it. The date of the most recent change appears at the top of this page. In the event of significant changes we will inform you actively, for example by email or via a notice on the website.