← Back to website
SnackDragon.euDeutschFrançaisEnglishNederlandsDeutsch (CH)English (CH)

Privacy Policy

1. Controller

Ventec Systems GmbH
Carl-Zeiss-Ring 15a
85737 Ismaning
E-mail: info@snackdragon.eu

No data protection officer (Datenschutzbeauftragter) has been appointed. Please address data protection enquiries to the e-mail address given above.

2. General information

We process personal data (personenbezogene Daten) only to the extent necessary for operation, security, communication, order processing, performance of contracts, payment processing, accounting or statutory obligations.

The legal bases are in particular Art. 6 para. 1 lit. b DSGVO (GDPR) for pre-contractual measures and performance of the contract, Art. 6 para. 1 lit. c DSGVO for statutory obligations and Art. 6 para. 1 lit. f DSGVO for legitimate interests (berechtigte Interessen) in a secure and economically efficient operation of the website and the business.

3. Server log files

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes personal data in the context of operating the website as a technical service provider or processor (Auftragsverarbeiter).

When you visit our website, information is automatically sent to the server of our website. This information is stored temporarily in so-called server log files. The following information may be recorded:

The processing takes place to ensure a smooth connection, for system security, for error analysis and to prevent misuse. The legal basis is Art. 6 para. 1 lit. f DSGVO. The server log files are automatically deleted after 14 days at the latest, unless further retention is necessary in an individual case to investigate attacks or misuse.

Country detection: When you visit our website, our server determines the country from your IP address using a locally stored DB-IP Lite Country database. We use the country code to show the appropriate country offer, offer the Swiss franc version to visitors from Switzerland, limit financing offers to visitors from Germany, and show a delivery area notice to visitors outside Germany, France, the Netherlands and Switzerland. Your IP address is not sent to DB-IP or another geolocation service for this lookup. The country detection endpoint is excluded from the web server access log; ordinary page requests continue to be logged as described above. Your browser's session storage (sessionStorage) holds a recognised country code and, where applicable, whether you closed the delivery area notice. To select the market, it also holds the last language used in each market and the number and time of automatic redirects. A choice made in the language menu is also stored as a language preference in local browser storage. When an existing basket is transferred between the euro and Swiss markets, session storage holds a copy of its items and, after a successful transfer, a snapshot of the source basket to prevent a duplicate transfer. The original basket remains in the browser's local storage. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to show offers and delivery information relevant to the visitor's country and to provide reliable market selection. Country data source: IP Geolocation by DB-IP, licensed under CC BY 4.0.

4. Contact, shopping basket and orders

If you contact us by e-mail, use a contact form, place products in the shopping basket or submit an order, we process the data you provide. This may include in particular name, company, billing and delivery address, e-mail address, VAT identification number (USt-IdNr.), products ordered, configurations, payment status and the content of communications.

The processing takes place to handle your enquiry, to check and carry out orders, to perform the contract, for customer communication, for delivery, for invoicing and to comply with statutory obligations. The legal bases are Art. 6 para. 1 lit. b, lit. c and lit. f DSGVO.

To avoid duplicate orders and to reliably allocate payments, we keep a pseudonymised order history. For this purpose, server-side HMAC identifiers are generated from the e-mail address, where applicable the VAT identification number and the company name in combination with the country of delivery and postcode. The order history contains no contact data in plain text, but in particular the pseudonymous customer allocation, product ID, quantity, order reference, payment method or booking status and timestamps. Open card or Billie orders processed via Stripe reserve the allocated stock for a maximum of one hour; if payment is aborted or expires, the reservation is released. To avoid overselling, we also keep, for each enabled product ID, a server-side remaining stock and a status for the reservation, booking or release of the respective order quantity. An open prepayment order ties up the allocated stock until fulfilment or deliberate cancellation; upon confirmed cancellation it is released again. Released reservation data are intended to be kept for 30 days, orphaned identifiers from incomplete price queries for 24 hours and booked order histories for ten years; they are removed after the period expires at the next checkout call or by the regular server-side clean-up. The legal bases are Art. 6 para. 1 lit. b and lit. f DSGVO; our legitimate interests lie in avoiding duplicate orders, avoiding overselling and reliably allocating payments.

4a. Contact via WhatsApp

Our website contains optional links to WhatsApp. Only when you click such a link or send a message yourself do you open the WhatsApp service and data are transmitted to WhatsApp. No WhatsApp tracking module is integrated on the SnackDragon website.

For users in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited. When used, WhatsApp processes in particular your mobile number, device and connection data, usage data and the content you send in accordance with its own privacy policy for the European Economic Area. If you write to us via WhatsApp, we process your message and the contact data visible in it in order to handle your enquiry. The legal bases are Art. 6 para. 1 lit. b and lit. f DSGVO. Alternatively, you can contact us by e-mail at any time.

4b. Service requests via the website form

If you use the service form, we process the information you enter in order to review and handle your request. This includes name or company, e-mail address, location with country, postcode and town, relationship to SnackDragon, manufacturer and model of the vending machine, where applicable serial number and year of manufacture, fault category and fault description, information on access and site conditions, the preferred contact channel, an optional video link and, where applicable, the spare part viewed on the website. A telephone number is optional and only required if you wish to be contacted by telephone or via WhatsApp; it is used exclusively for contact and appointment scheduling in the service case.

You can attach up to three photos of the fault to the form. An uploaded image is completely rewritten on our server and reduced to a maximum edge length of 2’000 pixels. In the process, all additional data of the original file are removed, in particular the location, time of capture and camera data; we receive only the image itself. Until the request is submitted, the file is stored under a random name outside the publicly accessible area of our server and is not delivered. On submission, it is attached to the internal service e-mail and deleted from the server; if you abandon the form, it is automatically deleted after 24 hours at the latest. Please upload only images of the vending machine and no pictures in which persons can be identified.

The information is transmitted to our server in encrypted form and sent exclusively as an internal service e-mail to info@snackdragon.eu. The website and mailbox are operated via Hetzner Online GmbH. The form does not create any additional case database; attached photos are processed exclusively as described in the preceding paragraph. To protect against misuse, the server stores, within a short time window, only access times under an IP identifier pseudonymised with a secret key; outdated rate-limit data are cleaned up on the server side.

The legal bases are Art. 6 para. 1 lit. b DSGVO for pre-contractual and contractual service requests and Art. 6 para. 1 lit. f DSGVO for secure, traceable handling and the prevention of misuse. We store service requests and the related communication for as long as this is necessary for handling and possible legal claims; they are then deleted unless statutory retention obligations prevent this. Before case data are transmitted to a service business, we will name the specific business to you and obtain your consent.

5. Payment and invoice processing

Depending on the payment method chosen, we process payment and invoice-related data in order to allocate payments, issue invoices, manage receivables and comply with statutory retention obligations.

For online payments in the shop we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe receives the data required for payment processing, for example name, e-mail address, payment data and amount. The processing takes place for the performance of the contract (Art. 6 para. 1 lit. b DSGVO). In this context, a transfer to Stripe, Inc. in the USA may take place; Stripe is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply. Further information: https://stripe.com/de/privacy

For purchase on invoice via Billie, the order and company data required for the offer, identity, company and credit checks and payment processing are transmitted via Stripe to Billie GmbH, Am Postbahnhof 15, 10243 Berlin. Billie decides on approval under its own responsibility and processes the data to carry out the purchase on invoice, for fraud prevention and for receivables management. The legal basis for our transmission is Art. 6 para. 1 lit. b DSGVO. Further information: Billie's privacy policy.

Where payment, accounting, invoicing or shipping service providers are involved, they receive only the data required for the respective service. The legal bases are Art. 6 para. 1 lit. b and lit. c DSGVO and Art. 6 para. 1 lit. f DSGVO.

5a. Financing enquiries

If you request financing via our website, we process the data you provide, in particular name, company, contact details, the desired machine with configuration and net price and the desired term.

If we forward your financing enquiry for assessment, a financing intermediary based in Germany that we engage for business financing receives the enquiry data needed for that assessment. The intermediary handles the enquiry and may pass it to participating financing companies. It acts as an independent controller for its own processing under the GDPR. Any financing agreement is concluded between you and the relevant financing company, not with us or the intermediary.

Further documents may be required for a creditworthiness check, such as proof of business registration, proof of income or a self-disclosure form. The intermediary will tell you, where applicable, which documents are needed and how to submit them. These documents cannot be submitted through our website enquiry form. If they are made available through the intermediary’s platform, the financing company involved and the supplier you enquired with may have access for purposes of the particular financing case.

The legal basis is Art. 6 para. 1 lit. b DSGVO, as the transfer is necessary to carry out the pre-contractual measures you have requested. There is no obligation to submit an enquiry; you can also purchase our machines without financing.

5b. Availability notification and discount code

As long as a product cannot be ordered, you can enter your e-mail address on the product page in order to be notified as soon as ordering is possible. In this case, your e-mail address, the machine concerned and the configuration with net price selected on the product page are processed.

We use this information for the requested message on the availability of this product. If you request a discount code on the product page, we additionally send you the model-specific code by e-mail. This does not result in a newsletter or any further advertising; for that we would ask you separately for your consent. The registration reaches us as an e-mail to info@snackdragon.eu and is not stored in a separate mailing list. When the code is redeemed, we store its identifier and redemption status together with the order in order to ensure correct calculation of the discount.

The legal basis is Art. 6 para. 1 lit. b DSGVO for the pre-contractual measure you have requested and Art. 6 para. 1 lit. f DSGVO in responding to your enquiry. Providing the information is voluntary; instead, you can write to us directly by e-mail at any time. We delete the information as soon as the notification has been sent and no statutory retention obligations prevent this.

6. Recipients of personal data

Personal data may be transmitted to technical service providers, in particular our hosting provider Hetzner Online GmbH, shipping and freight forwarding providers, payment and invoicing providers, tax advisers, authorities or other recipients, insofar as this is necessary for operating the website, performing contracts, processing payments, delivery, accounting, enforcing legal rights or complying with statutory obligations.

7. Retention period

We store personal data only for as long as is necessary for the stated purposes or statutory retention periods apply. Business records relevant under commercial and tax law may be retained for up to ten years. Communication data are deleted when they are no longer required for processing and no statutory obligations prevent this.

8. Cookies and local storage

Our website uses third-party web analytics and advertising services only with your consent; details on Google Ads conversion measurement can be found in section 8a. Our own product and order statistics are likewise compiled only with your consent; details can be found in section 8b. If Google Customer Reviews is activated, the order confirmation page loads the opt-in module described there only after your express selection “Show Google survey”. Google may use cookies, pixels or comparable technologies in this context. The legal basis for loading and for accessing or storing information on your device is your consent under Section 25 para. 1 TDDDG.

For technically necessary functions, information may be stored in the browser, for example cart contents, language selection or user interface states. This storage serves to provide website functions expressly requested by you and is based on Section 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR.

If you select Google Ads in the cookie notice and save your selection or choose “Accept all”, we use Google services to measure reach and advertising success (Google Ads Conversion Tracking). The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In this process, cookies are set or information is stored on or read from your device and usage data are processed, including a shortened IP address, page views and conversion events such as orders or enquiries. We do not transmit any names, email addresses or other plain-text contact details to Google.

We use Google Consent Mode v2. Without your consent to Google Ads, all four consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to “denied” and no Google tag is loaded; no tracking cookies are then set. The Google tag is loaded only after your consent to Google Ads through the saved selection or “Accept all”. The legal basis for setting and reading cookies or information on your device and for the subsequent data processing is your consent under Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR.

With the same selection, we additionally record on our own server whether our website was accessed with a Google Ads click parameter before an order. For this purpose, we store our own cookie and pseudonymous identifiers and link the source information with your orders. We do not store the values of the click parameters for this attribution; the attribution is not transmitted to Google. The cookie and order attribution remain valid for a maximum of 30 days from recording and are not extended by further visits or orders. A technical withdrawal safeguard may remain in place for up to 30 days after withdrawal so that delayed requests do not reactivate consent. After withdrawal, we no longer use the attribution and remove the associated links through secured clean-up. This processing is voluntary and is not required for a purchase.

A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses may also apply. Further information can be found in Google’s privacy policy and Google’s information on international data transfers.

You can withdraw your consent to Google Ads at any time with effect for the future via the “Cookie settings” link in the page footer. When consent to Google Ads is withdrawn, all four consent signals are immediately set to “denied” and no further events are sent to Google. The retention period of the cookies set and the data processed by Google depends on the data type, purpose and account settings; Google describes the details under Data retention at Google.

8b. Our own product and order statistics (only with consent)

With your express consent in the cookie notice, we count product views, successful additions to the cart, the opening of the order form and order summary, as well as input validation errors, price enquiries and order attempts. This allows us to identify where the purchasing process can be improved. The reports are sent exclusively to our own server and are not transmitted to Google for these statistics.

We store only daily counters per product and action and, in the case of errors, where applicable, an additional predefined technical error category. The statistics contain no names, contact details, form entries, order numbers, IP addresses, session identifiers or advertising click IDs. We do not store individual usage histories or create visitor profiles. Connection data and server log files arising from the technical operation of the server are processed separately in accordance with section 3.

The analysis covers the last 90 days; older daily values are removed the next time the statistics are accessed. Participation is voluntary and is not required for a purchase. Without your consent, we do not send any reports for these statistics. You can withdraw your consent at any time with effect for the future via “Cookie settings”. The legal bases are Art. 6 para. 1 lit. a GDPR and, insofar as information is stored on or read from your device, Section 25 para. 1 TDDDG.

9. Location Radar

If you use the Location Radar, we process the business location address you enter to analyse the surroundings of a possible vending machine location. Please do not enter a private address or confidential location data. The check begins only after you have expressly consented to the transmission of the address to Google Maps and of the coordinates determined from it to FOSSGIS.

To determine the coordinates, our server transmits the address to the Google Geocoding API. Google processes, in particular, the search query and technical information about the requesting SnackDragon server. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this processing, Google and Ventec Systems GmbH each act as independent controllers under the Google Maps Platform EEA terms. Google may process data on servers outside your country. Further information can be found in Google’s privacy policy and the Google Maps Platform EEA terms. The legal basis for transmitting the address is your consent under Art. 6 para. 1 lit. a GDPR; you can withdraw it with effect for the future.

Our server then retrieves mapped surroundings data based on the coordinates via Overpass servers of FOSSGIS e.V. In this process, the coordinates, but not the address entered or your browser IP address, are transmitted to FOSSGIS. The legal basis for transmitting the coordinates is likewise your consent under Art. 6 para. 1 lit. a GDPR. The German-language assessment is then generated on our server according to fixed rules. Neither the address nor the coordinates nor derived location data are transmitted to OpenAI. Further information can be found in the FOSSGIS terms of use.

We do not permanently store the address entered or the exact coordinates. An analysis result derived from the position, without address and coordinates, may be cached for a maximum of 15 minutes in an access-protected temporary server directory to avoid unnecessarily repeating identical queries. To protect against misuse, we store a hash generated from the requesting IP address and a timestamp for a maximum of 24 hours. The legal bases for the location check carried out at your request and for protection against misuse are Art. 6 para. 1 lit. b and lit. f GDPR.

10. Google Customer Reviews

Google Customer Reviews is activated.

After a qualifying order, the order confirmation page may display an optional preliminary choice for Google Customer Reviews. Before you make your choice, no connection to the Google module is established and no order data are transmitted to Google. Only if you choose “Show Google survey” do we load the official Google opt-in module and transmit the order number, email address, delivery country and estimated delivery date to Google. Google may use cookies, pixels or comparable technologies in this context. In the Google module then displayed, you decide whether Google may send you a review survey by email after the estimated delivery date. Choosing “Do not participate” has no disadvantages for your order.

The legal basis for loading the module, transmitting the order data and the possible access to your device is your consent under Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can withdraw consent with effect for the future; the lawfulness of processing already carried out remains unaffected.

Before the Google module is loaded, we record exclusively the order number, version of the consent text, language and time as proof of your choice. No additional email address or IP address is stored for this purpose. The legal basis for this proof of consent is Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR. After the end of the third calendar year following consent, the proof is automatically removed during the next consent process, unless it is exceptionally required for longer to establish, exercise or defend legal claims.

To protect public checkout, payment and consent endpoints against automated mass requests, we store in a temporary server directory an identifier of the requesting IP address pseudonymised with a secret server-side HMAC key, together with the times of the requests. For rate limiting, the system takes into account only the configured short time window, usually the last hour; outdated entries are removed during subsequent protected requests and additionally through the regular clean-up of temporary server files. For the location check, the IP hash described in section 9, stored for a maximum of 24 hours, applies instead. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is to protect order, payment, consent and location requests against abusive access.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google and Ventec Systems GmbH each process the data under their own responsibility in accordance with the terms applicable to Google Customer Reviews. Processing by Google LLC in the USA or in other third countries is possible. Google LLC is certified under the EU-US Data Privacy Framework; Google additionally identifies other applicable transfer mechanisms. Further information can be found in Google’s privacy policy and Google’s information on international data transfers.

The data record prepared for the opt-in is stored in your browser only for the session and for no more than 24 hours. It is deleted if you decline, abandon payment, the payment or order verification fails, or immediately when an attempt is made to load the Google module after your consent. Google stores transmitted data for different periods depending on the type of data, purpose and account settings; some data is automatically deleted or anonymised, while other data may be retained longer for security, prevention of misuse or legal obligations. Google provides details under Google data retention.

10a. Postal direct marketing to businesses

To initiate business relationships, we send addressed advertising mail to companies, institutions and public authorities. The addresses used for this purpose come exclusively from publicly accessible sources, particularly company websites, the commercial register, and industry and location directories. We process the company name, address, industry and, where publicly stated, the job title or name of a person authorised to represent the company. We do not contact private individuals.

The legal basis is Article 6(1)(f) DSGVO. Our legitimate interest is direct marketing to business recipients; Recital 47 of the DSGVO expressly identifies processing for direct marketing purposes as a legitimate interest. Where the addresses used constitute personal data and we have not collected the data directly from you, we inform you of this under Article 14 DSGVO no later than the first mailing.

We store this data for as long as it is needed to contact you, but no longer than three years after the last contact. If you object to the advertising, we store your address permanently on a suppression list to reliably prevent further mailings; this continued storage serves solely to implement your objection.

You may object to the processing of your data for direct marketing purposes at any time without giving reasons (Article 21(2) DSGVO). An informal message to info@snackdragon.eu is sufficient; no further advertising contact will take place afterwards.

11. Your rights

You have the following rights against us concerning your personal data:

To exercise your rights, please contact: info@snackdragon.eu

You also have the right to lodge a complaint with a data protection supervisory authority.

12. SSL encryption

For security reasons, our website uses SSL encryption. You can recognise an encrypted connection when the browser address bar changes from “http://” to “https://” and by the padlock symbol in your browser bar.

13. Current status and amendments to this privacy policy

This privacy policy is currently valid and is dated 2 October 2026. Changes to our website or legal requirements may make it necessary to amend this privacy policy.

Additional information for people in Switzerland

In addition to the General Data Protection Regulation, the Schweizer Bundesgesetz über den Datenschutz (DSG, Swiss Federal Act on Data Protection) applies to this website because the processing has effects in Switzerland (Article 3(1) DSG). The controller is Ventec Systems GmbH, Carl-Zeiss-Ring 15a, 85737 Ismaning, Germany.

In the processing described, personal data is disclosed to recipients in Germany (Ventec Systems GmbH and Billie GmbH), Ireland (Stripe and Google) and, where applicable, the USA (Stripe and Google). For delivery and import clearance, the necessary delivery and contact details are also disclosed to recipients in Switzerland. Details of the services, data and purposes are set out in the relevant sections of this policy.

For data transfers from Switzerland to the USA, Stripe and Google cite the Swiss-U.S. Data Privacy Framework and, where required, applicable standard data protection clauses. Information on the respective transfer mechanisms: Stripe Data Transfers Addendum and Google information on international data transfers.

Under the Swiss DSG, you have the right to information about the personal data processed concerning you, including the retention period or the criteria used to determine it (Article 25 DSG), the right to receive or have your data transferred (Article 28 DSG), and the right to request correction of inaccurate data and enforce your claims through civil proceedings (Article 32 DSG). For enquiries, please contact info@snackdragon.eu.

Unlike the General Data Protection Regulation, Swiss law does not provide for a supervisory complaint. You may submit a report to the Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten (EDÖB, Federal Data Protection and Information Commissioner) (Article 49 DSG) or pursue civil proceedings.

No representative in Switzerland has been designated under Article 14 DSG because the requirements for large-scale processing involving a high risk are not met.

Last updated: 2 October 2026