← Back to website
SnackDragon.euDEFRENNLCH

Privacy Policy

1. Controller

Ventec Systems GmbH
Carl-Zeiss-Ring 15a
85737 Ismaning
E-mail: info@snackdragon.eu

No data protection officer (Datenschutzbeauftragter) has been appointed. Please address data protection enquiries to the e-mail address given above.

2. General information

We process personal data (personenbezogene Daten) only to the extent necessary for operation, security, communication, order processing, performance of contracts, payment processing, accounting or statutory obligations.

The legal bases are in particular Art. 6 para. 1 lit. b DSGVO (GDPR) for pre-contractual measures and performance of the contract, Art. 6 para. 1 lit. c DSGVO for statutory obligations and Art. 6 para. 1 lit. f DSGVO for legitimate interests (berechtigte Interessen) in a secure and economically efficient operation of the website and the business.

3. Server log files

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes personal data in the context of operating the website as a technical service provider or processor (Auftragsverarbeiter).

When you visit our website, information is automatically sent to the server of our website. This information is stored temporarily in so-called server log files. The following information may be recorded:

The processing takes place to ensure a smooth connection, for system security, for error analysis and to prevent misuse. The legal basis is Art. 6 para. 1 lit. f DSGVO. The server log files are automatically deleted after 14 days at the latest, unless further retention is necessary in an individual case to investigate attacks or misuse.

Country detection: When you visit our website, our server determines the country from your IP address using a locally stored DB-IP Lite Country database. We use the country code to show the appropriate country offer, offer the Swiss franc version to visitors from Switzerland, limit financing offers to visitors from Germany, and show a delivery area notice to visitors outside Germany, France, the Netherlands and Switzerland. Your IP address is not sent to DB-IP or another geolocation service for this lookup. The country detection endpoint is excluded from the web server access log; ordinary page requests continue to be logged as described above. Your browser's session storage (sessionStorage) holds a recognised country code and, where applicable, whether you closed the delivery area notice. To select the market, it also holds the last language used in each market and the number and time of automatic redirects. A choice made in the language menu is also stored as a language preference in local browser storage. When an existing basket is transferred between the euro and Swiss markets, session storage holds a copy of its items and, after a successful transfer, a snapshot of the source basket to prevent a duplicate transfer. The original basket remains in the browser's local storage. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to show offers and delivery information relevant to the visitor's country and to provide reliable market selection. Country data source: IP Geolocation by DB-IP, licensed under CC BY 4.0.

4. Contact, shopping basket and orders

If you contact us by e-mail, use a contact form, place products in the shopping basket or submit an order, we process the data you provide. This may include in particular name, company, billing and delivery address, e-mail address, VAT identification number (USt-IdNr.), products ordered, configurations, payment status and the content of communications.

The processing takes place to handle your enquiry, to check and carry out orders, to perform the contract, for customer communication, for delivery, for invoicing and to comply with statutory obligations. The legal bases are Art. 6 para. 1 lit. b, lit. c and lit. f DSGVO.

To avoid duplicate orders and to reliably allocate payments, we keep a pseudonymised order history. For this purpose, server-side HMAC identifiers are generated from the e-mail address, where applicable the VAT identification number and the company name in combination with the country of delivery and postcode. The order history contains no contact data in plain text, but in particular the pseudonymous customer allocation, product ID, quantity, order reference, payment method or booking status and timestamps. Open card or Billie orders processed via Stripe reserve the allocated stock for a maximum of one hour; if payment is aborted or expires, the reservation is released. To avoid overselling, we also keep, for each enabled product ID, a server-side remaining stock and a status for the reservation, booking or release of the respective order quantity. An open prepayment order ties up the allocated stock until fulfilment or deliberate cancellation; upon confirmed cancellation it is released again. Released reservation data are intended to be kept for 30 days, orphaned identifiers from incomplete price queries for 24 hours and booked order histories for ten years; they are removed after the period expires at the next checkout call or by the regular server-side clean-up. The legal bases are Art. 6 para. 1 lit. b and lit. f DSGVO; our legitimate interests lie in avoiding duplicate orders, avoiding overselling and reliably allocating payments.

4a. Contact via WhatsApp

Our website contains optional links to WhatsApp. Only when you click such a link or send a message yourself do you open the WhatsApp service and data are transmitted to WhatsApp. No WhatsApp tracking module is integrated on the SnackDragon website.

For users in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited. When used, WhatsApp processes in particular your mobile number, device and connection data, usage data and the content you send in accordance with its own privacy policy for the European Economic Area. If you write to us via WhatsApp, we process your message and the contact data visible in it in order to handle your enquiry. The legal bases are Art. 6 para. 1 lit. b and lit. f DSGVO. Alternatively, you can contact us by e-mail at any time.

4b. Service requests via the website form

If you use the service form, we process the information you enter in order to review and handle your request. This includes name or company, e-mail address, location with country, postcode and town, relationship to SnackDragon, manufacturer and model of the vending machine, where applicable serial number and year of manufacture, fault category and fault description, information on access and site conditions, the preferred contact channel, an optional video link and, where applicable, the spare part viewed on the website. A telephone number is optional and only required if you wish to be contacted by telephone or via WhatsApp; it is used exclusively for contact and appointment scheduling in the service case.

You may attach up to three photos of the fault to the form. An uploaded image is completely rewritten on our server and reduced to a maximum edge length of 2,000 pixels. In the process, all additional data of the original file are removed, in particular location, time of capture and camera data; we receive only the image itself. Until the request is submitted, the file is stored under a random name outside the publicly accessible area of our server and is not delivered. Upon submission it is attached to the internal service e-mail and deleted from the server; if you abandon the form, it is automatically deleted after 24 hours at the latest. Please upload only images of the vending machine and no pictures in which persons are identifiable.

The information is transmitted to our server in encrypted form and sent exclusively as an internal service e-mail to info@snackdragon.eu. The website and mailbox are operated via Hetzner Online GmbH. The form does not create any additional case database; attached photos are processed exclusively as described in the preceding paragraph. To protect against misuse, the server stores, within a short time window, only access times under an IP identifier pseudonymised with a secret key; outdated rate-limit data are cleaned up on the server side.

The legal bases are Art. 6 para. 1 lit. b DSGVO for pre-contractual and contractual service requests and Art. 6 para. 1 lit. f DSGVO for secure, traceable handling and the prevention of misuse. We store service requests and the related communication for as long as this is necessary for handling and possible legal claims; they are then deleted unless statutory retention obligations prevent this. Before case data are transmitted to a service business, we will name the specific business to you and obtain your consent.

5. Payment and invoice processing

Depending on the payment method chosen, we process payment and invoice-related data in order to allocate payments, issue invoices, manage receivables and comply with statutory retention obligations.

For online payments in the shop we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe receives the data required for payment processing, for example name, e-mail address, payment data and amount. The processing takes place for the performance of the contract (Art. 6 para. 1 lit. b DSGVO). In this context, a transfer to Stripe, Inc. in the USA may take place; Stripe is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply. Further information: https://stripe.com/de/privacy

For purchase on invoice via Billie, the order and company data required for the offer, identity, company and credit checks and payment processing are transmitted via Stripe to Billie GmbH, Am Postbahnhof 15, 10243 Berlin. Billie decides on approval under its own responsibility and processes the data to carry out the purchase on invoice, for fraud prevention and for receivables management. The legal basis for our transmission is Art. 6 para. 1 lit. b DSGVO. Further information: Billie's privacy policy.

Where payment, accounting, invoicing or shipping service providers are involved, they receive only the data required for the respective service. The legal bases are Art. 6 para. 1 lit. b and lit. c DSGVO and Art. 6 para. 1 lit. f DSGVO.

5a. Financing enquiries

If you request financing via our website, we process the data you provide, in particular name, company, contact details, the desired machine with configuration and net price and the desired term.

If we forward your financing enquiry for assessment, a financing intermediary based in Germany that we engage for business financing receives the enquiry data needed for that assessment. The intermediary handles the enquiry and may pass it to participating financing companies. It acts as an independent controller for its own processing under the GDPR. Any financing agreement is concluded between you and the relevant financing company, not with us or the intermediary.

Further documents may be required for a creditworthiness check, such as proof of business registration, proof of income or a self-disclosure form. The intermediary will tell you, where applicable, which documents are needed and how to submit them. These documents cannot be submitted through our website enquiry form. If they are made available through the intermediary’s platform, the financing company involved and the supplier you enquired with may have access for purposes of the particular financing case.

The legal basis is Art. 6 para. 1 lit. b DSGVO, as the transfer is necessary to carry out the pre-contractual measures you have requested. There is no obligation to submit an enquiry; you can also purchase our machines without financing.

5b. Availability notification and discount code

As long as a product cannot be ordered, you can enter your e-mail address on the product page in order to be notified as soon as ordering is possible. In this case, your e-mail address, the machine concerned and the configuration with net price selected on the product page are processed.

We use this information for the requested message on the availability of this product. If you request a discount code on the product page, we additionally send you the model-specific code by e-mail. This does not result in a newsletter or any further advertising; for that we would ask you separately for your consent. The registration reaches us as an e-mail to info@snackdragon.eu and is not stored in a separate mailing list. When the code is redeemed, we store its identifier and redemption status together with the order in order to ensure correct calculation of the discount.

The legal basis is Art. 6 para. 1 lit. b DSGVO for the pre-contractual measure you have requested and Art. 6 para. 1 lit. f DSGVO in responding to your enquiry. Providing the information is voluntary; instead, you can write to us directly by e-mail at any time. We delete the information as soon as the notification has been sent and no statutory retention obligations prevent this.

6. Recipients of personal data

Personal data may be transmitted to technical service providers, in particular our hosting provider Hetzner Online GmbH, shipping and freight forwarding service providers, payment and invoicing service providers, tax advisers, authorities or other recipients, insofar as this is necessary for operating the website, performing contracts, processing payments, delivery, accounting, legal enforcement or statutory obligations.

7. Storage period

We store personal data only for as long as is necessary for the stated purposes or statutory retention periods apply. Business records relevant under commercial and tax law may be retained for up to ten years. Communication data are deleted when they are no longer required for processing and no statutory obligations prevent this.

8. Cookies and local storage

Our website uses third-party web analytics and advertising services only with your consent (Einwilligung); details on Google Ads conversion measurement can be found in section 8a. Our own product and order statistics are likewise compiled only with your consent; details can be found in section 8b. If Google Customer Reviews is activated, the order confirmation page loads the opt-in module described there only after your express selection "Show Google survey". Google may use cookies, pixels or comparable technologies in this context. The legal basis for loading and for accessing or storing information on your terminal device is your consent under § 25 Abs. 1 TDDDG.

For technically necessary functions, information may be stored in the browser, for example shopping basket contents, language selection or states of the user interface. This storage serves to provide website functions expressly requested by you and is based on § 25 Abs. 2 TDDDG and Art. 6 para. 1 lit. f DSGVO.

If you select Google Ads in the cookie notice and save your selection or choose "Accept all", we use Google services to measure reach and advertising success (Google Ads Conversion Tracking). The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In this process, cookies are set or information is stored on or read from your terminal device and usage data are processed, including a shortened IP address, page views and conversion events such as orders or enquiries. We do not transmit any names, e-mail addresses or other plain-text contact data to Google. The only exception is the hashed value of your e-mail address for enhanced conversions described below.

We use Google Consent Mode v2. Without your consent to Google Ads, all four consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to "denied" and no Google tag is loaded; in that case no tracking cookies are set. The Google tag is loaded only after your consent to Google Ads via the saved selection or "Accept all". The legal basis for setting and reading cookies or information on your terminal device and for the subsequent data processing is your consent under § 25 Abs. 1 TDDDG and Art. 6 para. 1 lit. a DSGVO.

Enhanced conversions. If you have consented to Google Ads and complete an order, we additionally pass the e-mail address entered in the order form to the Google tag with the order event. The Google tag converts it into a hash value (SHA-256) in your browser; only this hash value is transmitted to Google, never the e-mail address in plain text. Google compares the hash value with likewise hashed data of signed-in Google accounts in order to attribute the order to a previous ad click, even if no cookie is available for this. The sole purpose is measuring advertising success; we only receive aggregated reports from Google. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Without your consent to Google Ads, this transmission does not take place. Withdrawal and transfers to the USA are governed by the following paragraphs.

Click identifier from the ad. If you reach our website via a Google ad, the page address contains a Google click identifier (gclid, gbraid or wbraid). As long as you have not yet consented to Google Ads, we append this identifier to the page address when you move to another page of our shop. We do not store it on your device and do not use it for our own analyses; Google only receives it if you later consent to Google Ads and the Google tag is loaded. If you decline, the identifier is not transmitted to Google.

With the same selection, we additionally record on our own server whether our website was accessed with a Google Ads click parameter before an order. For this purpose, we store a first-party cookie and pseudonymous identifiers and link the source information with your orders. We do not store the values of the click parameters for this allocation; the allocation is not transmitted to Google. The cookie and the order allocation are valid for a maximum of 30 days from recording and are not extended by further visits or orders. A technical withdrawal safeguard may exist for up to 30 days after withdrawal, so that delayed requests do not reactivate the consent. After withdrawal, we no longer use the allocation and remove the associated links via the secured clean-up. The processing is voluntary and not required for making a purchase.

A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses may also apply. Further information can be found in Google's privacy policy and in Google's information on international data transfers.

You can withdraw your consent to Google Ads at any time with effect for the future via the "Cookie settings" link in the page footer. When the Google Ads consent is withdrawn, all four consent signals are immediately set to "denied" and no further events are sent to Google. The storage period of the cookies set and the data processed by Google depends on the data type, purpose and account settings; Google describes the details under How Google retains data.

8b. Own product and order statistics (only with consent)

With your express consent in the cookie notice, we count product views, successful additions to the shopping basket, the opening of the order form and of the order summary as well as errors in input validation, price queries and order attempts. This allows us to identify where the purchasing process can be improved. The reports are sent exclusively to our own server and are not transmitted to Google for these statistics.

We store only daily counters per product and event, and in the case of errors, where applicable, additionally a predefined technical error category. The statistics contain no names, contact data, form entries, order numbers, IP addresses, session identifiers or ad click IDs. We do not store individual usage histories and do not create visitor profiles. The connection data and server log files arising from technical server operation are processed separately in accordance with section 3.

The evaluation covers the last 90 days; older daily values are removed the next time the statistics are retrieved. Participation is voluntary and not required for making a purchase. Without your consent, we do not send any reports for these statistics. You can withdraw your consent at any time with effect for the future via "Cookie settings". The legal bases are Art. 6 para. 1 lit. a DSGVO and, insofar as information is stored on or read from your terminal device, § 25 Abs. 1 TDDDG.

9. Location radar

If you use the location radar, we process the business site address you enter in order to analyse the surroundings of a possible vending machine site. Please do not enter a private address or confidential location data. The check only begins after you have expressly consented to the transmission of the address to Google Maps and of the coordinates determined from it to FOSSGIS.

To determine the coordinates, our server transmits the address to the Google Geocoding API. Google processes in particular the search query and technical information about the requesting SnackDragon server. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this processing, Google and Ventec Systems GmbH each act as independent controllers under the Google Maps Platform EEA terms. Google may process data on servers outside your country. Further information can be found in Google's privacy policy and the Google Maps Platform EEA terms. The legal basis for transmitting the address is your consent under Art. 6 para. 1 lit. a DSGVO; you can withdraw it with effect for the future.

Our server then retrieves mapped surroundings data on the basis of the coordinates via Overpass servers of FOSSGIS e.V. In this process, the coordinates, but not the address entered or your browser IP, are transmitted to FOSSGIS. The legal basis for transmitting the coordinates is likewise your consent under Art. 6 para. 1 lit. a DSGVO. The German-language assessment is then generated on our server according to fixed rules. Neither the address nor the coordinates nor derived location data are transmitted to OpenAI. Further information can be found in the FOSSGIS terms of use.

We do not permanently store the address entered or the exact coordinates. An analysis result derived from the position, without address and coordinates, may be cached for a maximum of 15 minutes in an access-protected temporary server directory so that identical queries are not repeated unnecessarily. To protect against misuse, we store a hash generated from the requesting IP address and a timestamp for a maximum of 24 hours. The legal bases for the location check carried out at your request and for protection against misuse are Art. 6 para. 1 lit. b and lit. f DSGVO.

10. Google Customer Reviews

Google Customer Reviews is activated.

After a qualifying order, the order confirmation page may display an optional preliminary selection for Google Customer Reviews. Before you make your selection, no connection to the Google module is established and no order data are transmitted to Google. Only if you choose "Show Google survey" do we load the official Google opt-in module and transmit the order number, e-mail address, country of delivery and estimated delivery date to Google. Google may use cookies, pixels or comparable technologies in this context. In the Google module then displayed, you decide whether Google may send you a rating survey by e-mail after the estimated delivery date. "Do not participate" has no disadvantages for your order.

The legal basis for loading the module, transmitting the order data and the possible access to your terminal device is your consent under Art. 6 para. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw consent with effect for the future; the lawfulness of processing already carried out remains unaffected.

Before the Google module is loaded, we log, as proof of your selection, exclusively the order number, version of the consent text, language and time. No additional e-mail address or IP address is stored for this purpose. The legal basis for this proof of consent is Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 DSGVO. After the end of the third calendar year following the consent, the proof is automatically removed during the next consent process, unless it is exceptionally required for longer for the establishment, exercise or defence of legal claims.

To protect public checkout, payment and consent endpoints against automated mass requests, we store in a temporary server directory an identifier of the requesting IP address pseudonymised with a secret server-side HMAC key, together with the times of the requests. For the limitation, the system only takes into account the respectively configured short time window, usually the last hour; outdated entries are removed during subsequent protected requests and additionally by the regular clean-up of temporary server files. By way of derogation, the IP hash described in section 9, stored for a maximum of 24 hours, applies to the location check. The legal basis is Art. 6 para. 1 lit. f DSGVO; our legitimate interest is the protection of order, payment, consent and location requests against abusive retrieval.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google and Ventec Systems GmbH each process the data under their own responsibility in accordance with the terms applicable to Google Customer Reviews. Processing by Google LLC in the USA or in other third countries is possible. Google LLC is certified under the EU-US Data Privacy Framework; Google additionally names further applicable transfer mechanisms. Further information can be found in Google's privacy policy and in Google's information on international data transfers.

The data record prepared for the opt-in is stored in your browser only for the session and for a maximum of 24 hours. It is deleted upon refusal, payment abort, invalid payment or order reconciliation and immediately upon the attempt to load the Google module after your consent. Google stores transmitted data for different periods depending on data type, purpose and account settings; some data are automatically deleted or anonymised, others may be retained for longer for security, misuse prevention or legal obligations. Google describes the details under How Google retains data.

10a. Postal direct marketing to businesses

To initiate business relationships, we send addressed advertising mail to companies, institutions and public authorities. The addresses used for this purpose come exclusively from publicly accessible sources, in particular from company websites, the commercial register (Handelsregister) and trade and location directories. The company name, address, sector and, where publicly stated, the job title or the name of a person authorised to represent the company are processed. Private individuals are not contacted.

The legal basis is Art. 6 para. 1 lit. f DSGVO. Our legitimate interest lies in direct marketing to commercial recipients; Recital 47 of the DSGVO expressly mentions processing for direct marketing purposes as a legitimate interest. Insofar as the addresses used are personal and we have not collected the data from you yourself, we will inform you of this in accordance with Art. 14 DSGVO at the latest with the first mailing.

We store these data for as long as they are necessary for the contact, but no longer than three years after the last contact. If you object to the advertising, we store your address permanently in a suppression list in order to reliably prevent further mailings; this continued storage serves solely to implement your objection.

You can object to the processing of your data for direct marketing purposes at any time and without giving reasons (Art. 21 para. 2 DSGVO). An informal message to info@snackdragon.eu is sufficient; thereafter no further advertising contact will take place.

11. Your rights

You have the following rights against us with regard to the personal data concerning you:

To exercise your rights, please contact: info@snackdragon.eu

You also have the right to lodge a complaint with a data protection supervisory authority (Datenschutzaufsichtsbehörde).

12. SSL encryption

For security reasons, our website uses SSL encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the padlock symbol in your browser bar.

13. Currency and amendment of this privacy policy

This privacy policy is currently valid and was last updated on 8 September 2026. Due to the further development of our website or as a result of changed legal requirements, it may become necessary to amend this privacy policy.

Last updated: 8 September 2026