Privacy policy

01 The key points

• This website uses no tracking: no analytics or statistics services, no advertising or social media pixels, no user profiles.
• There is no embedded content from other providers, such as maps, videos or social media posts. The fonts are served from our own web server.
• Details entered in forms reach us as an email. The website also stores them so that no enquiry gets lost, and deletes them there automatically after six months.
• For visitors, only one technically necessary cookie is set to protect the website – which is why there is no consent banner.

02 Controller

The controller responsible for processing personal data on this website is:

Automaten Maxxx OG
Kaasgrabengasse 121A
1190 Vienna, Austria
Phone: +43 678 791 88 70 (available 24/7)
Email: office@automatenmax.com

For questions about data protection and anything concerning your own data, an email to this address is all it takes. Further company details are in our legal notice.

03 Hosting and delivery of the website

The website is hosted by GoDaddy (Managed WordPress hosting). It is delivered via the content delivery network (CDN) of Cloudflare, which serves the pages quickly and protects the website against attacks and automated access.

When a page is requested, these services process data that every browser transmits for technical reasons:

• IP address,
• date and time of access,
• the address (URL) requested and, if transmitted, the page visited before (referrer),
• browser and operating system (user agent),
• status code and amount of data transferred.

Purpose: delivering the website, stability and security, for example fending off attacks and tracing errors. Legal basis: our legitimate interest in the secure and proper operation of the website (Art. 6(1)(f) GDPR). Retention period: the log data is kept only for as long as necessary for these purposes.

GoDaddy processes this data as a service provider on our behalf (Art. 28 GDPR) and uses Cloudflare as a further service provider for delivery.

04 Contact by phone and email

If you call or write to us, you give us the details needed for your request – for example your name, phone number, email address and a description. We use them only to handle and answer your request.

Legal basis: steps prior to entering into a contract or the performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Our email inbox is hosted on Microsoft 365, with Microsoft acting as our service provider.

Retention period: for as long as needed to handle the request and any follow-up questions. If a contract results, we keep the records for as long as statutory retention obligations require (for example under commercial and tax law).

05 Forms on this website

The website has forms for the location check, location suggestions, fault reports, refund requests, product requests, general enquiries and enquiries about buying and renting vending machines, event vending machines and coffee machines.

What is processed

The details entered in the form (required fields are marked with *), plus the page, the language, the time of sending and your consent. If we refund money by bank transfer following a refund request, we also process the bank details needed for this.

How it reaches us

The completed form is sent as an email to office@automatenmax.com. We use the email service SMTP2GO (Sand Dune Mail Limited, Christchurch, New Zealand) for sending, with an account in the provider’s EU data centre. SMTP2GO processes the message as a service provider on our behalf (Art. 28 GDPR) solely to deliver it; we have concluded a data processing agreement. The website also keeps a sending log, which it deletes automatically after 14 days. From then on, the same applies as for emails (section 04).

In addition, the website stores the details in its database so that no enquiry gets lost – for example if an email is not delivered. It also records whether the email could be sent. The database is hosted by our hosting provider GoDaddy, which operates it as a service provider on our behalf (section 03). Only we, as the operators of the website, can view the stored enquiries in the protected admin area. The IP address is not stored with the enquiry.

Retention period

In the website’s database, enquiries are deleted automatically six months after they were sent. If we need the details for longer – for example for an ongoing business relationship or because statutory retention obligations require it – we keep them as described in section 04.

Legal basis

Your consent given by ticking the box in the form (Art. 6(1)(a) GDPR); where a contract or an enquiry about one is concerned, also Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future – an informal email to office@automatenmax.com is enough. Nobody is obliged to give us any data; without the required details, however, we cannot process a request.

Protection against misuse

To prevent automated misuse of the forms, the website checks an invisible field, a minimum time between loading and sending, and the number of forms sent. For this, a shortened, irreversible check value (hash) of the IP address is stored – without any form content. It expires after ten minutes. Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR).

06 No analytics, no embeds

This website uses no analytics or statistics services (for example, neither Google Analytics nor Google Tag Manager), no advertising or social media pixels and no social media plugins. We do not create user profiles and do not use automated decision-making.

No content from other providers is embedded either. The location map is our own drawing and does not load anything from map services.

Fonts

The fonts used on this website are hosted on our own web server. No connection to Google Fonts or any other font provider is made when you visit the website.

07 Cookies

The website itself does not set any cookies. Cloudflare’s CDN sets one technically necessary security cookie (__cf_bm) that distinguishes humans from automated access; it expires after 30 minutes. Only users who log in to the website’s admin area (WordPress) also receive the WordPress login cookies.

Legal basis: § 165(3) of the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021) – strictly necessary for operation – and Art. 6(1)(f) GDPR. All details are in our cookie notice.

08 “Get directions” with Google Maps

For our locations, “Get directions” takes you to Google Maps. Google Maps is not embedded on this website: it only opens in a new tab when you click, and only then is data such as your IP address and the address of the location transmitted to Google.

Google is responsible for the processing there – for users in Europe, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google’s privacy policy applies.

09 Video surveillance in the vending shops

Video cameras are in operation in our five vending shops:

• 24/7 Automatenshop Bruck an der Leitha, Hauptplatz 10-11, 2460 Bruck an der Leitha
• 24/7 Automatenshop Eggenburg, Hauptplatz 7, 3730 Eggenburg
• 24/7 Automatenshop Gars am Kamp, Wienerstraße 346, 3571 Gars am Kamp
• 24/7 Automatenshop Krems an der Donau, Untere Landstraße 33, 3500 Krems an der Donau
• 24/7 Shop Wien, Schönbrunner Straße 99, 1050 Vienna (Margareten)

We do not operate video surveillance at our single vending machines – in the garages in Vienna’s Landstraße and Simmering districts and in Klosterneuburg.

The cameras in the shops serve to protect the machines and goods and to help investigate vandalism, theft and damage.

Legal basis: our legitimate interest in protecting our property (Art. 6(1)(f) GDPR). Retention period: recordings are stored only for as long as necessary for this purpose and are then deleted. They are passed on only where this is necessary to investigate an incident, for example to security authorities, courts or our insurer.

The rights set out in section 11 also apply to recordings.

10 Recipients and transfers to third countries

Personal data is received only by the service providers named above (GoDaddy, Cloudflare, Microsoft, SMTP2GO) within the scope of their tasks, and by bodies to which we are required or permitted to pass it, such as authorities, courts or our insurer in the event of a claim. We do not sell data and do not pass it on for advertising.

GoDaddy, Cloudflare and Microsoft are companies headquartered in the USA, so personal data may be transferred to the USA. Such transfers are based on the safeguards under Art. 44 et seq. GDPR provided by the respective provider – in particular the European Commission’s adequacy decision on the EU-US Data Privacy Framework, where the provider is certified under it, and otherwise the European Commission’s standard contractual clauses.

SMTP2GO is headquartered in New Zealand, for which an adequacy decision of the European Commission applies. Where SMTP2GO uses further service providers outside the EU, the safeguards under Art. 44 et seq. GDPR apply.

11 Rights and complaints

Anyone whose data is processed has the following rights under the GDPR:

• access to the stored data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on our legitimate interest (Art. 21),
• withdrawal of consent with effect for the future (Art. 7(3)).

To exercise these rights, an email to office@automatenmax.com is all it takes.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

12 Security and changes

The connection to this website is encrypted via HTTPS. Only authorised persons have access to the admin area.

We update this privacy policy whenever the website, our service providers or the legal situation change. The version published here, with the date shown above, applies.