Privacy notice — website enquiries

Who we are

This site is operated by VendOptima Limited (company number 16672458), a company registered in England and Wales. Registered office: Unit 6, 147 Great Ducie Street, Manchester, England M3 1FB.

Phone: 0161 726 5243
Email (privacy / rights): info@vendoptima.com

For UK data protection law, VendOptima Limited is the controller of personal data described in this notice.

VendOptima Limited is registered with the Information Commissioner’s Office (ICO). Registration reference: ZC264232.

What this notice covers

This notice covers:

Personal data you submit through enquiry forms on vendoptima.com
Related business contact details we keep in our customer relationship systems so we can respond, assess a site, and (if you wish) move toward a written placement arrangement
The embedded explainer video on this site, played through YouTube’s privacy-enhanced player

It does not replace any separate privacy terms that may apply once you become a contracted site under a written agreement.

What we collect

Name, email address and message (needed so we can reply)
Optional postcode or area, and site type
Technical fields such as the page you enquired from and anti-spam form fields
Where Google reCAPTCHA is shown, interaction data that Google processes as part of that CAPTCHA
If you accept analytics cookies, usage data via Google Analytics 4 (for example pages viewed), processed by Google as described under Cookies below
If you play the embedded explainer, technical data that YouTube (Google) receives when the player loads and when the video plays, as described under Cookies below

If we speak or meet about a site, we may also keep notes of that correspondence, site details, and next steps.

We do not ask for payment card details on this website.

Suppliers and business contacts: if you work for one of our suppliers or another business we deal with, we hold your name and work contact details (email, phone, role) so we can place orders and manage our relationship. We rely on our legitimate interests to do this, we do not use it for marketing, and we keep it while we work together and for up to 24 months after our last dealing.

Business prospects: we may record details of people at businesses that might host a machine or work with us, taken from their public professional profiles (for example LinkedIn). This is limited to name, job title, employer, general location and a note of where and when we found them. We do not collect personal email addresses or phone numbers this way. We rely on our legitimate interests in finding suitable host sites and business partners. If we contact you, we will tell you where we got your details and point you to this notice. You can object at any time and we will stop; we keep a short note so we don't add you again. If there has been no meaningful contact within 12 months of adding you, we delete your record.

Card payments: when you pay by card at one of our machines, the payment is handled by our payment provider, myPOS Payments Ltd, which is authorised by the Financial Conduct Authority. We never see or store your full card number, PIN or security code. We receive a transaction record (date, time, amount, the last digits of your card and the card type), which we use to manage refunds and chargebacks and keep for as long as we need it for our accounts and tax records. myPOS also processes your payment details under its own privacy policy.

Why we use it

We use this information to reply to your enquiry, assess whether we can cover your site, take steps toward a site assessment and written agreement if you wish to proceed, and keep an organised record of host-site conversations in our CRM. If you accept analytics cookies, we also use aggregated usage statistics to understand how the website is used and to improve it.

Lawful bases (UK GDPR):

Steps toward a contract, where you are (or will be) the contracting party — for example a sole trader or individual contracting in their own name
Legitimate interests, where we deal with named contacts at limited companies or other organisations for B2B free-placement / site discussions
Legitimate interests, where we identify and approach potential host sites and business partners using information people have made public in a professional capacity

We do not rely on consent merely to answer a site enquiry you sent us. Separate rules under PECR apply if we send electronic marketing; we do not add you to a marketing list just because you submitted an enquiry.

Who receives it

We do not sell your details. Depending on the channel, personal data may be processed by:

Formspree — receives website form submissions and delivers them to us
HubSpot — our CRM (HubSpot Free CRM), used to organise enquiries, host-site pipeline records, supplier and business contacts, and business prospects
Google Analytics 4 — usage statistics so we can understand how the site is used and improve it (only if you accept analytics cookies; Measurement ID G-5P4SJ7FZFZ)
Google — where reCAPTCHA is shown on a form, for spam protection
YouTube (Google) — when you play the embedded explainer. YouTube decides how it uses that data. It is not a supplier acting only on our instructions. We do not add our own analytics to the video.
Our email / workspace provider — to receive and send messages
myPOS Payments Ltd — card payments at our machines
Professional advisers (for example accountants or solicitors) where needed to advise us

We remain the controller for enquiry, CRM and analytics purposes described above. Formspree, HubSpot, Google Analytics, reCAPTCHA and our email provider process that data for us under their terms and, where applicable, data processing agreements. YouTube is separate: when you play the embedded video, YouTube uses the data for its own purposes.

myPOS Payments Ltd also uses payment data for its own purposes as a regulated payment provider, under its own privacy policy: https://merchant.mypos.com/en-gb/terms-conditions/doc:PP.

International transfers

Personal data may be processed outside the UK (for example by our CRM or form providers). Where that happens, we rely on appropriate safeguards under UK data protection law, such as the UK Addendum to the EU Standard Contractual Clauses or other mechanisms set out in the provider’s data processing terms. Our CRM provider, HubSpot, may process data in the United States; for UK data it relies on the UK Extension to the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses with the UK Addendum, as set out in its data processing agreement.

We do not claim that all personal data stays only in the UK.

You can read Formspree’s privacy information at formspree.io/legal/privacy-policy. HubSpot’s privacy policy is at legal.hubspot.com/privacy-policy and its data processing agreement is at legal.hubspot.com/dpa. Google’s privacy and terms for Analytics, reCAPTCHA and YouTube are at policies.google.com/privacy and policies.google.com/terms. Where Google processes data outside the UK, we rely on appropriate safeguards under UK data protection law and Google’s published terms for those products. YouTube’s own description of the privacy-enhanced player is at support.google.com/youtube/answer/171780.

How long we keep it

We keep enquiry and related CRM records we control for 24 months from the last meaningful correspondence on that matter, unless a contract follows — in which case we keep what the agreement and any longer legal needs require. After that we delete or anonymise records we control, subject to any legal hold.

Formspree, HubSpot, Google and our email provider may also retain data according to their own retention practices and our account settings with them.

Cookies and similar technologies

We do not set our own advertising cookies on this site. The embedded YouTube player is separate, as set out below.

Analytics (Google Analytics 4): If you choose Accept on our cookie banner, we load Google Analytics 4 (Measurement ID G-5P4SJ7FZFZ) to collect usage statistics (for example pages viewed and approximate location derived from IP in Google’s systems) so we can understand site use and improve the website. Analytics cookies and related storage are set only after you accept. If you choose Reject, we do not load Analytics for that choice and keep analytics storage denied. We remember your choice in your browser (local storage key vo_cookie_consent). You can clear site data in your browser to be asked again.

Embedded video (YouTube): The explainer uses YouTube’s privacy-enhanced player. The player address starts with youtube-nocookie.com, and the player is not loaded until you choose to play. YouTube says this mode means the view is not used to personalise your later browsing on YouTube, and that any ads in the player are not personalised. It does not mean YouTube sets no cookies. When you play, YouTube can set cookies and similar storage, and can receive your IP address, device and browser details, and the fact that you played the video. Loading the player can also send technical data to Google. That is separate from our analytics cookie choice: choosing Reject on the cookie banner does not stop YouTube if you then play the video. We do not use the video to run our own analytics.

Spam protection (Google reCAPTCHA): Enquiry forms may use Google reCAPTCHA v2 to reduce spam. When the CAPTCHA is shown and you use it, Google may collect hardware and software information and may set cookies. That is separate from analytics. Google’s processing is governed by Google’s Privacy Policy and Terms of Service. We use reCAPTCHA only for spam protection on enquiry forms.

Automated decisions

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.

Your rights

Under UK GDPR you may have rights to access, rectify, erase, restrict or object to certain processing of your personal data, and rights relating to data portability where applicable.

You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk.

To exercise rights in relation to data we control, email info@vendoptima.com, use the website enquiry form, or call 0161 726 5243.

Contact

Privacy / rights: info@vendoptima.com
Phone: 0161 726 5243
Post: Unit 6, 147 Great Ducie Street, Manchester, England M3 1FB

Last updated: 20 October 2026.