Privacy Policy

1. Who we are

Innovative Vending Solutions (Pty) Ltd, trading as VendBot (“VendBot”, “we”, “us”) is a South African company (Registration No. 2024/176221/07, VAT No. 4260321890) that provides vending-machine telemetry, payment-terminal technology and a management portal to vending operators. Our registered business address is 11 Hammanshand Road (Stellenbosch LaunchLab), Stellenbosch, 7600, South Africa.

We are the “responsible party” under the Protection of Personal Information Act, 2013 (POPIA) for the processing described in this policy. This policy covers our public website (vendbot.co.za), our client portal (portal.vendbot.co.za), our mobile and terminal applications, and our merchant-onboarding services.

Our Information Officer is registered with the Information Regulator (South Africa), registration number 2026-034099. Contact the Information Officer via support@vendbot.co.za or the business address above.

2. Information we collect

Information you give us directly

We collect information that you or your authorised representative provide when you engage with VendBot, including details submitted through website enquiries, demo requests, sales discussions, client onboarding, portal account administration, support requests and ordinary correspondence. This may include names, contact details, company or trading details, location information, enquiry content, machine-related commercial context, portal account identifiers and role information, and the records reasonably required to assess and support a merchant relationship, including identity, company, banking-support, address and transaction-volume information where required for onboarding.

Information collected automatically

When our services are used, we process business and technical information generated by VendBot machines, terminals, the portal and supporting infrastructure. This includes machine and device identifiers, operational and diagnostic information, sales and transaction records, portal activity records, login and account-administration events, and standard connection information such as IP address, browser type and pages requested. Machine telemetry describes vending equipment and service activity rather than individual shoppers. Transaction records include the amount, date and time, machine reference, outcome, payment references and masked card details only, namely card scheme and last four digits.

Information from third parties

We also receive information from service partners where necessary to operate the service, including from AddPay in relation to merchant approval outcomes and transaction and settlement reporting associated with VendBot-enabled machines.

3. Why we process it, and on what basis

We process personal information for the purposes permitted by POPIA section 11, including responding to enquiries, preparing quotes and demonstrations, taking steps at your request before entering into a contract, onboarding merchants with our payment partner, providing the portal, telemetry, alerts, reporting, support, service notices and account administration, protecting systems and responding to incidents, meeting accounting, tax and record-keeping obligations, and sending direct marketing where consent or another lawful basis permits it. Depending on the context, the lawful basis is your consent, performance of a contract or steps preliminary to a contract, compliance with legal obligations that apply to VendBot or the payment ecosystem, or our legitimate interest in operating, securing and improving a business service.

Providing information marked as required on our forms is voluntary, but without it we cannot respond to your enquiry, administer the relevant relationship or complete merchant onboarding.

4. Merchant onboarding and our payment partner (AddPay)

Card acquiring for VendBot machines is provided by AddPay Payments Network (Pty) Ltd (“AddPay”). Where a VendBot client needs to be activated as a card-accepting merchant, we collect and assist with the onboarding and FICA information reasonably required for that purpose and make it available through AddPay’s onboarding process. AddPay performs the required identity, company and anti-money-laundering verification, makes the final decision on merchant approval, and activates approved merchants. AddPay retains onboarding records in accordance with its own legal obligations and is a responsible party in its own right for the processing it controls. VendBot keeps copies of onboarding documents in restricted, access-controlled storage only for as long as needed to support onboarding and our legal obligations. AddPay sends its merchant agreement and pricing schedule to you directly for signature.

5. Payment card data

We never receive, process or store full card numbers, CVV codes or PINs. Card payments on VendBot machines are captured and processed entirely within AddPay’s certified payment application on the payment terminal. Our systems receive only the transaction outcome, payment references, the amount, and masked card details (card scheme and last four digits) for receipts, reporting and reconciliation. Shoppers at vending machines are not identified by our systems.

6. Who we share information with

We share personal information only where necessary for the purposes described in this policy. Recipients include AddPay Payments Network (Pty) Ltd in South Africa for merchant onboarding, FICA verification, card acquiring and settlement, and category-based operators that provide cloud database, authentication and storage services, web portal hosting, website hosting, DNS and content delivery, contact-form relay services, business email and productivity services, and internal lead and enquiry-management tools. These providers process personal information on our instructions and under contractual safeguards, except where a recipient such as AddPay acts as a responsible party for processing it controls. We do not sell personal information, and we do not share it with third parties for their own advertising.

7. Cross-border transfers

Some providers listed above store information outside South Africa (for example, our portal database is hosted in the European Union). Where information leaves South Africa, we rely on section 72 of POPIA: the recipient is subject to laws or binding agreements that provide substantially similar protection to POPIA, or the transfer is necessary to perform our contract with you.

8. How we protect information

We maintain reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved, including restricted access for authorised personnel bound by confidentiality obligations, encrypted transmission, access controls designed to limit client records to the relevant client context, controlled storage for onboarding documents, credential-management practices and incident-response procedures. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by section 22 of POPIA.

9. Retention, marketing and your choices

We keep personal information only as long as needed for the purposes above or as required by law (for example, tax and company records). Enquiry data that does not lead to a client relationship is deleted or anonymised within a reasonable period. Onboarding document copies are kept only as long as needed to support onboarding and our legal obligations, after which they are deleted.

Direct marketing: we only send electronic marketing where the law allows, and every message will include an opt-out. To opt out at any time, email support@vendbot.co.za with the subject “Unsubscribe”.

10. Your rights

Under POPIA you may, at any time and free of charge (a small fee may apply to copies):

• Access — ask whether we hold personal information about you and request a copy;
• Correction — ask us to correct or update inaccurate information;
• Deletion — ask us to delete or destroy information we no longer need;
• Objection — object to processing based on legitimate interests, and opt out of direct marketing;
• Complaint — complain to the Information Regulator (South Africa): inforegulator.org.za.

To exercise any right, contact our Information Officer at support@vendbot.co.za. We may ask you to verify your identity first. We aim to respond within a reasonable time and in any event as required by law. See also our PAIA Manual for formal access requests.

11. Changes to this policy

We may update this policy as our services evolve. The current version, with its effective date and version number, will always be published on this page. Material changes affecting existing clients will be notified by email.