Privacy Policy

1. Who we are

Innovative Vending Solutions (Pty) Ltd, trading as VendBot (“VendBot”, “we”, “us”) is a South African company (Registration No. 2024/176221/07, VAT No. 4260321890) that provides vending-machine telemetry, payment-terminal technology and a management portal to vending operators. Our registered business address is 11 Hammanshand Road (Stellenbosch LaunchLab), Stellenbosch, 7600, South Africa.

We are the “responsible party” under the Protection of Personal Information Act, 2013 (POPIA) for the processing described in this policy. This policy covers our public website (vendbot.co.za), our client portal (portal.vendbot.co.za), our mobile and terminal applications, and our merchant-onboarding services.

Our Information Officer is registered with the Information Regulator (South Africa), registration number 2026-034099. Contact the Information Officer via support@vendbot.co.za or the business address above.

2. Information we collect

Information you give us directly

We collect information that you or your authorised representative provide when you engage with VendBot, including details submitted through website enquiries, demo requests, sales discussions, client onboarding, portal account administration, support requests and ordinary correspondence. This may include names, contact details, company or trading details, location information, enquiry content, machine-related commercial context, portal account identifiers and role information, and the records reasonably required to assess and support a merchant relationship, including identity, company, banking-support, address and transaction-volume information where required for onboarding.

Information collected automatically

When our services are used, we process business and technical information generated by VendBot machines, terminals, the portal and supporting infrastructure. This includes machine and device identifiers, operational and diagnostic information, sales and transaction records, portal activity records, login and account-administration events, and standard connection information such as IP address, browser type and pages requested. Machine telemetry describes vending equipment and service activity rather than individual shoppers. Transaction records include the amount, date and time, machine reference, outcome, payment references and masked card details only, namely card scheme and last four digits.

Information from third parties

We also receive information from service partners where necessary to operate the service, including from AddPay in relation to merchant approval outcomes and transaction and settlement reporting associated with VendBot-enabled machines.

3. Why we process it, and on what basis

We process personal information for the purposes permitted by POPIA section 11, including responding to enquiries, preparing quotes and demonstrations, taking steps at your request before entering into a contract, onboarding merchants with our payment partner, providing the portal, telemetry, alerts, reporting, support, service notices and account administration, protecting systems and responding to incidents, meeting accounting, tax and record-keeping obligations, and sending direct marketing where consent or another lawful basis permits it. Depending on the context, the lawful basis is your consent, performance of a contract or steps preliminary to a contract, compliance with legal obligations that apply to VendBot or the payment ecosystem, or our legitimate interest in operating, securing and improving a business service.

Providing information marked as required on our forms is voluntary, but without it we cannot respond to your enquiry, administer the relevant relationship or complete merchant onboarding.

4. Merchant onboarding and our payment partner (AddPay)

Card acquiring for VendBot machines is provided by AddPay Payments Network (Pty) Ltd (“AddPay”). Where a VendBot client needs to be activated as a card-accepting merchant, we collect and assist with the onboarding and FICA information reasonably required for that purpose and make it available through AddPay’s onboarding process. AddPay performs the required identity, company and anti-money-laundering verification, makes the final decision on merchant approval, and activates approved merchants. AddPay retains onboarding records in accordance with its own legal obligations and is a responsible party in its own right for the processing it controls. VendBot keeps copies of onboarding documents in restricted, access-controlled storage only for as long as needed to support onboarding and our legal obligations. AddPay sends its merchant agreement and pricing schedule to you directly for signature.

5. Payment card data

We never receive, process or store full card numbers, CVV codes or PINs. Card payments on VendBot machines are captured and processed entirely within AddPay’s certified payment application on the payment terminal. Our systems receive only the transaction outcome, payment references, the amount, and masked card details (card scheme and last four digits) for receipts, reporting and reconciliation. Shoppers at vending machines are not identified by our systems.

6. Who we share information with

We share personal information only where necessary for the purposes described in this policy. Recipients include AddPay Payments Network (Pty) Ltd in South Africa for merchant onboarding, FICA verification, card acquiring and settlement, and category-based operators that provide cloud database, authentication and storage services, web portal hosting, website hosting, DNS and content delivery, business email and productivity services, internal lead and enquiry-management tools, and an AI service provider that will help us draft replies to enquiries. These providers process personal information on our instructions and under contractual safeguards, except where a recipient such as AddPay acts as a responsible party for processing it controls. We do not sell personal information, and we do not share it with third parties for their own advertising.

7. Cross-border transfers

Some providers listed above store information outside South Africa (for example, our portal database is hosted in the European Union, and the AI service provider that will help us draft replies will process enquiry text outside South Africa). Where information leaves South Africa, we rely on section 72 of POPIA: the recipient is subject to laws or binding agreements that provide substantially similar protection to POPIA, or the transfer is necessary to perform our contract with you.

8. How we protect information

We maintain reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved, including restricted access for authorised personnel bound by confidentiality obligations, encrypted transmission, access controls designed to limit client records to the relevant client context, controlled storage for onboarding documents, credential-management practices and incident-response procedures. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by section 22 of POPIA.

9. Retention, marketing and your choices

We keep personal information only as long as needed for the purposes above or as required by law (for example, tax and company records). Enquiry data that does not lead to a client relationship is deleted or anonymised within a reasonable period. Onboarding document copies are kept only as long as needed to support onboarding and our legal obligations, after which they are deleted.

Direct marketing: where the law allows it, we may send marketing emails to people who have asked for them, to existing customers about products similar to the ones they bought from us, and to people who enquired with us before our form offered that choice. Our contact form has a box you can tick to ask for specials and product news; it is unticked by default and ticking it is the clearest way to tell us you want them. Leaving it unticked means we will not email you marketing, and either way it makes no difference to your enquiry. If you enquired with us before our form offered that choice, we may email you about specials; every one of those emails has an unsubscribe link. We keep a record of the wording version you agreed to and when, so we can show what you consented to. Every marketing email we send has an unsubscribe link, and one click is enough; you can also tell us to stop at any time by emailing support@vendbot.co.za.

10. Your rights

Under POPIA you may, at any time and free of charge (a small fee may apply to copies):

• Access — ask whether we hold personal information about you and request a copy;
• Correction — ask us to correct or update inaccurate information;
• Deletion — ask us to delete or destroy information we no longer need;
• Objection — object to processing based on legitimate interests, and opt out of direct marketing;
• Complaint — complain to the Information Regulator (South Africa): inforegulator.org.za.

To exercise any right, contact our Information Officer at support@vendbot.co.za. We may ask you to verify your identity first. We aim to respond within a reasonable time and in any event as required by law. See also our PAIA Manual for formal access requests.

11. Enquiries and AI-assisted replies

When you send us an enquiry, for example through this website or by email, we will use AI tools to help our team draft a reply. Only the text of your most recent message will be processed for that purpose, after screening and never with attachments, by an AI service provider. Before any enquiry is handled this way, an agreement with that provider will be in place that limits its use of your information to drafting the reply. A member of our team will review and send every reply; replies will not be sent automatically.

Your rights, including access, correction and deletion, are set out in section 10.

12. Changes to this policy

We may update this policy as our services evolve. The current version, with its effective date and version number, will always be published on this page. Material changes affecting existing clients will be notified by email.