Privacy Policy
Last updated: 28/07/2026 · Version 2026-07-28
1. Who is the data controller
| Controller | Expendedoras U-Retail S.L. (hereinafter, "1Self Vending" or "we") |
| CIF | B16794505 |
| Registered office | Sociedad Cultural y Deportiva Betis Florida, 5, Local 2, 03007 Alicante (España) |
| Contact email | info@1selfvending.com |
| Phone | +34 605 303 684 |
| Website | https://1selfvending.com |
No Data Protection Officer has been appointed, as the conditions of art. 37 GDPR and art. 34 LOPDGDD do not apply. For any privacy matter you can write to the contact email above.
1Self, uNobo Connect and other distinctive signs are trademarks owned by Bonobo Services OÜ, used by the controller under licence. The controller of the personal data collected through this website is, in any case, Expendedoras U-Retail S.L..
2. Applicable law
We process your data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD) and, as regards commercial communications and the use of cookies and similar technologies, Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).
3. What data we process
3.1. Data you provide in the contact or quote request form
First name and surname; email address; phone number (with international prefix); information about your project: what you need the machine for (profile), province, city or area of interest, whether you have premises, expected start timeframe and the free-text message you wish to send us (600 characters maximum); and the language you browse in (ES, EN or PT).
3.2. Origin and advertising attribution data (only if you have accepted marketing cookies and technologies)
Campaign parameters present in the URL you arrived through (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, fbclid) and the landing page address. This information is stored in your browser’s local storage and linked to your request so we know through which channel you found us.
3.3. Technical and security data of the form
To prevent automated submissions and abuse, we process your IP address for anti-bot verification and the hourly limit. Security logs retain the normalised verification result and reason, attempt number, form-completion time range, presence of expected technical context, whether the form would have passed ordinary validation, secondary suspicion signals, and the selected origin, language, profile, timeframe, premises and province categories. We do not log name, email, phone number, free-text message, Turnstile token, full user-agent or attribution URL.
3.4. Site usage data (only if you have accepted analytics cookies)
PostHog records the pages and features you interact with and, for the form, the normalised verification outcomes and derived categories described in section 3.3, together with browser technical data and a pseudonymous identifier. PostHog does not store information or receive events before you accept analytics cookies. You may withdraw consent at any time through "Cookie settings".
3.5. Evidence of consent
We keep, together with your request, the exact text you accepted, the date and time of submission, the version of this policy in force at that time and the site from which the form was sent. We do this to be able to demonstrate compliance with the regulations (arts. 5.2 and 7.1 GDPR).
3.6. Internal quality flagging of records
Submissions that do not pass Turnstile are automatically rejected and are not added to our commercial system. If a submission passes Turnstile but shows secondary signals consistent with automation, it is accepted and flagged for human review. This security measure does not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR; if verification fails, you may retry or contact us by phone or email.
3.7. Data we do NOT process
We do not request or process special categories of data (art. 9 GDPR: health, ideology, ethnic origin, biometrics, etc.). We do not buy databases or collect data from publicly available sources: all data comes from you.
4. What we use your data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Handling your information request, preparing and sending you a quote and arranging the meeting or call you requested (including the email with the scheduling link and phone or WhatsApp contact for that same purpose). | Art. 6.1(b) GDPR: pre-contractual measures taken at your request. |
| Sending you commercial communications about our products, services, campaigns and news, other than the specific request you made. | Art. 6.1(a) GDPR and art. 21 LSSI: your specific consent, which where applicable we will request via a separate, voluntary checkbox. You may withdraw it at any time without affecting the handling of your request. |
| Protecting the form and the site against automated submissions, fraud and abuse (Cloudflare Turnstile anti-bot verification, honeypot field, per-IP submission limit and security logs). | Art. 6.1(f) GDPR: legitimate interest in the security of our systems and data quality (recitals 47 and 49 GDPR). |
| Measuring website usage, producing statistics and measuring the effectiveness of our advertising campaigns. | Art. 6.1(a) GDPR and art. 22.2 LSSI: your consent, given through the cookie panel. |
| Complying with legal obligations (commercial, tax and data protection) and handling or defending claims. | Art. 6.1(c) and art. 6.1(f) GDPR. |
Ticking the box "I have read and accept the Privacy Policy" does not authorise advertising: we will only send you commercial communications unrelated to your request if we have your specific consent to do so.
5. How long we keep your data
| Data or scenario | Period |
|---|---|
| Request that does not become a commercial relationship | 12 months from the last effective contact with you; then deleted or anonymised. |
| Customer data | For the duration of the contractual relationship and, afterwards, blocked for the statutory limitation periods: 4 years (art. 66 of Spanish Law 58/2003, General Tax Law), 6 years (art. 30 of the Commercial Code) and 5 years for personal actions (art. 1964 of the Civil Code). |
| Data processed with your consent for advertising | Until you withdraw consent or unsubscribe. We will keep proof of consent and of the withdrawal for a further 3 years, in order to demonstrate them. |
| Per-IP submission control key (anti-abuse) | 1 hour. |
| Server technical and security logs | Up to 24 hours in Vercel under the current configuration; we do not retain an additional copy. |
| Cookies and similar technologies | As indicated for each of them in the Cookies Policy. |
6. Who we share your data with
We do not sell or transfer your data to third parties for their own purposes. It is accessed, as processors and under a contract pursuant to art. 28 GDPR, by the providers we need in order to serve you:
| Provider | Purpose | Processing country |
|---|---|---|
| ActiveCampaign, LLC | CRM and email automation: where your request is recorded and from where we write to you. | USA |
| Vercel Inc. | Website hosting, form execution and technical logs. | USA |
| Cloudflare, Inc. | Anti-bot verification (Turnstile) and static asset delivery. | USA and global network |
| Google Ireland Ltd. / Google LLC | Analytics (GA4), tag management (GTM), advertising (Google Ads), web fonts and YouTube videos. Only with your consent, except for technical resource delivery. | Ireland and USA |
| PostHog, Inc. | Product analytics and measurement of site interactions. Storage and event delivery are enabled only after you accept analytics cookies. | EU (regional infrastructure) |
| Upstash, Inc. | Per-IP submission control to prevent form abuse. | EU or USA, depending on the configured service region |
| Meta Platforms Ireland Ltd. (WhatsApp) | WhatsApp contact when we use it as a channel to handle your request. | Ireland and USA |
| Bonobo Services OÜ | Platform support and corporate services of the group. | Estonia (EEA) |
We may also disclose your data to courts, law enforcement, public administrations and our legal, accounting and tax advisers, where there is a legal obligation or where necessary to defend our rights.
7. International data transfers
Some of the above providers process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by one of these safeguards: the European Commission adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), where the importer is certified and active in the official programme list; or the Standard Contractual Clauses approved by Implementing Decision (EU) 2021/914, supplemented by a transfer impact assessment and additional measures (encryption in transit, minimisation and pseudonymisation of technical identifiers).
You can request information about the safeguard applied to each provider, and a copy of it, by writing to info@1selfvending.com.
8. What your rights are
You may exercise, free of charge, the rights of access, rectification, erasure (right to be forgotten), objection (including objection, at any time and without stating reasons, to processing for direct marketing purposes), restriction of processing, portability, the right not to be subject to automated individual decisions with legal or similar effects, and the right to withdraw consent at any time, without affecting the lawfulness of processing prior to its withdrawal.
How to exercise them: by writing to info@1selfvending.com or by post to Expendedoras U-Retail S.L., Sociedad Cultural y Deportiva Betis Florida, 5, Local 2, 03007 Alicante (España), indicating the right you are exercising. We may ask you to prove your identity. We will reply within one month of receiving the request, extendable by two further months if the request is complex (art. 12.3 GDPR).
Complaint to the supervisory authority: if you consider that we have not properly handled your request, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid; electronic office at www.aepd.es). Beforehand, and optionally, you may contact our privacy officer at the contact email.
9. Information security
We apply appropriate technical and organisational measures (art. 32 GDPR): encrypted communications (HTTPS), server-side validation and filtering of submissions, anti-bot verification, per-IP submission limits, credentials kept in encrypted environment variables, CRM access restricted to necessary personnel and minimisation of the data kept in technical logs (pseudonymised IP address and masked email).
10. Social media and third-party content
If you interact with our profiles on Facebook, Instagram or YouTube, those platforms process your data under their own policies, over which we have no control. We embed YouTube videos on this site: when you play them, Google may process data from your device under its own privacy policy.
11. Minors
This site and our services are aimed at adults and professionals. We do not knowingly collect data from children under 14 (art. 7 LOPDGDD). If we detect that we have received data from a minor without the consent of their parents or guardians, we will delete it.
12. Changes to this policy
We may update this policy to adapt it to regulatory changes or new services. The version in force is always the one published on this page, with its update date. We keep the version history and the specific version you accepted when sending us your data.
General information (legal notice)
In accordance with article 10 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, we provide you with the following information:
Expendedoras U-Retail S.L., with Tax ID (CIF) B16794505, with registered office at Sociedad Cultural y Deportiva Betis Florida, 5, Local 2, 03007 Alicante (España). Email: info@1selfvending.com.
On the website www.1selfvending.com there is a range of informational content about the vending sector and the company's activity. Its main objective is to provide clients and the general public with information about the company and the products and services offered. The commercial offering of this site is aimed at professionals and businesses.
The processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), as described in this Privacy Policy and in the Cookies Policy.
Terms of use
The conditions of access and use of this website are governed by current legislation and the principle of good faith, with the user undertaking to make proper use of the website. Conduct that goes against the law or the rights or interests of third parties is not permitted.
Being a user of the website www.1selfvending.com means that you acknowledge having read and accepted these conditions and any extension of them under the applicable legislation. If for any reason you do not agree with these conditions, please do not continue using this website.
You may address any query, notice or claim to info@1selfvending.com or by post to Expendedoras U-Retail S.L., Sociedad Cultural y Deportiva Betis Florida, 5, Local 2, 03007 Alicante (España). If you act as a consumer, the above is without prejudice to your right to turn to the competent consumer bodies.
Governing law and jurisdiction: these conditions are governed by Spanish law. For relationships between businesses or professionals, the parties submit to the Courts of Alicante; if you act as a consumer, the mandatory jurisdiction of your place of residence shall apply.
Liability
Expendedoras U-Retail S.L. is not responsible for the information and content stored in forums, social networks or any other medium that allows third parties to publish content independently on the provider's website. Nor is it responsible for the content of third-party pages that may be accessed via links from this site.
However, taking into account articles 11, 16 and 17 of the LSSI-CE, Expendedoras U-Retail S.L. undertakes to remove or, where appropriate, block any content that could affect or contravene national or international legislation, the rights of third parties, or morality and public order.
Nor shall the company be liable for any damages resulting from failures or misconfigurations of the software installed on the user’s computer. All liability is excluded for any technical incident or failure that occurs when the user connects to the internet. Likewise, the absence of interruptions or errors in access to the website is not guaranteed.
Likewise, Expendedoras U-Retail S.L. reserves the right to update, modify or delete the information contained on its website, as well as its configuration or presentation, at any time and without assuming any liability for it. Any price you may see on the website is indicative unless otherwise stated; to know the exact price or current offers, contact us by email or phone.
Intellectual and industrial property
The trademarks 1Self, uNobo Connect and other distinctive signs used on this site are owned by Bonobo Services OÜ and are used by Expendedoras U-Retail S.L. under licence. All other content (texts, images, videos, designs and software) is owned by Expendedoras U-Retail S.L. or its licensors.
No material published on this website may be reproduced, copied or published without the written consent of Expendedoras U-Retail S.L..
If you send us comments, suggestions or ideas, you grant us a non-exclusive, free licence to use them to improve our products and services, unless you tell us otherwise. This licence does not extend to your personal data, the processing of which is governed by this Privacy Policy, nor to information you are obliged to keep confidential.
All products and services on these pages that are NOT the property of Expendedoras U-Retail S.L. or Bonobo Services OÜ are registered trademarks of their respective owners and are recognized as such by our company. They only appear on the website for promotional and information-gathering purposes. These owners may request the modification or removal of the information that belongs to them.