Gibraltar Vending ("we", "us" or "our") operates commercial vending machine services across London and the surrounding areas, supplying snack, drinks, coffee, office, workplace and gym vending solutions. We are committed to protecting your privacy and handling your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what information we collect when you interact with our website, request a quote, become a client, or use our vending services, and how that information is used and protected.

We may collect and process the following categories of personal information:

• Contact details — name, business name, email address, phone number and site address provided through quote forms or direct enquiries.

• Business information — details about your premises, employee numbers, machine preferences and product requirements.

• Transactional data — invoicing details, purchase orders and payment records for client accounts.

• Machine telemetry — sales data, stock levels and operating status from machines installed on client sites (this does not identify individual end-users).

• Website usage data — IP address, browser type, device information, pages viewed and referring URL, collected via cookies and analytics tools.

We use personal information to:

• Respond to quote requests and enquiries about our vending services.

• Plan site surveys, installations, restocking schedules and maintenance visits.

• Provide ongoing customer support and account management.

• Process invoices, payments and contractual obligations.

• Improve our service offering, product ranges and website experience.

• Comply with our legal, regulatory and tax obligations in the United Kingdom.

Our website uses cookies and similar technologies to make the site work, remember your preferences and understand how visitors use it. These may include strictly necessary cookies, performance/analytics cookies and functional cookies. You can manage or disable cookies through your browser settings, though some site features may not function correctly without them.

Personal data is stored on secure servers located within the United Kingdom or European Economic Area where possible. We implement appropriate technical and organisational measures — including encryption, access controls and regular reviews — to safeguard your information against unauthorised access, loss or disclosure.

We work with trusted third-party providers who help us deliver our services, such as payment processors for contactless vending payments, telemetry platforms, accounting software, hosting providers and analytics services. These partners only process data on our instructions and under contractual obligations to protect it. We do not sell your personal data to any third party.

With your consent, or where we have a legitimate business interest, we may occasionally contact you about new products, service updates or special offers relevant to your vending setup. You can opt out at any time by clicking the unsubscribe link in our emails or contacting us directly.

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.

• Request correction of inaccurate or incomplete information.

• Request deletion of your personal data, subject to legal retention requirements.

• Restrict or object to certain types of processing.

• Request data portability where applicable.

• Withdraw consent to marketing communications at any time.

• Lodge a complaint with the UK Information Commissioner's Office (ICO).

We retain personal data only for as long as necessary to fulfil the purposes set out in this policy, to provide our vending services, and to comply with legal, accounting or reporting obligations. Inactive enquiry records are typically deleted after 24 months; client account records are retained for the duration of the contract and for up to seven years thereafter to meet UK tax law.

Our services are intended for businesses and adult professional users. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided personal data to us, please contact us so we can remove it.

​We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The latest version will always be available on this page with the updated date noted above.