Privacy notice

1. Data controller

Name

IVP SOLUTION Intelligent Vending Products Zártkörűen Működő Részvénytársaság

Registered office

4002 Debrecen, Domokos Márton kert 70., Hungary

E-mail

office@ivpzrt.eu

Phone

+36 70 93 111 84

On the IVPay payment pages (<company>.ivpay.eu) the company operating the vending machines is the data controller; IVP Solution Zrt. acts as its data processor. That company's own privacy notice is available on its payment page.

2. The www.ivpay.eu landing page

The landing page is a static information page. It uses no cookies and contains no visitor analytics or marketing trackers. The selected language is remembered in the browser's own storage and is not sent to the server.

For operation and security the server keeps a technical log: IP address, time of the request, requested address, browser and device data. Its purpose is running the service, troubleshooting and preventing abuse (e.g. intrusion attempts); the legal basis is legitimate interest under Art. 6(1)(f) GDPR. Retention: up to 1 year.

3. Users of the pay.ivpay.eu management interface

The management interface is used by the staff of the companies operating the machines. Their account is created by the company's manager or by IVP Solution Zrt.

Data processed

Username, e-mail address, language, password (only as an irreversible hash), role and permissions.

Sign-in log

Successful and failed sign-ins, sign-out, password and settings changes: time, IP address, browser. Retention: 1 year.

E-mail sign-in code

Hash of the one-time code and the requesting IP address. Retention: 30 days.

Trusted device

On request, the user's browser is remembered with a random identifier stored in a cookie (IP address, browser, expiry). The user can revoke it in their profile at any time.

Fingerprint sign-in (passkey)

Only the public half of the key and a random identifier are stored. No biometric data reaches the server; it never leaves the device.

Purpose and legal basis

Providing the service and securing the account — Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest: protecting access).

Cookies

Only strictly necessary cookies: the session cookie and the language; these require no consent.

4. The IVPay payment pages (<company>.ivpay.eu)

The buyer's card data never reaches the servers of IVP Solution Zrt.: payment takes place on the secure payment page of the card acquirer (myPOS), where myPOS acts as an independent controller under its own privacy notice.

Transaction

Transaction ID, amount, currency, time, machine identifier, payment status and the payment provider's transaction reference. Retention: the statutory period for accounting records (8 years), under the operating company's control.

Loyalty programme

If the buyer provides it voluntarily: e-mail address, chosen name, time of consent, number of credited purchases. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time via the unsubscribe link in the e-mails.

Closed (internal) use

E-mail address, name, IP address of the registration, the approval, hashes of the one-time sign-in codes, and the purchase log (time, machine, amount). Legal basis: the agreement between the operating company and the member (Art. 6(1)(b) GDPR).

Cookies

A session cookie for the duration of the payment or sign-in, and a language cookie. No analytics or marketing cookies.

5. Processors and recipients

Personal data is accessible to those employees of IVP Solution Zrt. whose duties require it. We do not sell the data and do not use it for newsletters without the data subject's separate consent.

• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — server hosting and backups; the servers are located in Falkenstein, Germany.
• Brevo (Sendinblue SAS) (7 rue de Madrid, 75008 Paris, France) — delivery of system e-mails (sign-in codes, notifications, loyalty e-mails).
• myPOS — acceptance of card payments; an independent controller on the payment page.
• The company operating the machines — controller of its own payment page and buyers.

6. Transfers to third countries

Data is stored and processed within the European Economic Area; no personal data is transferred to third countries. Should a future service require this, the notice will be updated before that service is enabled.

7. Data security

All connections are encrypted (HTTPS, and TLS towards the machines). Passwords are stored only as hashes; sign-in is strengthened by an e-mail code or a passkey. Data is backed up regularly in encrypted form. Every payment and dispensing event is logged in detail so that the facts can be established in case of a dispute.

8. Rights of the data subject

You may request access to your personal data, its rectification, erasure or the restriction of processing; object to processing based on legitimate interest; withdraw consent at any time where processing is based on consent; and, where the statutory conditions are met, exercise your right to data portability. Requests can be sent to office@ivpzrt.eu; as a rule we reply within one month. For data processed on the payment pages, requests may also be submitted to the operating company.

9. Complaints and remedies

In case of a complaint, please contact us first at office@ivpzrt.eu. You may also lodge a complaint with the supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu. You may also bring the matter before a court.

10. Changes to this notice

We update this notice when our processing practices, the service's features, the providers we use or the legal environment change. The current version is always available on this page.