Privacy policy

Loopu AB is the data controller for the processing of personal data in the VendMap service. This means that we determine the purposes and means of processing and are responsible for ensuring that it complies with the General Data Protection Regulation (GDPR).

• Account details: name, email address and login details when you create a business account.
• Business and machine details: business names, addresses, images, product selections, opening hours and machine requests that you post yourself.
• Support messages: the content of messages you send us.
• Technical data: IP address, device and browser information, and usage data/telemetry.
• Location data: if you allow location access, your location is used only in your browser to show machines near you; we do not store it.

Payment details (e.g. card numbers) are collected and processed by our reseller Paddle, not by us.

• Providing the service – creating an account, displaying your listings, managing your subscription (performance of a contract).
• Security and fraud prevention – protecting accounts and the service (legitimate interest).
• Product improvement – analysing usage to improve the service (legitimate interest).
• Customer support – answering questions and handling requests (legitimate interest/contract).
• Marketing – where applicable, with your consent, which you may withdraw at any time.
• Legal obligations – e.g. bookkeeping (legal obligation).

• Service providers/sub-processors: hosting, database, authentication, analytics and support tools.
• Merchant of Record (Paddle): for sales, subscription management, payments, tax compliance and invoicing.
• Professional advisers: e.g. lawyers and auditors as needed.
• Public authorities: when required by law.

We retain personal data only for as long as needed for the purposes above or as required by law. When the data is no longer needed, it is deleted or anonymised. If you delete your account, your data is deleted or anonymised, except for data we must retain by law (e.g. for accounting purposes).

Some of our providers may process data outside the EU/EEA. In such cases, we ensure that the transfer is covered by appropriate safeguards, such as the European Commission's standard contractual clauses or an adequacy decision.

Under the GDPR, you have the right to:

• access your personal data,
• have inaccurate data rectified,
• have your data erased,
• request restriction of processing,
• receive your data in a machine-readable format (data portability),
• object to processing based on legitimate interests,
• withdraw consent at any time,
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

We will respond to your request within one month.

We take appropriate technical and organisational measures to protect your data, including encryption and access controls.

We use necessary cookies and similar technologies to make the service work (e.g. for login sessions). If we use analytics or marketing cookies in the future, we will inform you, and you can manage your choices through your browser settings.

Do you have questions about how we process personal data, or would you like to exercise your rights? Contact Loopu AB using the contact details on the website.