This privacy policy explains which personal data is processed when you use VMflow (web application and iOS app), for what purposes, and which rights you have.
1. Controller
Kerl Handel GmbH
Ziegelweg 1, 74676 Niedernhall, Germany
E-mail: [email protected]
2. What VMflow is
VMflow is a vending machine management system for commercial operators. It primarily processes your company's operational data: machines, sales, stock levels, devices and the cash book. Personal data arises mainly in connection with your user account.
3. Account and sign-in
Using VMflow requires a user account. We process your e-mail address and a password (stored as a cryptographic hash, never in plain text). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
Accounts are usually created via an invitation from your company's administrator, or via self-registration.
4. Your company's operational data
Sales data, stock levels, machine telemetry and cash-book entries belong to your company, not to individuals. Where entries carry a user attribution (e.g. who created a booking), this serves traceability within your team. Legal bases are Art. 6(1)(b) and — for accounting data — Art. 6(1)(c) GDPR.
5. Push notifications (Apple)
If you enable push notifications (e.g. low-stock alerts), we store your iPhone's device token. Delivery is handled by the Apple Push Notification service of Apple Inc., One Apple Park Way, Cupertino, USA. This involves a transfer of data to the USA; Apple is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the iOS settings.
6. Camera
The iOS app uses the camera exclusively on-device to scan barcodes and QR codes. No photos or videos are captured, stored or uploaded.
7. Cookies and local storage
VMflow uses only technically necessary cookies and local storage (§ 25(2) of the German TDDDG); no consent banner is therefore required. Specifically: an authentication cookie for your session, a cookie storing your language preference, and a browser local-storage entry for the colour scheme (light/dark). There is no tracking, no analytics cookies and no advertising cookies.
8. Hosting and processing on our behalf
VMflow is self-operated. The instance hosted by us runs on servers of Contabo GmbH (server location: Germany). Where required, a data-processing agreement under Art. 28 GDPR is in place with the hosting provider. Operators who install VMflow on their own infrastructure are responsible for that processing themselves.
9. Server logs
When you access this website and its interfaces, access data is processed for technical reasons (IP address, time, requested resource). These logs serve operational security and troubleshooting (Art. 6(1)(f) GDPR) and are deleted after a short period.
10. Retention and account deletion
You can delete your account at any time directly in the iOS app (Settings → Delete Account). If you are your company's last administrator, the company data is deleted as well after explicit confirmation.
Statutory retention duties (in particular for accounting records under German commercial and tax law) may prevent the immediate erasure of individual data (Art. 17(3)(b) GDPR); such data is deleted once the retention periods expire.
11. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority.
12. No tracking
VMflow uses no analytics, tracking or advertising services — neither on this website nor in the app.