Skip to content

Legal

Cookie & Privacy Policy

This privacy policy sets out how Refreshment Systems Ltd collects, uses, discloses, transfers, stores, protects, and deletes any personal data you provide when using this website or engaging with our services.

Last updated

Refreshment Systems Limited ("we", "us", "our") is the Data Controller responsible for the personal information described in this Privacy Policy. Refreshment Systems Ltd also operates trading brands including Balmforth & Co. and VendSmart.

We may collect the following information

  • We may collect and process the following categories of personal information:
  • Identity Data: Name, job title, and company details.
  • Contact Data: Business email address, telephone numbers (including direct dials for service or ingredient ordering), and delivery or site addresses.
  • Demographic & Preference Data: Postcode, business sector, communication preferences, and commercial interests.
  • Technical & Usage Data: IP addresses, browser types, device identifiers, referral URLs, page interaction metrics, and campaign attribution data.
  • Inquiry & Service Data: Information submitted via quote requests, demo bookings, customer service calls, telemetry reports, or direct messaging.

How we obtain your information

  • 1. Information obtained directly from you:
  • When you fill in an online form (Get a Quote, Book a Demo, or contact forms);
  • When you contact our team by telephone (General Enquiries: 0800 169 3686 | Service: 01274 750 008 | Order Ingredients: 01226 720 482), email, post, or messaging platforms;
  • When you enter into a commercial supply, equipment rental, or maintenance contract with us.

2. Information obtained indirectly (Third-party sources):

Where permitted by law, our commercial sales team may obtain business contact details from reputable B2B sources, including:

  • Professional social networks (e.g., LinkedIn);
  • Publicly accessible corporate websites and directory listings;
  • Commercial business databases and corporate event attendee registries.

Our technology stack & third-party tools

  • We utilize specific technology providers to manage, analyze, and optimize our digital platforms:
  • Google Tag Manager (GTM): Loads our analytics and advertising tags. It is not loaded at all until you click Accept on our cookie banner, and it passes your choice to Google's tags through Google Consent Mode v2.
  • Google Analytics: Tracks website traffic, visitor interactions, and site navigation patterns.
  • Google Ads: Measures commercial conversion events and displays targeted advertisements across Google networks.
  • LinkedIn Insight Tag: Tracks B2B conversion events, generates demographic reports (job seniority, industry, company size), and enables retargeting campaigns on LinkedIn.
  • Microsoft Advertising (UET tag): Measures conversions from our adverts on Bing and the Microsoft Advertising network, and enables retargeting.
  • Meta Pixel: Measures conversions from our adverts on Facebook and Instagram, and enables retargeting.
  • Pinterest Tag: Measures conversions from our adverts on Pinterest, and enables retargeting.
  • Zoho Analytics & Zoho CRM: Measures user engagement, manages B2B lead attribution, and maintains customer account interactions.
  • Mailchimp: Manages subscriber databases and delivers promotional B2B email updates.
  • Vercel: Hosts this website and protects our enquiry forms from automated abuse.

Under UK GDPR and the Data Protection Act 2018, we process your personal data relying on the following lawful bases:

  • Contractual Performance (Art. 6(1)(b)): To fulfill machinery supply, ingredient fulfillment, telemetry support, and field engineering service agreements.
  • Legitimate Interests (Art. 6(1)(f)): To manage customer accounts, conduct B2B communications, analyze site performance, secure our digital infrastructure, and promote relevant workplace refreshment solutions to corporate buyers.
  • Consent (Art. 6(1)(a)): Required before deploying non-essential cookies/tracking pixels (Google Analytics, Google Ads, Microsoft Advertising, LinkedIn, Meta and Pinterest) or sending marketing to non-corporate subscribers.
  • Legal Obligation (Art. 6(1)(c)): To maintain corporate accounting, tax compliance, and statutory reporting records.

How we use the information

  • We process your personal information for specific business purposes:
  • Fulfilling machine installations, ingredient shipments, and engineering service requests;
  • Maintaining telemetry connectivity and machine performance monitoring;
  • Responding to quote requests, demo bookings, and general account inquiries;
  • Customizing website navigation and evaluating digital marketing effectiveness;
  • Sending B2B commercial communications regarding vending machinery, coffee solutions, and ingredient offers (where permitted or consented to).

Marketing profiling & automated tracking

We use tracking tools such as Google Ads, Microsoft Advertising, the LinkedIn Insight Tag, the Meta Pixel and the Pinterest Tag to deliver relevant B2B advertising and measure campaign performance.

  • What this involves: These tools analyze interaction data (e.g., pages visited, job roles inferred from LinkedIn profiles) to show customized adverts or retarget visitors on third-party platforms.
  • Your control: This tracking does not produce legally binding or automated decisions that significantly affect you. You can disable all marketing tracking at any time from Cookie settings in our website footer, or through your browser settings.

Who we share personal information with

We do not sell or lease personal data. Depending on the service, we share data with third parties who act as data processors, joint controllers, or independent controllers:

  • Independent / Joint Controllers:
    • LinkedIn Ireland Unlimited Company: Acts as an independent controller for B2B advertising and campaign retargeting via the LinkedIn Insight Tag.
    • Google Ireland Limited: Acts as an independent controller for advertising conversion reporting and Google Ads delivery.
    • Microsoft Ireland Operations Limited: Acts as an independent controller for advertising conversion reporting and ad delivery via Microsoft Advertising.
    • Meta Platforms Ireland Limited: Acts as a joint controller with us for the collection of data through the Meta Pixel, and as an independent controller for its own subsequent use of that data for advertising.
    • Pinterest Europe Limited: Acts as an independent controller for advertising conversion reporting and ad delivery on Pinterest.
  • Data Processors (bound by data processing agreements):
    • Zoho Corporation: CRM and customer account analytics host.
    • Mailchimp (Intuit Inc.): Email newsletter management platform.
    • Vercel Inc.: Website hosting, content delivery and form security.
    • Logistics & Telemetry Partners: Couriers and telemetry hardware/software service hosts supporting equipment uptime and deliveries.

International data transfers

Some of our technology providers process personal data outside the United Kingdom, primarily in the European Economic Area (EEA) or the United States.

Whenever personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR:

  • Adequacy Regulations: Data transferred to the EEA or countries recognized by the UK Government as providing an adequate level of data protection.
  • Standard Contractual Clauses (SCCs) & UK Addendum: Used for transfers to US-based providers (e.g., Intuit/Mailchimp, Google, LinkedIn, Microsoft, Meta, Pinterest, Vercel, Zoho), supplemented by technical security measures such as encryption.
  • UK Extension to the EU-US Data Privacy Framework: Relied upon where service providers are certified under the recognized framework.

Your data protection rights

Under UK data protection legislation, you have the following rights:

  • Right of Access: Request copies of your personal data free of charge (Subject Access Request).
  • Right to Rectification: Request correction of inaccurate or incomplete personal records.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where no legal exception applies.
  • Right to Restriction: Request that we temporarily suspend or limit processing of your personal data.
  • Right to Data Portability: Request transfer of your data to another organization in a structured, machine-readable format.
  • Right to Withdraw Consent: Revoke previously granted consent for cookies or marketing at any time.

YOUR RIGHT TO OBJECT

You have an absolute right to object at any time to the processing of your personal data for direct marketing purposes, including marketing profiling.

You also have the right to object to processing based on Legitimate Interests. If you object, we will cease processing your personal data unless we demonstrate compelling legitimate grounds that override your legal interests.

To exercise this right, click "Unsubscribe" in any email, adjust your cookie preferences in the site footer, or email info@refreshmentsystems.co.uk (opens in a new tab).

How to make a data protection complaint

1. Internal Complaint Process (In effect from 2026):

If you have concerns about how Refreshment Systems Ltd handles your personal information, please contact our Data Protection Team first:

Our commitment:

  • We will formally acknowledge your complaint within 30 days of receipt.
  • We will investigate your concern thoroughly and without undue delay.
  • We will keep you updated on progress and provide a clear written outcome.

2. Regulatory Escalation (ICO):

If you remain dissatisfied with our response, you have the statutory right to lodge a complaint with the Information Commissioner's Office (ICO):

Security & data retention

We implement appropriate physical, technical, and organizational measures to prevent unauthorized access, loss, or disclosure of personal data.

Data Retention Schedule:

  • Tax & Accounting Records: Retained for 6 years following the end of the relevant accounting period to comply with HMRC statutory requirements.
  • Active Customer & Machine Contracts: Retained for the duration of the commercial agreement plus 6 years following contract termination (in accordance with standard breach of contract limitation periods).
  • General Sales Inquiries & Demo Requests: Retained for 2 years from last interaction unless erasure is requested earlier.
  • Marketing Subscribers: Retained until you unsubscribe or withdraw consent.

Cookies are small files saved on your computer or mobile device to support website performance, save user settings, and provide commercial analytics.

Essential and functional items are used as soon as you visit. Everything listed as Analytics or Marketing is set only after you click Accept on our cookie banner. Where a cookie is set on another company's domain, that company's own cookie policy also applies. Expiry periods are the providers' published defaults.

  • rsl_consent
    • Provider: Refreshment Systems
    • Purpose: Remembers whether you accepted or rejected cookies, so the banner is not shown on every page
    • Category: Essential
    • Expiration: 6 months
  • Form attribution (browser session storage, not a cookie)
    • Provider: Refreshment Systems
    • Purpose: Remembers the page you arrived on, the site that referred you and any campaign tags in the link, so that an enquiry you send us records how you found us. It is only sent to us if you submit a form
    • Category: Functional
    • Expiration: Deleted when you close the browser tab
  • Zoho Forms cookies (set inside embedded forms)
    • Provider: Zoho Corporation
    • Purpose: Keep an embedded Zoho form secure and working while you fill it in
    • Category: Essential
    • Expiration: Session
  • _ga
    • Provider: Google Analytics
    • Purpose: Distinguishes unique website visitors
    • Category: Analytics
    • Expiration: 2 years
  • _ga_T38C96HVHW
    • Provider: Google Analytics
    • Purpose: Maintains session state and records your interactions with the site
    • Category: Analytics
    • Expiration: 2 years
  • _gcl_au, _gcl_aw
    • Provider: Google Ads
    • Purpose: Measure conversions from our adverts and remember which advert you clicked
    • Category: Marketing
    • Expiration: 90 days
  • IDE, test_cookie (set on doubleclick.net)
    • Provider: Google
    • Purpose: Ad delivery, retargeting and measurement across Google's advertising network
    • Category: Marketing
    • Expiration: 15 minutes to 13 months
  • _uetsid, _uetvid
    • Provider: Microsoft Advertising
    • Purpose: Measure conversions from our adverts on Bing and the Microsoft Advertising network, and enable retargeting
    • Category: Marketing
    • Expiration: 1 day to 13 months
  • MUID (set on bing.com)
    • Provider: Microsoft
    • Purpose: Identifies your browser across Microsoft sites for advertising
    • Category: Marketing
    • Expiration: 13 months
  • li_fat_id, li_sugr
    • Provider: LinkedIn
    • Purpose: Match visits to LinkedIn members for B2B conversion reporting and retargeting
    • Category: Marketing
    • Expiration: 30 to 90 days
  • bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory (set on linkedin.com)
    • Provider: LinkedIn
    • Purpose: Browser identification and ad matching for LinkedIn ad performance
    • Category: Marketing
    • Expiration: 1 day to 1 year
  • _fbp, _fbc
    • Provider: Meta (Facebook)
    • Purpose: Measure conversions from our adverts on Facebook and Instagram, and enable retargeting
    • Category: Marketing
    • Expiration: 90 days
  • fr (set on facebook.com)
    • Provider: Meta (Facebook)
    • Purpose: Ad delivery and measurement on Meta's platforms
    • Category: Marketing
    • Expiration: 90 days
  • _pin_unauth, _pinterest_ct_ua
    • Provider: Pinterest
    • Purpose: Measure conversions from our adverts on Pinterest, and enable retargeting
    • Category: Marketing
    • Expiration: 1 year
  • _pinterest_sess (set on pinterest.com)
    • Provider: Pinterest
    • Purpose: Identifies your browser to Pinterest for advertising
    • Category: Marketing
    • Expiration: 1 year

Embedded YouTube videos use YouTube's privacy-enhanced mode, which stores nothing until you press play, and Vimeo videos are loaded with Do Not Track switched on.

  • All non-essential cookies (Analytics and Marketing) are blocked by default: Google Tag Manager, which loads every analytics and advertising tag on this site, is not loaded at all until you click Accept on our cookie banner.
  • To Give Consent: Click "Accept" on our cookie banner. If you click "Reject", that choice is remembered in the same way and nothing non-essential is set.
  • To Withdraw Consent: Click the "Cookie settings" link in the footer of any web page at any time to change your choice. If you withdraw consent, we delete the analytics and advertising cookies set on our own domain; cookies other companies have set on their own domains can be cleared in your browser settings.
  • How long we remember your choice: 6 months, after which we ask again.

Our website may contain links to external third-party websites. Once you leave our domain, we have no operational control over external security. Please review the privacy policy of any third-party website you visit.

How to contact us & ICO details

Data Controller:

Refreshment Systems Limited

Registered Office: 31 Bolling Road, Bradford, West Yorkshire, BD4 7HN

Company Registration Number: 01826322 (Registered in England & Wales)

Telephone Contact Numbers:

Questions about this document?

Write to Refreshment Systems Limited at Refreshment Systems Ltd, Bolling Road, Bradford BD4 7HN, or call 0800 169 3686.

Contact us