Last updated: 2026-05-08
1. Who to contact
Platform operator: Oktcom LTD
Contact: contact@combivend.com
Business address: 67 crescent drive north, Brighton, United Kingdom, BN2 6SL
Company number: 14560946
2. Personal data we process
- Customer email addresses collected during Stripe Checkout so access codes and order notices can be sent.
- Order details, product names, quantities, payment status, checkout references, and reserved or assigned stock-code records.
- Client/admin account information, including invited email addresses, Google sign-in identity, role, session records, and login audit information.
- Technical and security information such as IP address, browser user agent, CSRF/session data, webhook references, and error logs.
3. Why we use it
- To process orders, reserve stock, send access codes, and provide customer support information.
- To provide secure admin and client portals, prevent unauthorised access, and investigate checkout or delivery issues.
- To maintain payment, accounting, audit, legal, and platform administration records.
4. Legal basis
We process order and account data where needed to provide the service, fulfil contracts, comply with legal duties, and protect legitimate interests such as platform security, fraud prevention, and support.
5. Who data is shared with
- Stripe, for payment processing, connected-account onboarding, fraud checks, and payment status updates.
- Postmark or another configured email provider, for transactional email delivery.
- The seller/client responsible for the storefront, so they can handle product support, fulfilment, refunds, and customer queries.
- Hosting, database, logging, and professional service providers where needed to operate and protect the platform.
- Authorities or advisers where required by law or to defend legal rights.
6. Payment details
Stripe handles payment card details. Combivend stores payment references and status information, but not full card numbers.
7. How long data is kept
Order, payment, and accounting records are normally kept for as long as needed for support, accounting, tax, legal, and audit purposes. Login/security records are kept only as long as needed to protect the platform and investigate issues.
8. Cookie Notice
Combivend uses only essential cookies and similar technologies needed to provide and protect the service.
- Session cookies keep invited admin and client users signed in securely.
- CSRF security cookies help protect forms from unauthorised submissions.
- Server-side checkout abuse-prevention records help limit repeated checkout attempts that could reserve stock unfairly.
- Stripe may use cookies or similar technologies when customers continue to Stripe Checkout.
- Google may use cookies or similar technologies when admin or client users choose Google sign-in.
We do not currently set advertising, marketing, or non-essential analytics cookies. If we add those later, we will ask for consent before they are used.
9. Your rights
You may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data. You can contact us using the details above. You can also complain to the ICO at ico.org.uk/make-a-complaint.
10. Updates
We will update this notice when the platform, providers, or data use changes.