Privacy Policy
Last updated: 7 September 2026
1. Data Controller
Easy Vending GmbH
Weisslhofweg 12, 5400 Hallein, Austria
Phone: +43 5 77 09
Email: office@easyid.at
Easy Vending GmbH is the sole data controller within the meaning of Art. 4(7) GDPR for the operation of the easyID service.
2. Purposes and Data Processing
easyID processes data for the purpose of legally required age verification at vending machines, pursuant to § 2a TNRSG and provincial youth protection laws. Age verification is required by law. Without successful verification, the vending machine cannot dispense age-restricted products. Verification is carried out using one of the following methods.
2.1 Age Verification with ID Austria
ID Austria transmits exclusively Boolean age confirmations (over 14/16/18/21 years). No date of birth is requested.
| Data | Used | Stored |
|---|---|---|
| Age attributes (over 14/16/18/21) | Yes, adopted directly | Verification result in billing (7 yrs) |
| Date of birth | Not requested | No |
| Name, bPK | No | No |
2.2 Age Verification with EU-Login (eIDAS)
Nationals of other EU/EEA member states may identify themselves via EU-Login. If Boolean age confirmations are included in the token, they are adopted directly. Otherwise, the date of birth is used for age calculation in working memory and discarded immediately thereafter. Name and personal identifier are not processed.
| Data | Used | Stored |
|---|---|---|
| Age attributes (over 14/16/18/21, if available) | Yes, preferentially adopted directly | Verification result in billing (7 yrs) |
| Date of birth (MDS) | Only as fallback: calculated in RAM, immediately discarded | No |
| Name, identifier (MDS) | No | No |
Parties involved: The eIDAS node of your home country (authentication) and the Austrian eIDAS node of the BMI (forwarding). Data processing within the eIDAS infrastructure is subject to the respective national and European data protection legislation.
2.3 Age Verification by Document Check
Alternatively, you can verify your age by capturing a valid identity document (national ID card, passport, or driving licence) via camera and transmitting it to the server for verification. This method is available in the browser, both via the easyID app and directly after scanning the QR code at the vending machine. The transmitted image is processed exclusively in working memory and is never stored on any permanent medium.
| Data | Processed | Stored |
|---|---|---|
| Image of identity document | Yes, in RAM for 2 to 5 sec. | No, discarded immediately |
| Date of birth (from MRZ) | Yes, age calculation in RAM | No, discarded immediately |
| Name, document number | No | No |
| Document type and issuing state | Yes, for format identification | No, discarded immediately |
| Age verification (result) | Yes | Verification result in billing (7 yrs) |
2.4 easyID Mobile App
The easyID app allows you to set up an age proof once and then use it repeatedly by scanning a QR code at the vending machine. Biometric confirmation (Face ID, fingerprint, or device PIN) is required before each verification. Biometric data is processed exclusively on the device and is not transmitted to the easyID server. Easy Vending GmbH has no access to this data.
| Data | Storage Location | Purpose |
|---|---|---|
| App token (identifier without personal reference) | Secure device storage (iOS Keychain / Android Keystore) | Reusable age proof |
| Language setting | Local storage | User preference |
The app stores neither name, date of birth, document number, nor any other personal data. All stored data can be deleted at any time via the app settings; this revokes the tokens both locally and on the server. Setting up the app token is voluntary and is based on your consent (Art. 6(1)(a) GDPR), which you give by actively setting up the feature. You may withdraw this consent at any time with effect for the future by deleting the stored data via the app settings. Withdrawal results in the immediate deletion of the token on your device and in its revocation on our servers. The lawfulness of processing carried out prior to withdrawal remains unaffected.
Note for minors: The easyID app is also aimed at persons who have not yet reached the age limits relevant to the purchase of age-restricted goods. For consent to the setup of the app token to be validly given, an age limit of 14 years applies pursuant to Section 4(4) of the Austrian Data Protection Act (DSG). Persons under 14 years of age require the consent of their legal guardian to set up the app token. The one-off age verification at an individual vending machine (2.1 to 2.3) is not affected by this age limit, as it takes place without storing personal data and is not based on consent but on a separate legal basis (Section 3).
2.5 Website Visits and Contact
The underlying server infrastructure (virtual machines, storage, network connectivity) is provided by neteco IT GmbH & Co. KG (Oberfeldstraße 7, 5082 Grödig, Austria) in a data centre located in Austria. neteco has no login credentials to the easyID system and does not access the personal data processed in the application. As a precautionary measure, a data processing agreement under Art. 28 GDPR has nevertheless been concluded, since a residual technical access exists at the virtualisation and storage layer. No personal data is stored in log files when visiting the website. If you contact us by email or via the support form, your information will be processed for the purpose of handling your inquiry (Art. 6(1)(b) GDPR).
3. Legal Basis
| Processing | Legal Basis |
|---|---|
| Age verification (all methods) | Art. 6(1)(f) GDPR (legitimate interest of Easy Vending in providing a legally compliant age control mechanism for machine operators) |
| easyID app token (setup and repeated use) | Art. 6(1)(a) GDPR (consent, revocable at any time, see 2.4) |
| ID Austria attribute transmission | § 4(2) E-GovG (consent of the user to the ID Austria system) |
| EU-Login / eIDAS | Regulation (EU) No. 910/2014 |
| Contact | Art. 6(1)(b) GDPR |
| IT security (session protection, rate limiting) | Art. 6(1)(f) GDPR (legitimate interest in preventing misuse of the service) |
4. Origin of the Data and Recipients
Origin of the age confirmations
With the verification methods ID Austria (2.1) and EU-Login/eIDAS (2.2), we receive the age confirmations directly from the system with which you yourself authenticate in the course of the verification:
| Source | Data Transmitted | Controllership |
|---|---|---|
| ID Austria (BMI) | Boolean age attributes, signed | Separate controller pursuant to § 4 E-GovG |
| eIDAS node (home country or the Austrian node of the BMI) | Boolean age attributes or eIDAS Minimum Data Set | Separate controllers pursuant to Regulation (EU) No. 910/2014 |
For the processing carried out in the context of your authentication with them, these bodies are each separate controllers; Easy Vending GmbH has no influence over that processing and receives only the result of the authentication.
Recipients of our data
The following bodies receive data from us in connection with age verification:
| Recipient | Which Data | Role |
|---|---|---|
| Machine operator | Verification result (over 14/16/18/21: yes/no), no name, no date of birth | Separate controller |
| neteco IT GmbH & Co. KG (provision of virtualised server infrastructure, Grödig, Austria) | No operational access to personal data; residual technical access at the hypervisor / storage layer possible | Processor pursuant to Art. 28 GDPR |
neteco has no login credentials to the easyID system and does not access personal data in operational use. As a precautionary measure, a data processing agreement under Art. 28 GDPR has been concluded, since a residual technical access exists at the virtualisation and storage layer. No further external processors are currently engaged.
5. Transfer to Third Countries
There is no transfer of personal data to third countries. All processing takes place on servers in Austria.
6. Retention Periods
| Data Type | Storage Location | Duration |
|---|---|---|
| Verification session | Working memory (RAM) | Max. 5 min., deleted after single retrieval |
| Image of identity document (document check) | Working memory (RAM) | 2 to 5 seconds, discarded immediately |
| Billing data (verification results without personal reference) | Database | 7 years (§ 132 BAO) |
| App token | Device + server (encrypted) | Default 365 days, deletable by user at any time |
| System logs | Working memory (ring buffer) | Volatile, no persistent storage |
| Support requests: images (e.g. ID document photo) | Disk | 30 days |
| Support requests: contact details and description (name, email, problem text) | Database | Up to 30 days after the request is resolved, no later than 90 days after receipt; thereafter anonymisation |
| Support requests: anonymised statistics (category, status, processing outcome) | Database | Up to 2 years, thereafter complete deletion |
Billing data consists of the verification result (over 14/16/18/21: yes/no), a timestamp, and a machine identifier. Re-identification of individual users is not possible for Easy Vending GmbH with the means at its disposal.
7. Cookies
easyID uses exclusively technically necessary cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Assignment of the verification session | End of session (max. 5 min.) |
No tracking, analytics, or advertising cookies are used (§ 165(3) TKG 2021).
8. Automated Decision-Making
The verification result is determined automatically and, if negative, may lead to the purchase being refused. This constitutes an automated decision within the meaning of Art. 22(1) GDPR, which is permitted under Art. 22(2)(b) GDPR because it serves a legal obligation (§ 2a TNRSG, provincial youth protection laws). You are entitled to the safeguards under Art. 22(3) GDPR: in the event of an incorrect rejection, you may repeat the check, switch the method, contact support (via the support form at id.easyid.at/support or by email to office@easyid.at), or purchase from staffed retail instead.
9. Your Rights
Since no personal data is stored during age verification and Easy Vending GmbH cannot identify the data subject, the rights under Art. 15 to 20 GDPR do not apply to verification data pursuant to Art. 11(2) GDPR.
Should you provide additional information enabling your identification (e.g. by email or via the support form), you are entitled to the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21).
Contact: office@easyid.at
10. Right to Lodge a Complaint
You have the right to lodge a complaint with the competent data protection supervisory authority:
Austrian Data Protection Authority (DSB)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at