We were similar. (had vendors and fridges for staff packed lunch)
We did not claim to be nut free but the statement on the Tesco product was "made in a factory which does not handle nuts)
So, we had to brief staff on what could and could not be in their lunch. i.e. no nuts. Explain that this covers the obvious e.g. nuts and the less obvious, sate sauce, chocolate with nuts in, breakfast bars etc. Lots of staff brought boxes of chocolates in to share when celebration their birthdays etc. not realizing some of them contained nuts. (document the attendance of the briefing)
We then had to monitor their packed lunch. Check some each week with the staff in attendance. (Just ask what they have in their packed lunch and have a look at it)
We had to set a routine for cleaning the fridges used for staff packed lunch, monitoring the temps and & discard out of date, opened unwrapped food.
We had a signed conformance declaration with the service provider for the vending machines that they would not put nut containing foods in the machines.
Cleaning schedules , for floor, microwaves, tables, fridges, lidded bins for waste (signed for & verified by second person).
Basic Food Hygiene training for the service provider staff who fill the vendor.
Temp checks (audited and recorded) by internal staff of the vendors if containing food ( not cans of pop)
record the checks (weekly perhaps) for out of date products being sold in the vendor. record and issues a supplier complaints.
When the service provider comes to remove the stock which is coming out of date ask to probe the food to see if its is achieving the required temp in the core of the food.
Check cleanliness of the of vendors. Ensure this is all included in your HACCP and depending on the findings you set the frequency which will be changed to suit the needs as time goes on. Its about managing the packed lunches, vendors and the facility.
Hope this helps.
Sharon, Dewsbury (West Yorkshire, UK)