Privacy Policy
Last updated: 12 October 2026
1. Who we are
easyKiosk is a commerce operating system for businesses. It may include point of sale, EPOS, self service kiosks, SoftPOS, card terminal connectivity, online ordering, QR ordering, stock management, reporting, loyalty, CRM, hotel PMS, integrations, AI tools, marketing tools, delivery connections and related services.
The service is operated by Multi Channel Creative Ltd trading as easyKiosk. In this Privacy Policy, “easyKiosk”, “we”, “us” and “our” means Multi Channel Creative Ltd and any relevant trading names used in connection with easyKiosk.
- Company: Multi Channel Creative Ltd
- Trading name: easyKiosk
- Address: 25 Station Road, Office 5, Kings Heath, Birmingham, B14 7SR, United Kingdom
- Email: [email protected]
- ICO registration reference: ZB394739
2. Purpose of this Privacy Policy
This Privacy Policy explains how we collect, use, store, share and protect personal data when people use our websites, applications, merchant portals, payment related services, integrations, support services and related products.
It covers the easyKiosk POS app, including the Android app available on Google Play, the easyKiosk web app and dashboard at easykiosk.biz, and the easyKiosk platform behind them.
It applies to:
- Merchants and business customers who sign up to easyKiosk.
- Staff, users, administrators and authorised users of merchant accounts.
- Customers of merchants where easyKiosk processes customer information on behalf of the merchant.
- Website visitors and people who contact us.
- Suppliers, partners, integration providers and prospective customers.
- Applicants who apply to work with us or become partners, where relevant.
3. Controller and processor roles
Depending on the activity, we may act either as a data controller or as a data processor.
3.1 Where we act as controller
We usually act as controller when we decide why and how personal data is used. This includes data used for merchant signup, account administration, billing, customer support, sales, marketing, fraud prevention, website analytics, security, legal compliance and service improvement.
3.2 Where we act as processor
We usually act as processor when we process personal data on behalf of a merchant using the easyKiosk platform. This may include customer names, contact details, order history, loyalty data, delivery details, booking details, table orders, hotel guest related data, CRM records and similar data entered into the system by the merchant or generated through the merchant’s use of the platform.
Where we act as processor, the merchant is responsible for telling its customers and staff how their data is processed and for having a lawful basis for the processing. Our processing will be governed by our agreement with the merchant and any applicable data processing terms.
4. Personal data we collect
The personal data we collect depends on how the service is used. It may include the following categories.
| Category | Examples |
|---|---|
| Identity data | Name, business name, job title, username, account owner details and authorised user details. |
| Contact data | Email address, telephone number, postal address, billing address and support contact details. |
| Business data | Company number, VAT number, trading address, store locations, sector, opening hours, staff roles, merchant settings and business profile information. |
| Account data | Login details, permissions, account preferences, subscription plan, product usage and security settings. |
| Payment and billing data | Invoices, billing history, transaction references, subscription status, chargeback or dispute data. We do not normally store full card numbers where payments are handled by payment providers. |
| Transaction and order data | Orders, refunds, products, services, baskets, table orders, bookings, loyalty activity, receipts, delivery details and fulfilment information. |
| Customer and CRM data | Customer names, contact details, preferences, loyalty points, marketing preferences, order history and notes added by merchants. |
| Device and technical data | IP address, device type, operating system, browser type, app version, device identifiers, logs, crash reports and security events. |
| Location data | Store location, delivery location, parcel shop or locker location, approximate location derived from IP address and any precise location only where enabled and necessary. |
| Communications data | Emails, support tickets, calls, chat messages, meeting notes, feedback, surveys and correspondence. |
| Marketing data | Marketing preferences, campaign engagement, website forms, event attendance and responses to communications. |
| AI and content data | Prompts, generated outputs, campaign drafts, product descriptions, summaries, analytics requests and other content processed through AI features. |
4.1 Device permissions used by our apps
The easyKiosk POS app asks for the following device permissions. Each is used only for the purpose shown, and the app works without the ones you decline, apart from the related feature.
- Camera: to scan product barcodes. Images are not stored or sent to us.
- Bluetooth and nearby devices: to find and connect receipt printers, barcode scanners and card readers.
- Location: Android requires this permission to search for Bluetooth devices, and some card readers require it to take payments. The app does not use it to track your location, and does not send your location to us.
- Local network: to find and connect network printers and card terminals on the same Wi-Fi.
- Storage: to save and share files you choose to export, such as receipts and reports.
5. How we collect personal data
- Directly from merchants, users, customers, partners and website visitors.
- When an account is created or a merchant signs up.
- When someone uses the website, dashboard, apps, EPOS, kiosk, QR ordering, payment, delivery or integration features.
- From payment providers, app stores, integration providers, delivery providers, hardware providers and commerce platforms.
- From cookies, analytics tools, logs and similar technologies.
- From support requests, demos, sales enquiries, events and communications.
- From publicly available sources, business directories, Companies House, social media and professional networks where lawful and relevant.
6. How we use personal data and lawful bases
Under UK data protection law, we must have a lawful basis for using personal data. The table below summarises common purposes and lawful bases. The exact lawful basis may depend on the context and the relationship we have with the individual.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Account setup and administration | Creating accounts, verifying users, managing subscriptions and providing access. | Contract, legitimate interests and legal obligation where applicable. |
| Providing the platform | Operating POS, EPOS, ordering, loyalty, CRM, delivery, reporting, integrations and AI tools. | Contract and legitimate interests. Where acting as processor, the merchant’s lawful basis applies. |
| Billing and payments | Invoices, subscriptions, receipts, refunds, failed payments, disputes and payment provider connections. | Contract, legitimate interests and legal obligation. |
| Support and service communications | Responding to enquiries, troubleshooting, training and account notices. | Contract and legitimate interests. |
| Security and fraud prevention | Monitoring abuse, protecting accounts, preventing unauthorised access and investigating suspicious activity. | Legitimate interests and legal obligation. |
| Product improvement | Analysing usage, fixing bugs, improving performance and developing new features. | Legitimate interests. Consent where required for non essential cookies or similar technologies. |
| Marketing | Sending product updates, offers, partner news and event invitations. | Consent or legitimate interests depending on the recipient and communication type. PECR rules may also apply. |
| Legal and regulatory compliance | Tax, accounting, law enforcement requests, disputes, regulatory obligations and record keeping. | Legal obligation, legitimate interests and establishment or defence of legal claims. |
| AI features | Generating content, summaries, recommendations, analytics and campaign ideas. | Contract and legitimate interests. Where merchant customer data is used, we may act as processor. |
7. Merchant customer data
Merchants may use easyKiosk to process information about their own customers. This may include order details, delivery details, loyalty records, marketing preferences, CRM notes, bookings, receipts and customer support information.
In most cases, the merchant is the controller of this data and easyKiosk is the processor. Merchants must ensure that their own privacy notices explain how they use easyKiosk and any connected providers. Merchants must not upload or process personal data through easyKiosk unless they have the right to do so.
We may process merchant customer data only to provide, secure, support and improve the service, to comply with law, to follow merchant instructions, or as otherwise permitted under our contract with the merchant.
8. Payments, SoftPOS and financial providers
easyKiosk and related products may connect with payment providers and financial technology partners, including providers of online payments, SoftPOS, Tap to Pay, card terminals, pay by link and payment processing services.
Payment providers may act as independent controllers for some processing, particularly where they carry out onboarding, know your customer checks, fraud prevention, compliance, payment processing, disputes and settlement. Their own privacy policies and terms will apply.
We do not normally store full card numbers or sensitive payment authentication data where payment processing is handled by regulated payment providers. Tokenised references, transaction IDs, status information and limited payment data may be processed to operate the service.
9. Integrations and third party services
easyKiosk may integrate with third party services such as payment providers, delivery platforms, ecommerce platforms, marketplace connectors, inventory tools, accounting tools, app stores, hardware manufacturers, analytics providers, communication providers and AI service providers.
Examples may include Stripe, Worldpay, NatWest, Elavon, Global Payments, Clover (Fiserv), Worldline, Shift4, Ingenico, Phos, Verifone, PAX, Castle, SUNMI, iMin, Epson, Star Micronics, Linnworks, Deliverect, HubRise, Google, Apple, Visa, Mastercard and other providers used from time to time.
Where a merchant enables an integration, relevant data may be shared with that provider to deliver the requested functionality. Merchants are responsible for reviewing and approving any integrations they connect to their account.
10. AI features
easyKiosk may include AI powered tools to help merchants generate content, create campaigns, analyse data, summarise information, build product descriptions, improve customer engagement and support business decisions.
Users should not submit unnecessary personal data, special category data, payment card details, passwords or confidential information into AI prompts unless the feature is specifically designed and approved for that purpose.
Where AI features use third party AI providers, data may be shared with those providers subject to contractual safeguards. We will aim to configure AI providers so that customer data is not used to train public models unless we have a lawful basis and appropriate permissions.
Where a merchant connects its own AI provider account, such as its own OpenAI API key, data sent through AI features is processed by that provider under the merchant’s own agreement with it.
11. Cookies and similar technologies
Our websites and apps may use cookies, pixels, SDKs, local storage and similar technologies. These may be used to keep the site working, remember preferences, analyse performance, improve services, prevent fraud and support marketing.
Strictly necessary technologies may be used without consent where they are required to provide the service requested. Analytics, advertising and other non essential technologies will be used only where we have the required consent or another lawful basis where permitted.
Users can manage cookie choices through our cookie banner or settings tool where available. Browser settings may also allow users to block or delete cookies, although some service features may not work properly if necessary cookies are disabled. See our Cookie Policy for more detail.
12. Direct marketing
We may send marketing communications about easyKiosk, easyPay, easyDelivery, easyMarketing, related products, partner offers, events and service updates.
Where consent is required, we will ask for it. Where permitted, we may rely on legitimate interests for business to business marketing or soft opt in rules for existing customer relationships. Recipients can unsubscribe or opt out at any time by using the link in our messages or contacting us.
13. When we share personal data
We may share personal data with:
- Payment providers, acquiring banks, SoftPOS providers, card terminal providers and financial technology partners.
- Delivery, courier, parcel, locker and fulfilment providers.
- Ecommerce, marketplace, inventory, accounting, marketing, CRM and integration providers.
- Hosting, cloud, database, security, monitoring, email, SMS, WhatsApp, analytics and support providers.
- AI service providers where AI features are used.
- Professional advisers, insurers, auditors, accountants and legal representatives.
- Regulators, tax authorities, courts, law enforcement and public authorities where required or permitted by law.
- Potential investors, buyers, sellers, group companies or advisers in connection with a business sale, investment, restructuring or corporate transaction.
- Merchants and authorised users connected to the relevant account.
The service providers we use to run the platform include Alibaba Cloud (application hosting and databases, in the United Kingdom), Cloudflare (image storage), Sentry (error and crash reporting from our apps), OpenAI and Google Gemini (AI features), Stripe (subscription billing) and our email delivery provider.
14. International transfers
We may process or transfer personal data outside the United Kingdom where our suppliers, partners, cloud providers or support teams are based in other countries. Where required, we will use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.
Some of our service providers process data in the United States, including Sentry for error and crash reports, OpenAI and Google for AI features, Stripe for subscription billing and Cloudflare for image storage. For these transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
15. Data retention
We keep personal data only for as long as necessary for the purposes described in this policy, including providing the service, meeting legal, accounting and tax obligations, resolving disputes, enforcing agreements, maintaining security and improving the platform.
Typical retention periods may include:
- Merchant account data for the life of the account and for a reasonable period afterwards.
- Billing, invoice, tax and accounting records for up to 6 years or longer where required by law.
- Support records for as long as needed to resolve the issue and maintain business records.
- Security logs for a limited period unless needed for investigation or legal purposes.
- Marketing data until the person opts out or the data is no longer needed.
- Merchant customer data in accordance with the merchant’s instructions, account settings, contract and applicable retention rules.
Where we cannot specify a fixed period, we decide retention by considering the nature of the data, the purpose, legal requirements, risk, user expectations and whether the data can be anonymised.
15.1 Deleting your account
A business owner can delete their easyKiosk account from the website (Dashboard, then Account), or from the app (Settings, then About, then Delete account, which opens the same steps on the website). Full steps are on our Delete your account page.
We delete the business account and its data 30 days after the owner confirms. This includes its stores, products, orders, customers, staff accounts and settings. The owner can cancel the deletion during those 30 days.
After deletion we keep only:
- Our invoices and billing records to the business, for up to 6 years, to meet tax and accounting law.
- Security and fraud prevention logs, for a limited period, unless needed for an investigation or legal claim.
- Records we must keep to meet any other legal obligation or to establish or defend legal claims.
Payment providers, delivery platforms and other providers a merchant connected keep their own records under their own privacy policies.
16. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, encryption, secure hosting, monitoring, backups, audit logs, staff training and supplier due diligence.
No system is completely secure. Merchants and users must keep login details confidential, use strong passwords, restrict account permissions and notify us promptly if they suspect unauthorised access.
17. Individual rights
Depending on the circumstances and the lawful basis for processing, individuals may have the right to:
- Access their personal data.
- Correct inaccurate personal data.
- Request deletion of personal data.
- Restrict processing.
- Object to processing.
- Request data portability.
- Withdraw consent where processing is based on consent.
- Complain to the Information Commissioner’s Office.
Requests can be sent to [email protected]. We may need to verify identity before responding. Some rights may be limited where we act as processor for a merchant, where legal obligations apply, or where the request affects the rights of others.
Individuals also have the right to complain to the UK Information Commissioner’s Office at www.ico.org.uk.
18. Children
easyKiosk is intended for business users and is not directed at children. Merchants must not knowingly use easyKiosk to collect children’s personal data unless they have appropriate authority, a lawful basis and any required safeguards.
19. Automated decision making
We may use automated systems to support fraud prevention, security monitoring, risk checks, account protection, product recommendations and operational insights. We do not intend to make solely automated decisions that produce legal or similarly significant effects on individuals unless this is necessary, authorised by law, based on explicit consent, or covered by appropriate safeguards.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The latest version will be published on our website. Where changes are significant, we may notify merchants or users by email, dashboard notice or another appropriate method.
21. Contact us
Questions about this Privacy Policy or how personal data is handled should be sent to:
- Privacy contact: [email protected]
- Postal address: Multi Channel Creative Ltd trading as easyKiosk, 25 Station Road, Office 5, Kings Heath, Birmingham, B14 7SR, United Kingdom
- ICO registration reference: ZB394739
