We're committed to protecting your privacy and personal data. This policy explains how we collect, use, store, and safeguard your information.
Privacy Policy
Last updated: 15 October 2026
This policy explains how POSable collects, uses, shares and protects personal information when you visit posable.co.uk or use the POSable point of sale service. It applies to customers and visitors in the United Kingdom and the United States.
In short:
- POSable Ltd (UK) runs POSable. POSable LLC is our US company.
- UK customer data is hosted on UK servers. US customer data is hosted on US servers. Our dashboard, licensing and API run on our UK server, so some data moves between the UK and the US, with legal safeguards in place.
- We do not sell personal information.
- For the customer, staff and sales data you keep in your POS, you (the merchant) are in control. We process it for you, on your instructions.
1. Scope
This policy covers:
- our website, posable.co.uk
- the POSable web dashboard, Android and Windows till apps, Shop Floor app, customer loyalty app and APIs (together, the "Service")
- our sales, support and marketing communications
It applies to business customers who subscribe to POSable ("merchants"), their staff who use the Service, and visitors to our website. Section 3 explains how this works for the people whose details merchants keep in their POS, such as their customers and loyalty members.
2. Who we are
POSable Ltd is a UK company registered in England and Wales.
- Company Registration Number: 16705417
- Registered office: 5 Beach Road, Perranporth, Cornwall, TR6 0JL, United Kingdom
- ICO registration: ZC072234
- Data Protection Officer: Mark Foster
- Email: privacy@posable.co.uk
- Website: https://posable.co.uk
POSable LLC is our US company. It contracts with and bills our US customers.
- Address: 30 Gould St, Ste N, Sheridan, WY 82801, USA
Who is responsible for your data:
- UK merchants and all website visitors: POSable Ltd is the controller.
- US merchants: POSable LLC is the contracting company. POSable Ltd operates the platform. POSable Ltd acts as a service provider to POSable LLC.
In this policy, "POSable", "we", "our" and "us" mean POSable Ltd and POSable LLC.
3. Our role: controller or processor
POSable as controller. We decide how and why we use:
- merchant account and billing information
- website visitor and marketing data
- support records
- security and service logs
The merchant as controller and POSable as processor. When a merchant uses POSable to record information about other people, the merchant is the controller of that data. This includes customers, loyalty members, staff, sales transactions and Shop Floor records. Under UK data protection law, we act as the merchant's processor. Under US state privacy laws, we act as the merchant's service provider or processor. In this role, we:
- process that data only to provide the Service and on the merchant's documented instructions
- keep it confidential and secure, and help the merchant respond to rights requests
- do not sell it, or use it for our own purposes (other than creating anonymised, aggregated statistics as described in section 6)
Our Data Processing Agreement (DPA) is available on request.
If you are a customer of a shop that uses POSable, please contact that business about your data. If you contact us instead, we will pass your request to the business where we can.
Card payment partners as independent controllers. Card payments are processed by the merchant's chosen payment provider:
- Dojo, Teya or myPOS in the UK
- Gravity Payments (using its Emergepay platform) in the US
Each of these acts as an independent controller under its own agreement with the merchant and its own privacy policy. POSable sends the payment amount to the terminal and receives the result. POSable Ltd and POSable LLC do not keep or store card information at any time.
4. Information we collect
4.1 Information you give us
- Account information: name, email address, phone number, business name, business and billing address
- Business information: business type, industry, number of employees and locations
- Subscription payment information: processed securely by Stripe. We do not store full card numbers for subscription payments.
- Communications: support requests, live chat, feedback and other messages to us
4.2 Data merchants store in the Service (we process this for the merchant)
- Sales transactions, refunds and payment results
- Product, stock and supplier information
- Staff user accounts, roles and activity logs
- Customer and loyalty member details (such as name, contact details, points and purchase history), where the merchant uses these features
- Shop Floor checks and other records the merchant creates
4.3 Information collected automatically
- Device and connection data: IP address, browser type, operating system and app version
- Approximate location: the country we derive from your IP address through Cloudflare, used to select your region (UK or US), prices, currency and servers. We do not collect precise location.
- Usage data: pages visited, features used, session duration
- Log data: access times, errors and performance data
- Cookies and similar technologies: see section 13 and our Cookie Policy
5. How we use information and our legal bases (UK)
| Purpose | UK GDPR legal basis |
|---|---|
| Providing the Service, syncing your devices, account management and support | Performance of contract (Art. 6(1)(b)) |
| Billing, tax and accounting | Performance of contract; legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, monitoring and fixing the Service | Legitimate interests (Art. 6(1)(f)) |
| Choosing your region, prices and servers from your IP country | Legitimate interests (Art. 6(1)(f)) |
| Improving the Service and creating anonymised, aggregated statistics | Legitimate interests (Art. 6(1)(f)) |
| Service and policy notices | Performance of contract; legitimate interests |
| Marketing emails, and analytics and marketing cookies | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Meeting legal requirements and responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
6. Aggregated and anonymised data
We may combine and anonymise data from across the Service to:
- analyse usage and trends
- produce industry benchmarks
- improve and develop the Service
Before we use data this way, we remove personal identifiers and combine it so that no individual, business or customer can be identified. We take technical and organisational measures to make the anonymisation irreversible. Truly anonymised data is not personal data. We do not sell aggregated data to third parties for marketing.
7. Who we share information with
We do not sell personal information. We share it only as follows.
7.1 Service providers (processors) acting on our instructions
- Stripe: subscription billing and payments, through our UK and US Stripe accounts
- Cloudflare: website and network security, performance, and IP-based country detection used to set the posable_region cookie
- Hosting and backup providers: our UK and US regional servers and off-site backups.
- Customer support: Support Genix, our self-hosted help desk on posable.co.uk, which runs our support chat (POS BOT), knowledge base and support tickets
- Analytics and advertising: Google Analytics, Microsoft Clarity, Google Ads and Meta (Facebook Pixel). In the UK these are only used with your consent; in the US you can opt out at any time (see section 13).
- AI service providers, such as OpenAI and Anthropic, for AI.MEE features on AI plans. AI requests are logged for error reporting only. Our support chat (POS BOT) also sends the questions you type to OpenAI and Anthropic, which match them to our own help articles and point you to the right guide. Please don't enter card details or other sensitive information in the chat.
7.2 Independent controllers
Card payment partners chosen by the merchant: Dojo, Teya and myPOS (UK), and Gravity Payments using Emergepay (US). See section 3.
7.3 Between our companies
POSable Ltd and POSable LLC share information to provide, bill and support the Service.
7.4 Legal requirements and protection
We may share information where the law requires it, or where it is needed to protect our rights, our users or the public, or to prevent fraud.
7.5 Business transfers
If POSable is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner. We will tell you about any such change.
8. Where we store data and international transfers
Regional hosting:
- UK merchants: data is hosted on our UK regional servers in Manchester, Glasgow, Coventry and London.
- US merchants: data is stored in the US, on our regional servers in Los Angeles, New York, Chicago, Richmond, Spokane and Las Vegas.
Central services in the UK. The POSable dashboard, licensing and API run on our UK server. This means some US merchant data, such as account and licence details and data viewed or exchanged through the dashboard or API, is transferred to and processed in the UK. UK data may also be transferred to the US where needed, for example to support US operations or when using US-based service providers.
Safeguards. When personal data leaves the UK, we rely on one of the following:
- UK adequacy regulations, including the UK–US "data bridge" where the US recipient is certified under it
- the ICO's International Data Transfer Agreement (IDTA)
- the UK Addendum to the EU Standard Contractual Clauses (SCCs)
We also apply supplementary measures where needed. We apply the same security standards to data processed in the UK on behalf of US merchants.
9. How long we keep information
| Data | Retention |
|---|---|
| Account and Service data, including merchant POS data | While your subscription is active. Kept for up to 90 days after cancellation, then permanently deleted. You can ask for earlier deletion. |
| Billing and payment records | 6 years for UK accounting and tax purposes. For US customers, as long as US federal and state tax law requires. |
| Marketing data | Until you withdraw consent, or after 3 years of inactivity |
| Support records | 3 years after your last contact with us |
| Security and service logs | 3 years after your last contact with us |
| Backups | Overwritten on a rolling basis of 14 days |
Merchants can export their data before their paid period ends.
10. How we protect information
We use appropriate technical and organisational measures, including:
- encryption in transit (SSL/TLS) and encrypted storage
- access controls and authentication
- regional servers with off-site backups
- regular security updates and reviews
- staff training on data protection
No method of transmission or storage is completely secure, but we continuously work to improve our protections.
11. Your rights in the UK (UK GDPR and the Data Protection Act 2018)
You have the right to:
- access a copy of your personal data
- rectification of inaccurate or incomplete data
- erasure of your data
- restrict how we process your data
- data portability: receive your data in a portable format
- object to processing based on legitimate interests, and to direct marketing at any time
- withdraw consent at any time, where we rely on consent
- not be subject to solely automated decisions with legal or similarly significant effects
To use these rights, email privacy@posable.co.uk. We will respond within one month. We may extend this by up to two further months for complex requests, and we will tell you if we do.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to deal with your concern first.
12. Your rights in the US (state privacy laws)
12.1 Your rights
Depending on where you live, US state privacy laws may give you rights over your personal information. These laws include the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the privacy laws of states such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon. The rights may include:
- knowing and accessing the personal information we collect, use and disclose
- deleting personal information
- correcting inaccurate personal information
- portability: getting a copy in a usable format
- opting out of the sale or sharing of personal information, targeted advertising and certain profiling
- limiting the use of sensitive personal information. We only use sensitive information, such as account log-in details, to provide and secure the Service.
- not being discriminated against for exercising your rights
- appealing a decision about your request, where your state provides this
12.2 Making a request
Email privacy@posable.co.uk.
- We will verify your identity before acting on a request.
- You may use an authorised agent.
- We aim to respond within 45 days, as the law allows.
- If we refuse a request, you can appeal by replying to our decision. If you are not satisfied with the outcome of an appeal, you can contact your state Attorney General.
- California residents can also contact the California Privacy Protection Agency.
12.3 Do not sell or share
We do not sell personal information. We have not sold personal information in the past 12 months. Some advertising cookies, such as Google Ads and the Meta Pixel, may count as "sharing" for cross-context behavioural advertising, or as "targeted advertising", under some state laws. In the UK we only set these cookies with your consent. In the US you can opt out of this sharing at any time with the Your Privacy Choices link in the website footer, and we honour Global Privacy Control (GPC) browser signals as an opt-out. We do not knowingly sell or share the personal information of anyone under 16.
If you are a customer of a US business that uses POSable, that business controls your data. Please send your request to the business. We act as its service provider.
12.4 Notice at collection
| Category | Examples | Purposes | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email, phone, IP address, account ID | Providing the Service, support, security, billing, marketing (with consent) | Hosting, Stripe, Cloudflare, support and analytics providers |
| Customer records | Business and billing address, subscription payment details | Billing and accounting | Stripe, professional advisers |
| Commercial information | Plan, subscription and purchase history | Providing and billing the Service | Stripe, hosting providers |
| Internet or network activity | Usage, log and cookie data | Security, improving the Service, analytics and advertising (UK: with consent; US: unless you opt out) | Cloudflare, Google, Microsoft, Meta |
| Approximate location | Country derived from IP address | Selecting your region, prices and servers | Cloudflare |
| Professional information | Business type, role, staff user details | Providing the Service | Hosting providers |
| Sensitive personal information | Account log-in credentials | Account security only | Not disclosed, except to hosting providers as processors |
- Sources: you, your devices, the merchant who gives you access, and our service providers.
- Retention: see section 9.
- Sale: we do not sell any of these categories.
13. Cookies and similar technologies
We use essential cookies to run the website and Service. In the UK, we use analytics, functional and marketing cookies only with your consent. In the US, you can opt out of them at any time with the Your Privacy Choices link, and we honour Global Privacy Control (GPC) signals. You can change your choices at any time in our cookie settings or in your browser. Third-party cookies may be set by Google Analytics, Microsoft Clarity, Google Ads and Meta (Facebook Pixel).
We also use a posable_region cookie. It records whether you are in the UK or the US, based on the country Cloudflare detects from your IP address, so we can show the right prices and currency and connect you to the right servers. It lasts 30 days.
See our Cookie Policy for full details.
14. Children
The Service is designed for businesses. It is not aimed at anyone under 18, and we do not knowingly collect personal information from children. If we learn that we have collected a child's personal information, we will delete it promptly.
15. Third-party links
Our website and Service may link to third-party websites and services, such as payment partners. We are not responsible for their privacy practices, so please read their policies.
16. Data breaches
If a personal data breach is likely to put your rights and freedoms at risk, we will:
- notify you without undue delay (within 72 hours where feasible)
- give details of the breach and the steps we are taking
Where you are the controller, for example for your customers' data, you remain responsible for notifying regulators and affected individuals where the law requires it. We will help you do so.
17. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date. We will also email you about significant changes.
18. Contact us
Data Protection Officer: Mark Foster
POSable Ltd
5 Beach Road
Perranporth, Cornwall
TR6 0JL, United Kingdom
Email: privacy@posable.co.uk
US customers
POSable LLC, 30 Gould St, Ste N, Sheridan, WY 82801, USA
Email: privacy@posable.co.uk
UK: you can complain to the Information Commissioner's Office (ICO). Our ICO registration is ZC072234.
US: you can contact your state Attorney General. California residents can also contact the California Privacy Protection Agency.