Privacy notice

The short version

• We’re RED EPOS. We sell, install and support till systems for hospitality and retail businesses. For the personal data described here we’re the “controller”: we decide how it’s used, and we’re responsible for looking after it.
• We collect only what we need to reply to you, support your business and keep our systems secure. We don’t sell personal data or use it for advertising. We only market our own products and services to people we’ve dealt with, and you can stop that at any time.
• When we work on your business’s own tills and systems, your business stays in charge of the data on them. We act only on its instructions (we’re its “processor”).
• We keep website enquiries for 12 months, and closed support jobs and your customer record for 48 months after they’re closed. Then we delete them automatically.
• A few companies help us run things: hosting, backups, email, spam protection, remote support, AI suggestions and WhatsApp. They’re listed below, with where they are and how your data is protected.
• You can ask to see, correct or delete your data, or object to how we use it. If you’re unhappy, complain to us first: we’ll acknowledge your complaint within 30 days. You can then go to the Information Commission (ICO).

Who we are

RED EPOS is a trading name of David Lyons, a sole trader. Based in Runcorn, North West England.

We haven’t appointed a data protection officer, because the law doesn’t require one for a business like ours. As a sole trader, we don’t publish our home address on this page: you’ll find our postal address in our legal notice and terms. For anything about your data, email support@redepos.co.uk or call 07885 671481.

What we collect and why

What we hold depends on how you deal with us, so this section is grouped by who you are. Each part says what we collect, what we use it for, and our legal reason for using it (our “lawful basis”).

If you visit our website

Server logs. Like every website, ours logs each request: the page asked for, the time, the result, technical details of your browser, and a shortened version of your IP address. We cut off the end of the IP address before anything is written down, so it points to a large block of addresses rather than to your connection. We keep these logs for 14 days, to fix problems and keep the site secure. Lawful basis: legitimate interests (running a website that works and is secure).

Security logs. Our server’s firewall and security tools record the IP addresses of connections they block and of attempts to sign in to our systems. Our staff helpdesk site also logs the full IP address of each visit for 14 days, and keeps a record of sign-ins, including failed attempts, for 24 months. Most other security records are deleted after 4 weeks, and the server’s system journal after 90 days. Lawful basis: legitimate interests (keeping our network and systems secure).

The spam check on our contact page. Our contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. It runs only on our contact page. Cloudflare looks at technical signals such as your IP address and browser details. It uses them to tell people from bots for us and, as a separate controller, to improve how it spots bots. It says it doesn’t use them to identify, profile or target anyone: see Cloudflare’s Turnstile privacy notice. Lawful basis: legitimate interests (keeping our form free of spam and abuse).

No analytics. We don’t use any analytics tools on our website.

For cookies and similar technologies, see our cookies page.

If you send us an enquiry

What we collect. Through the form on our contact page: your name, email address and message, and anything else you choose to give us (your business name, phone number, sector, what you’re interested in, and the till system you use). We also record the page you came from and your browser’s technical details (its “user agent”). To stop spam, we keep a scrambled code made from your IP address with a secret that changes every day. We never store your IP address itself. The spam-check token from Cloudflare is checked once and not kept.

What we use it for. To reply to you and, if you go ahead, to arrange and do the work. We don’t send marketing to people who contact us through our website.

Reporting a problem or a security issue. For now, please email support@redepos.co.uk. We use your details only to look into your report and reply, and we keep the report for 24 months after we close it (longer only if it’s linked to a data breach). Please don’t include passwords, card numbers or other people’s personal data.

Lawful basis. Legitimate interests: replying to a request you’ve made, and keeping our form free of spam and abuse. If you’re a sole trader or partnership asking for a quote, it’s also a step you’ve asked us to take before a contract. You don’t have to give us your details, but we can’t reply without your name, email address and message.

A copy in our inbox. Each enquiry is also emailed to our business inbox (support@redepos.co.uk, hosted by Fasthosts), so we see it quickly. Brevo passes that email on for us. We keep the email copy for 12 months from when it arrives, then delete it.

How long. We keep the enquiry record for 12 months from the day you send it. It’s then removed in our monthly clean-up. If you become a customer, the details we need become part of your customer record (see below).

If you’re a customer, or a contact at a customer

Your account and our agreement. Your name, business name, email address, phone numbers, site addresses, what you’ve bought from us, your support package, and our invoices and payment records. We use them to provide what you’ve paid for, bill you, and keep the records the law requires.

Payments. We collect Direct Debit payments, such as for support packages, through GoCardless. One-off jobs are paid by card over the phone or by bank transfer. If you pay by card, we type your card details straight into the secure payment page of our card provider, Dojo, while we’re on the call. We never write them down or keep them, and we don’t record the call. Sage keeps our invoices and accounts.

Support jobs. When you ask for help, we log a job in our helpdesk: who asked, how to reach you, what the problem is, the site address if we visit, the messages about the job, our working notes, and a record of who changed what and when. Only the people who do our support work can sign in to the helpdesk (currently two). Customers don’t have accounts on it.

Texts and WhatsApp messages. Many jobs start with a text or WhatsApp message to our support number. An app on our work phones picks up new messages and files them against the right job, so we keep the message, the number it came from and when it arrived. We keep your number on file so that whichever way you get in touch, text or WhatsApp, we can match the message to you and to the right job. We send progress updates the same way. They’re service messages about your job, not marketing. Mobile networks carry text messages, and WhatsApp’s own privacy policy covers your use of WhatsApp.

Phone calls. We don’t record phone calls.

We’re also connecting our helpdesk directly to WhatsApp’s business messaging service. Once that’s switched on, WhatsApp (part of Meta) will pass the messages you send us straight to our helpdesk. For those messages, Meta Platforms Ireland Limited acts as our processor, on our instructions, under the data processing terms that form part of Meta’s WhatsApp Cloud API terms (Meta’s Global Processor Terms). For other data that reaches us through Meta’s platform, Meta and RED EPOS are independent controllers: each of us is responsible for its own use of it, and WhatsApp’s privacy policy covers Meta’s. Our server will keep a raw copy of each incoming message for 30 days, in case something goes wrong while it’s being filed, and then delete it. We also delete WhatsApp messages when you ask us to, and once we no longer need them.

AI help with job titles. We use this feature. When we turn one of your text or WhatsApp messages into a job, the app on our work phones sends its source (text or WhatsApp), the chat name, the sender, the date and time, and the full message text to Claude, an AI service run by Anthropic, and Claude suggests a short title for the job, such as “Kitchen printer offline”. For a text message, the chat name and sender can be the phone number it came from, or the name saved for that number in our work phone’s contacts. The suggested title is saved with the job straight away, and we can change it at any time. It’s only a title for the job: it doesn’t decide anything about you. If you object, we stop sending your messages to this step: for now we do that by hand, by keeping a list of customers who’ve objected, until we build a switch that turns it off for you automatically.

AI help with replies to data protection requests. This is a feature we may use; it isn’t switched on today. If it is, and you make a data protection request, our helpdesk may ask Claude to suggest wording for our reply. For that we’d send your name, your customer reference with us, counts and dates of what we hold, and any text we paste in from your request, but never your messages, our notes or your phone number. A person checks and sends every reply.

Both features only make suggestions. They don’t make decisions about you, and we don’t make any decisions about you by automated means alone. Anthropic processes this data in the USA, doesn’t use it to train its models, and normally deletes it within 30 days (it can keep data longer only if it’s flagged for misuse or the law requires it). Lawful basis: legitimate interests (organising our work efficiently). You can object to this, and if you do, we’ll stop sending your messages to the AI service.

Where we get your details. Usually from you. Sometimes someone else books a job for you, such as a colleague, your head office or a landlord, and gives us your name and number so we can do the work.

Lawful basis. If you’re our customer as an individual (a sole trader or partner), we use your details to perform our contract with you, or to take steps you’ve asked for before one. If you’re a contact at a customer business, or someone who reported a job for them, we rely on legitimate interests: working with our customer through you, and keeping you updated. Keeping a history of past jobs, so we can support the same equipment again and deal with any dispute, is also a legitimate interest. Keeping invoices and accounts is a legal obligation. We need your contact details to provide the support you’ve asked for.

Marketing. We use our own customer contacts to tell people about our own products and services. We don’t market to people who have only contacted us through our website. We don’t share your details with anyone else for marketing, and we don’t buy in marketing lists. Lawful basis: legitimate interests, keeping in touch with people we’ve already dealt with about things likely to interest them. You have an absolute right to object to marketing at any time, for any reason, and we’ll stop (UK GDPR Article 21(2)–(3)).

WhatsApp. We don’t use details that reach us through WhatsApp to build marketing profiles unless you’ve agreed. We only start a WhatsApp conversation with you, rather than replying to one of yours, if you’ve agreed to hear from us on WhatsApp, and we stop whenever you ask.

Emails and texts (PECR). If you’re a sole trader or in most partnerships, the law treats you as an “individual subscriber”, so we only email or text you marketing if you’ve agreed, or under the “soft opt-in”: we got your details while selling to you or negotiating a sale, we only market similar products and services to what you bought or asked about, and we gave you a clear chance to refuse marketing when we collected your details and in every message since. If you deal with us as a company, we can email you without consent, but every message says it’s from RED EPOS and gives you a way to opt out. Either way, every marketing message carries an unsubscribe link.

Debt collection. If an invoice goes unpaid, we may pass your details to a debt collection agency to recover what’s owed. Lawful basis: legitimate interests (recovering money owed to us). Other than that, we don’t share your data with anyone else for marketing, and we never sell it.

Please don’t send us card numbers, bank details, passwords, ID documents or health information by message or email. If we need a password to fix something, we’ll ask for it by phone, or you can type it in yourself. If a password reaches us by message anyway, we delete it and ask you to change it.

When we work on your business’s own systems

When we install, fix or support a customer’s tills, back-office software or other equipment, whether on site, by phone or remotely, we may see or handle personal data that belongs to that business. That includes its staff (for example names, till user IDs and clock-in times) and its own customers (for example names on orders, bookings or loyalty accounts and, on some integrated tills, payment details).

For that data the business is the controller, and we’re its processor. That means we:

• use it only to do the work the business has asked for, and follow its instructions;
• don’t keep copies unless the job needs one (for example, moving data to a new till), and delete them when the job’s done;
• keep it confidential and secure, and tell the business without undue delay if something goes wrong;
• help the business deal with any request you make about your data.

If you work for, or buy from, a business we support and you have a question about your data, please contact that business: it decides how your data is used. If you contact us instead, we’ll pass your request to the business and help it reply.

When we work on your systems, we never ask for, write down or store card numbers.

Website hosting customers. If we host your business’s website, the same applies to the personal data on it, for example names and messages from your site’s contact form, or accounts and orders it collects. You stay the controller of that data; we act only as your processor, under our Data Processing Agreement.

Our lawful bases

In short, we rely on:

• Contract: providing what you’ve bought from us, and steps you ask for before buying, where you’re our customer as an individual (a sole trader or partner).
• Legitimate interests: replying to enquiries; working with contacts at our business customers; keeping job histories and dealing with disputes; organising our work, including AI job-title suggestions; telling existing contacts about our own products and services (you can object to this at any time — see “Marketing” above); recovering unpaid debts; and keeping our website and systems secure. Where we rely on legitimate interests, we only use your data in ways you’d reasonably expect, and you can object.
• Legal obligation: keeping accounting and tax records, and dealing with your data protection requests and complaints.
• Recognised legitimate interests: answering requests from the police or other public bodies where the law allows (see the next section).

We don’t rely on your consent for anything described in this notice.

Who we share data with

We don’t sell personal data or share it for anyone else’s marketing. These companies process data for us, on our instructions and under contract:

Who	What they do for us	Where, and how transfers are protected
Fasthosts Internet Ltd	Hosts our server (this website, our enquiry database and our helpdesk), our email and our domain names	Fasthosts’ UK data centres, in Worcester and London. No transfer
Google (Google Cloud)	Stores our nightly backups	London, UK. Backups are encrypted on our server before they’re uploaded, and only we hold the key
TeamViewer Germany GmbH	Runs TeamViewer, the remote support software we use today, until our own remote support service replaces it. When you allow a session, it lets us see and control your computer or till. Sessions are encrypted from end to end, so TeamViewer can’t see what’s on the screen. It keeps a record of each connection, such as device IDs, IP addresses and times	Germany, Austria and elsewhere in the EU. UK law recognises the EU and EEA as giving adequate protection, so no extra safeguard is needed
Brevo (Sendinblue SAS)	Passes on the email that tells us about your enquiry	France (EU). UK law recognises the EU and EEA as giving adequate protection, so no extra safeguard is needed
Cloudflare, Inc.	Runs the spam check on our contact form	USA. Covered by the UK–US data bridge: Cloudflare is certified under the UK Extension to the EU–US Data Privacy Framework
Anthropic	Runs Claude, which suggests job titles and reply wording	USA. The UK’s International Data Transfer Addendum to the EU standard contractual clauses, backed by our own transfer risk assessment
WhatsApp (Meta)	Once our helpdesk’s WhatsApp link is switched on: carries WhatsApp messages between you and our helpdesk	USA, Ireland and other countries. The data transfer terms in WhatsApp’s business terms, including its UK addendum
GoCardless Ltd	Collects Direct Debit payments	UK and the EEA (the EEA is covered by UK adequacy regulations). Any other transfers use approved safeguards such as standard contractual clauses
Sage (Sage Group plc)	Sage Accounts online: keeps our invoices and accounts	Mainly the EEA (Ireland). Some services may use the USA, under Sage’s data processing terms and approved safeguards

We may also share personal data:

• with Dojo (a trading name of Paymentsense Limited), our card payment provider, when you pay us by card, so that it can process the payment;
• with our professional advisers and insurers, when we need advice or have to deal with a claim;
• with HMRC and other authorities, where the law requires it;
• with the police or other public bodies, where the law allows, for example to help prevent or detect crime, to protect someone at risk, or in an emergency. The law calls these “recognised legitimate interests”.

Sending data outside the UK

Most of the personal data we hold stays in the UK. Some services involve other countries: Cloudflare (USA), Anthropic (USA), WhatsApp once it’s switched on (USA and elsewhere), and Brevo and TeamViewer (EU, which UK law recognises as giving adequate protection). The table above shows the safeguard for each. Email us if you’d like a copy of a safeguard; we may remove commercially sensitive details.

How long we keep it

We keep personal data only as long as we need it, and delete it automatically wherever we can.

What	How long we keep it
Website server logs (shortened IP address)	14 days
Helpdesk access log (full IP address)	14 days
Security logs (blocked connections, sign-in attempts)	4 weeks. The server’s system journal: 90 days
Helpdesk sign-in records	24 months
Website enquiry	12 months from the day you send it, then removed in our monthly clean-up
Enquiry email in our inbox	12 months from when it arrives
Bug and security reports you send us, with our notes and replies	24 months after we close the report. Longer if a report is linked to a data breach: up to 6 years, with our records of that breach
Open support jobs	While the job is open
Closed jobs, with their messages, notes and change history	48 months after the job is closed
Your contact record and numbers in our helpdesk	Deleted once there are no jobs left under it and it hasn’t been updated for 48 months
Raw WhatsApp message log (once switched on)	30 days
Text sent to our AI service	Anthropic normally deletes it within 30 days
Contracts and support agreements	6 years after the agreement ends
Invoices and payment records	6 years from the end of the financial year they belong to
Privacy requests and complaints, and our replies	3 years after we close them
Backups	Up to 14 days on our server, and up to 30 days in our encrypted off-site backups

If we ever have to restore a backup, we run our deletion jobs again straight away, so nothing we’ve deleted comes back.

Keeping your data safe

In brief:

• Everything travels over encrypted connections (HTTPS).
• Our server sits behind a firewall, and repeated attacks are blocked automatically.
• The devices we use for work are encrypted and screen-locked.
• Our website logs keep only shortened IP addresses, and our enquiry database never stores your IP address.
• Backups are encrypted before they leave our server, and only we hold the key.

No system is completely secure. If a data breach is likely to put you at high risk, we’ll tell you without undue delay, and we’ll report breaches to the ICO where the law requires.

Your rights

You have the right to:

• see the personal data we hold about you, and get a copy;
• have it corrected if it’s wrong or incomplete;
• have it deleted, in some circumstances;
• limit how we use it, in some circumstances;
• object to how we use it where we rely on legitimate interests, and to direct marketing at any time;
• take it with you in a common digital format, where we use it under a contract and by automated means;
• not be subject to decisions made solely by automated means that significantly affect you. We don’t make any.

Some rights have exceptions. For example, we have to keep invoices for tax purposes even if you ask us to delete them. If we can’t do what you ask, we’ll tell you why.

How to ask. Use our contact form and choose “A privacy question or complaint”, email support@redepos.co.uk, call 07885 671481, or write to us at the postal address in our legal notice and terms. If you have an enquiry or job reference, include it. We may ask you to confirm who you are before we share anything.

When we’ll reply. Within one month of receiving your request, or of receiving anything we need to confirm who you are. If we need you to clarify what you’re asking for, the month pauses until you reply. If a request is complex, or you send several, we can take up to two more months; if so, we’ll tell you why within the first month. There’s normally no charge.

Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us. You have a legal right to complain to us, and we’d like the chance to put things right. To complain:

• online: use our contact form and choose “A privacy question or complaint”;
• by email: support@redepos.co.uk, with “Privacy complaint” in the subject;
• by phone: 07885 671481;
• by post: see the postal address in our legal notice and terms.

We’ll acknowledge your complaint within 30 days, counting from the day we receive it. We’ll look into it, keep you updated, and tell you the outcome without undue delay.

If you’re not happy with our response, you can complain to the Information Commission, the UK’s data protection regulator. It still goes by “ICO”: it took over from the Information Commissioner’s Office on 30 September 2026. Complain at ico.org.uk/make-a-complaint or call 0303 123 1113. You don’t have to wait for our process to finish, but the ICO will usually ask whether you’ve raised the matter with us first.

Changes to this notice

We’ll update this notice whenever we change how we use personal data, and change the date at the top. If a change affects our customers, we’ll tell them directly as well. The previous version, dated 23 September 2026, covered website enquiries only.

Contact us

Questions about this notice or your data:

• email: support@redepos.co.uk
• phone: 07885 671481
• post: see our postal address in the legal notice and terms

---