Privacy Policy

QIOSK operates as a multi-sided digital marketplace platform connecting vendors, retailers, and customers across the United Kingdom. This Privacy Policy explains how QIOSK ("we", "us", or "our") collects, processes, stores, and protects personal data submitted through our platform, including our AI Studio feature available to retailers. We are committed to maintaining the highest standards of data privacy and operate in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By accessing or using QIOSK, you agree to the collection and use of information as described in this policy.

This Privacy Policy applies to all individuals who interact with the QIOSK platform, including:

• Vendors who register on QIOSK to list and manage their products
• Retailers who browse vendor catalogues, add products to their storefronts, and manage customer-facing shops
• Customers who place orders through retailer storefronts powered by QIOSK
• Visitors who browse the QIOSK website without creating an account
• Users of the QIOSK AI Studio tool for image generation and campaign creation

We process personal data only where we have a lawful basis to do so under UK GDPR. The purposes for which we use your information include:

• Creating and managing user accounts for vendors, retailers, and customers
• Enabling vendors to list products and retailers to build and manage their storefronts
• Processing and fulfilling customer orders placed through retailer shops
• Operating the AI Studio to generate images and campaign content for retailers
• Sending transactional communications such as order confirmations and account notifications
• Processing payments and managing billing for platform subscriptions
• Providing customer support and resolving disputes between platform users
• Improving platform performance, features, and user experience through analytics
• Complying with legal obligations, including fraud prevention and financial record-keeping
• Sending marketing communications where you have provided explicit consent

QIOSK's AI Studio is an integrated tool available to retailers for generating product images and developing marketing campaign ideas. With respect to AI Studio, we wish to make the following clear:

• Prompts and inputs submitted to AI Studio may be processed by third-party AI model providers under strict data processing agreements
• Generated images and campaign outputs are stored securely and associated with your retailer account
• We do not use your AI Studio inputs to train our own AI models without your explicit consent
• Retailers are responsible for ensuring that any content they generate complies with applicable laws and does not infringe third-party intellectual property rights
• AI Studio usage data may be analysed in aggregate, anonymised form to improve tool performance

We do not sell personal data to third parties. We may share your information in the following circumstances:

QIOSK uses cookies and similar technologies to operate the platform and improve your experience. The types of cookies we use include:

• Essential cookies that are necessary for the platform to function, including maintaining your login session
• Performance cookies that help us understand how users navigate the platform
• Functional cookies that remember your preferences and settings
• Marketing cookies used to deliver relevant content, where consent has been provided

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Our general retention periods are as follows:

• Active account data is retained for the duration of your account with QIOSK
• Transaction and order records are retained for a minimum of six years in accordance with UK tax and financial regulations
• AI Studio generated content is retained for as long as your account remains active, unless you choose to delete it
• Marketing data is retained until you withdraw consent or unsubscribe
• Anonymised and aggregated data may be retained indefinitely for analytical purposes

As a data subject under UK law, you have the following rights regarding your personal data:

• Right of Access — You may request a copy of the personal data we hold about you
• Right to Rectification — You may request correction of inaccurate or incomplete data
• Right to Erasure — You may request deletion of your data where there is no lawful basis for continued processing
• Right to Restriction — You may request that we limit the processing of your data in certain circumstances
• Right to Data Portability — You may request your data in a structured, machine-readable format
• Right to Object — You may object to processing based on legitimate interests or for direct marketing purposes
• Rights Related to Automated Decision-Making — You have the right not to be subject to solely automated decisions that significantly affect you

QIOSK implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• End-to-end encryption for data transmitted across our platform
• Secure storage of payment information through PCI DSS compliant payment processors
• Role-based access controls limiting internal access to personal data
• Regular security assessments and vulnerability testing
• Staff training on data protection and information security

QIOSK is a UK-based platform. Where we transfer personal data outside of the United Kingdom, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or transfers to countries with an adequacy decision from the UK Secretary of State. Any third-party AI providers processing data outside the UK are bound by contractual obligations that meet UK GDPR standards.

The QIOSK platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal information, please contact us immediately and we will take prompt steps to delete such data.

We may update this Privacy Policy from time to time to reflect changes in our practices, platform features, or applicable law. When we make material changes, we will notify registered users by email or via a prominent notice on the platform. The date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically.