Candy shop kiosk - Data Protection & Security Policy

Effective Date: 01/16/2025

Candy Shop Kiosk ("Company," "we," "us," or "our") is committed to ensuring the confidentiality, integrity, and security of all data collected through our website, kiosks, and financial processing services.

This Data Protection & Security Policy outlines the measures we take to safeguard sensitive information, including customer data, merchant transaction details, and payment processing records. Our security framework adheres to PCI DSS compliance and other relevant industry standards to protect against unauthorized access, breaches, and misuse.

This policy applies to:

• All Candy Shop Kiosk employees, contractors, and service providers handling customer and business data.
• Customers using our kiosks, payment processing services, and online platforms.
• Third-party partners such as eMerchant Authority and Clover who process transactions on our behalf.
• Any merchant utilizing Candy Shop Kiosk’s financial processing services.

By using our services, you agree to the collection, storage, and protection measures outlined in this policy.

• Full name
• Email address
• Phone number
• Shipping and billing address
• Payment details (credit card, ACH, or other financial data)
• Order history and transaction details

• Business registration details
• Merchant account numbers
• Banking information for financial settlements
• Transaction volume, sales reports, and customer insights

• IP address, geolocation, and browser data
• Device identifiers when interacting with our kiosks
• Cookies and tracking data for website and kiosk interactions

Candy Shop Kiosk collects and stores customer and merchant data only for legitimate business purposes, including order processing, transaction security, and regulatory compliance.

• All financial and personal data is encrypted using AES-256 encryption standards.
• Payment information is never stored directly on Candy Shop Kiosk servers; it is processed via PCI DSS-certified payment gateways such as eMerchant Authority and Clover.
• Access to sensitive data is strictly restricted to authorized personnel only.

• Customer and merchant financial records are retained for seven (7) years in compliance with financial regulations.
• Non-financial customer data is deleted upon request or after three (3) years of inactivity.

Candy Shop Kiosk complies with PCI DSS (Payment Card Industry Data Security Standards) to secure credit card transactions.

• All financial transactions are tokenized and encrypted.
• We conduct quarterly vulnerability scans and annual security audits.
• Multi-factor authentication (MFA) is required for all internal financial processing accounts.

• Our servers and kiosks are monitored 24/7 for suspicious activity.
• In the event of a data breach, affected users will be notified within 72 hours per regulatory requirements.

• Employees handling customer and merchant data undergo mandatory security training.
• Role-based access ensures that only essential personnel can access sensitive data.

Candy Shop Kiosk does not sell or rent customer or merchant data to third parties. However, data may be shared with:

• eMerchant Authority & Clover – to facilitate secure financial transactions.
• Regulatory bodies & law enforcement – if required for legal compliance.
• Business service providers – for fraud prevention and cybersecurity protections.

All third parties handling data on our behalf are required to comply with industry-standard security measures.

Customers and merchants have the right to:

• Request a copy of personal data stored by Candy Shop Kiosk.
• Request data corrections in the event of inaccuracies.
• Request data deletion, subject to regulatory retention requirements.
• Opt-out of marketing communications at any time.

For data inquiries, please contact Contact@CandyShopKiosk.com.

Candy Shop Kiosk reserves the right to modify this policy at any time. Updates will be posted on our website, and affected customers and merchants will receive a notification.