Wake-up call: managing PoS integration in a Covid-19 world

The law

Integration services will often be supplied by a third-party specialist provider or by the supplier of the software solution that is to be integrated (eg your PoS provider). Your relationship with the provider should be governed by a contract outlining your expectations, your rights and remedies in case things go wrong.

Alongside your contractual rights, various regulations govern how you can use customer data collected through your technology solutions, such as the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

Expert advice

The contract

Careful consideration needs to be given to the terms of the contract that governs your relationship with any systems integrator. Your ability to negotiate your contract will be dictated by the scale of the project, expected spend with the relevant supplier and your bargaining power. However, at the very least, you should be aware of the implication of any contractual terms, to enable you to assess and mitigate any potential risks.

Points to deliberate when drafting a systems integration contract should include:

• Specifying who will own the intellectual property in any bespoke software developed, including the appropriate licence terms. You may consider exclusivity provisions to prevent competitors benefiting from a project for which you have paid.
• If possible, clearly outline the intended functionality of any end-product. If your requirements are unclear at the outset, consider a more agile approach. Collaborating with your supplier means output can be developed in stages, refining requirements during the project. This increases uncertainty at the outset (and thus weakens remedies if things go wrong), but can deliver better results.

Don't forget to consider any interaction with existing contracts for underlying technology solutions, to ensure that integration does not put you in breach of underlying terms or increase the fees payable for underlying solutions.

Customer data

It is important to be clear on what you are permitted to do with your customers' data. Data collected through various ordering solutions can hold significant value, as it can facilitate a richer understanding of your business and customers. This, in turn, can enable you to target individuals with specific offers and communications, thus selling more effectively.

As a general rule, you need an individual's express consent before conducting direct electronic marketing. However, when you have collected a customer's data through previous dealings, a "soft opt-in" approach is likely to be permitted. This will allow you to send direct electronic marketing to customers when it relates to similar goods and services already provided (ie, meals), as long as customers are given a simple way to refuse this marketing (eg an "opt-out" tick box when data is collected and an unsubscribe option in each communication).

However, receiving customer data from a third party (such as an aggregator) will often mean you do not "own" that customer relationship or have a right to market to the customers directly.

To-do checklist

1. Carefully consider your contract with any systems integrator.
2. Review underlying terms of supply for related technology solutions.
3. Consider what rights you have to use customer data for marketing purposes.
4. Ensure you request valid marketing consent from your customers or can rely on the "soft opt-in" approach.

Beware

If your contract is insufficient, you may not get what you ordered and may be left with little recourse against your supplier.

Breaching data protection laws can result in fines of up to €20m (£18m) or 4% of global turnover, as well as potentially causing significant reputational damage.

Contact

Chris Ingram is a senior associate solicitor at Charles Russell Speechlys LLP

chris.ingram@crsblaw.com

Photo: Shutterstock