1. Our commitment

MrPOS is based in Pakistan, but our website is open to the world — so we hold ourselves to the EU/UK General Data Protection Regulation (GDPR) standard for all visitors, not only those in Europe. In practice this site was built privacy-first: analytics are opt-in, there are no advertising networks, and the only personal data we hold is what you send us or what you consent to share.

2. Our role

  • On this website (mrpos.live): we are the data controller for the small amount of data described in our Privacy Policy — your enquiries and, with consent, analytics.
  • Inside the MrPOS software: you (the business) are the controller/owner of your own records — sales, customers, staff — and we act as a processor, handling that data only on your instructions and under your service agreement.

3. Consent first, analytics second

On your first visit you see a short consent banner with two buttons:

  • Accept — we load Google Analytics 4 and Microsoft Clarity, and remember your choice.
  • Decline — neither tool is loaded, no analytics cookies are set, no analytics requests are sent. The site remains fully usable.

Changing your mind takes one tap: Cookie Settings in the footer re-opens the banner at any time. This "block until consent" approach is stricter than most websites you visit daily.

4. Legal bases we rely on

  • Consent (Art. 6(1)(a)) — analytics cookies and session measurement.
  • Contract / pre-contractual steps (Art. 6(1)(b)) — replying to your demo requests, quotes and support messages.
  • Legitimate interest (Art. 6(1)(f)) — server security logs to protect the site from abuse.

5. Cookies and storage on this site

  • mrpos-analytics-consent — local storage, strictly necessary, stores your banner choice only.
  • _ga (Google Analytics 4) — only after Accept; visitor aggregation; typically up to 2 years.
  • _clck, _clsk (Microsoft Clarity) — only after Accept; heatmaps/recordings with inputs masked; roughly up to 1 year and 1 day.

6. Processors and international transfers

The only third parties that touch website data are our hosting provider, Google Ireland/Google LLC (Analytics 4) and Microsoft Corporation (Clarity). Where personal data leaves the EEA/UK, the providers rely on European Commission Standard Contractual Clauses and their published transfer safeguards.

7. Your GDPR rights and how to use them

You have the rights of access, rectification, erasure ("right to be forgotten"), restriction, objection, data portability, and the right to withdraw consent at any time — plus the right to lodge a complaint with your national data protection authority. To exercise any of them:

  • WhatsApp or call 0316 6132742 and describe your request, or
  • Use Cookie Settings in the footer to withdraw analytics consent instantly.

We acknowledge requests promptly and respond fully within 30 days. We never charge a fee and never ask for more information than needed to confirm your identity.

8. Security and breach response

This website is a hardened static site (no database, no forms, strict Content-Security-Policy). If a security incident ever affects personal data, we will inform affected users and, where required, the relevant supervisory authority without undue delay.

9. Questions

Everything here is also summarised in our Privacy Policy, and our Terms of Service cover orders. If anything is unclear, message MrPOS Support on WhatsApp — 0316 6132742; a real human replies, 7 days a week.