At CreativeXpos, your privacy matters. This Privacy Policy explains how we collect, use, store, share, and protect information when you use the CreativeXpos website, software, applications, dashboards, and related services ("Services").
By using our Services, you agree to the collection and use of information as described in this policy. We are committed to handling your data responsibly and in accordance with applicable privacy laws.
You own your data
Your Customer Data — orders, menus, customers — belongs to you. We only process it to run your services.
We don't sell your data
We never sell, rent, or trade your personal or business data to third parties for marketing purposes.
Security first
Industry-standard encryption, access controls, and secure infrastructure protect your data at all times.
1
Introduction
1.1
This Privacy Policy applies to CreativeXpos ("CreativeXpos", "Company", "We", "Us", or "Our") and covers all users of the CreativeXpos platform, including restaurant owners, administrators, staff, and end customers interacting with CreativeXpos-powered storefronts.
1.2
CreativeXpos acts as a data controller in respect of platform account and usage data, and as a data processor in respect of Customer Data entered into the platform by the Customer (restaurant operator).
1.3
This policy should be read alongside our Terms & Conditions, which govern the overall use of our Services.
1.4
If you have any questions about this policy or our privacy practices, contact us at the details provided in Section 15.
2
Information We Collect
2.1
Account & Registration Data. When you register or purchase a plan, we collect:
- Full name and business name
- Email address
- Phone number
- Business address and country
- Password (stored as a hashed value — never in plain text)
- Plan type and purchase information
2.2
Customer Business Data. Data you enter into CreativeXpos while running your restaurant, including menu items, orders, sales records, customer profiles, inventory, expenses, staff accounts, and business settings. This data belongs to you.
2.3
Usage & Technical Data. We may automatically collect:
- IP address and approximate location
- Browser type and operating system
- Pages visited and features used
- Session duration and timestamps
- Device identifiers and screen resolution
- Error logs and crash reports
2.4
Communication Data. Records of support requests, emails, or messages you send to CreativeXpos, including their content and timestamps.
2.5
Payment Data. Payment transactions are handled by third-party payment processors. CreativeXpos does not store full card numbers or sensitive payment credentials. We may retain invoice references, transaction IDs, and payment status.
2.6
Storefront Customer Data. If your restaurant uses the CreativeXpos online storefront, your customers' order data (names, delivery addresses, phone numbers, order history) is stored on the platform. You, as the restaurant operator, are the data controller for this information and are responsible for handling it lawfully.
3
How We Use Your Data
| Purpose | Data Used | Basis |
|---|---|---|
| Provide and operate the Services | Account data, Customer Data | Contract performance |
| Process payments and billing | Account data, payment references | Contract performance |
| Send service notifications and updates | Email, phone | Contract performance |
| Provide technical support | Account data, usage data, communications | Legitimate interest |
| Improve and develop the platform | Usage data, error logs | Legitimate interest |
| Ensure platform security | Usage data, IP address | Legitimate interest |
| Comply with legal obligations | As required by law | Legal obligation |
| Send product updates (opt-out available) | Legitimate interest / consent |
3.1
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
3.2
We do not sell, rent, or trade your personal data or Customer Data to any third party for commercial or marketing purposes.
4
Legal Basis for Processing
4.1
Contract Performance. Processing necessary to deliver the Services you have purchased or registered for.
4.2
Legitimate Interests. Processing for platform security, fraud prevention, service improvement, and support — where these interests are not overridden by your rights.
4.3
Legal Obligation. Processing required to comply with applicable laws, court orders, or regulatory requirements.
4.4
Consent. Where we rely on consent (e.g., optional marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.
4.5
These Terms are governed by the laws of Pakistan. Where mandatory data protection laws in your jurisdiction provide additional rights, those rights are not diminished by this policy.
5
Data Sharing & Disclosure
We do not sell your data. We share data only in the limited circumstances described below.
5.1
Service Providers. We may share data with trusted third-party providers who assist in operating the platform — including hosting providers, email delivery services, SMS gateways, and analytics tools — under strict data processing agreements that prohibit unauthorized use.
5.2
Payment Processors. Payment data is shared with third-party payment processors as necessary to complete transactions. These processors operate under their own privacy policies and PCI-DSS compliance obligations.
5.3
Legal Requirements. We may disclose data if required by applicable law, court order, regulatory authority, or to protect the rights, property, or safety of CreativeXpos, its users, or others.
5.4
Business Transfers. In the event of a merger, acquisition, or asset sale, Customer Data may be transferred as part of that transaction. Affected customers will be notified in advance where reasonably practicable.
5.5
With Your Consent. We may share data in other circumstances with your explicit prior consent.
6
Customer Data & Restaurant Operator Responsibilities
6.1
You, as the restaurant operator, retain ownership of all Customer Data you enter into CreativeXpos — including menus, orders, customer records, inventory, and sales data.
6.2
CreativeXpos processes Customer Data on your behalf as a data processor, following your instructions and these Terms.
6.3
You are responsible for:
- Ensuring you have a lawful basis to collect and process your customers' personal data
- Providing appropriate privacy notices to your own customers
- Responding to data subject access or deletion requests from your customers
- Ensuring Customer Data entered into the platform complies with applicable laws
6.4
CreativeXpos will not access Customer Data beyond what is necessary to provide, maintain, and support the Services, unless required by law.
6.5
Upon termination of your account, Customer Data may be retained for a limited period as described in Section 7, after which it will be deleted in accordance with our data retention policy and applicable law.
7
Data Retention
7.1
We retain account and usage data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements.
7.2
Customer Data entered into the platform is retained during your subscription or license term and for a post-termination period as defined in the applicable agreement or our data retention policy.
7.3
Financial and billing records may be retained for longer periods as required by applicable tax and accounting laws.
7.4
You may request deletion of your account and associated data by contacting our support team. Deletion requests are processed subject to applicable legal obligations and the terms of the applicable agreement.
7.5
Anonymized or aggregated data that cannot reasonably identify any individual may be retained indefinitely for analytical and platform improvement purposes.
8
Data Security
8.1
CreativeXpos implements industry-standard technical and organizational security measures to protect your data against unauthorized access, loss, alteration, disclosure, or destruction.
8.2
Security measures include:
- Encrypted data transmission (HTTPS/TLS)
- Password hashing using industry-standard algorithms
- Role-based access controls limiting data access to authorized personnel
- Multi-tenant data isolation preventing cross-tenant data access
- Regular security reviews and vulnerability assessments
- Audit logging for sensitive operations
8.3
Where the Software is deployed on Customer-provided hosting, the security of the hosting environment, server configuration, and backups is the Customer's responsibility unless otherwise agreed in writing.
8.4
In the event of a data breach affecting your account, we will notify you as required by applicable law and take reasonable steps to mitigate the impact.
8.5
No security system is completely impenetrable. While we use commercially reasonable measures, we cannot guarantee absolute security of data transmitted over the internet.
9
Cookies & Similar Technologies
9.1
CreativeXpos uses cookies and similar technologies on its website and platform to operate core functionality, maintain sessions, and improve your experience.
9.2
Essential Cookies. Required for the platform to function — session authentication, security tokens, and CSRF protection. These cannot be disabled without breaking functionality.
9.3
Functional Cookies. Used to remember your preferences, language settings, and dashboard configuration across sessions.
9.4
Analytics Cookies. Where applicable, we may use analytics tools to understand how the platform is used. This data is aggregated and does not identify individual users.
9.5
You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect platform functionality.
10
Third-Party Services & Links
10.1
CreativeXpos integrates with third-party services including payment gateways, SMS providers, email delivery services, and hosting platforms. These services have their own privacy policies, and we encourage you to review them.
10.2
CreativeXpos is not responsible for the privacy practices or content of third-party services, websites, or applications linked to or integrated with the platform.
10.3
When you connect a third-party service to CreativeXpos (e.g., a payment gateway), you authorize the necessary data exchange required to operate that integration.
10.4
The CreativeXpos online storefront may be accessed by your end customers. Their interactions are subject to your privacy notice as the restaurant operator and to CreativeXpos's handling of transactional data as described in this policy.
11
Your Rights
Subject to applicable law, you have the following rights regarding your personal data:
Your Data Rights
Access: Request a copy of personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data where no legal basis exists to retain it.
Restriction: Request that we restrict processing in certain circumstances.
Portability: Receive your data in a structured, machine-readable format where applicable.
Objection: Object to processing based on legitimate interests or for direct marketing.
Withdraw Consent: Where processing is based on consent, withdraw it at any time.
Complaint: Lodge a complaint with the applicable data protection authority.
11.1
To exercise any of these rights, contact us using the details in Section 15. We will respond within a reasonable timeframe as required by applicable law.
11.2
Where rights are subject to limitations or exceptions under applicable law, we will explain those limitations in our response.
11.3
Exercising your rights will not result in any penalty or reduction in the quality of our Services, subject to the necessary impact of the requested action.
12
Children's Privacy
12.1
The CreativeXpos platform is intended for use by businesses and adults aged 18 or older. We do not knowingly collect personal data from children under the age of 18.
12.2
If you believe a child has provided personal data to CreativeXpos without parental consent, contact us immediately at the details in Section 15 and we will take appropriate steps to delete such data.
13
Cross-Border Data Transfers
13.1
CreativeXpos operates primarily in Pakistan. Your data may be stored and processed on servers located in Pakistan or in the jurisdiction of our hosting providers.
13.2
Where data is transferred to or processed in a jurisdiction outside your own, we take reasonable steps to ensure appropriate protections are in place in accordance with applicable law.
13.3
By using our Services, you acknowledge and consent to the transfer and processing of your data as described in this policy, subject to applicable legal requirements in your jurisdiction.
14
Changes to This Privacy Policy
14.1
CreativeXpos may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.
14.2
Updated policies will be published on the CreativeXpos website with a revised Last Updated date. Material changes that affect how we use your personal data will be communicated to registered users in advance where reasonably practicable.
14.3
Continued use of the Services after the effective date of a revised policy constitutes acceptance of the updated policy, where permitted by applicable law.
14.4
We encourage you to review this policy periodically. The current version is always available at creativexpos.com/privacy.
15
Contact Us
Privacy & Data Enquiries
For privacy requests, data subject rights, concerns about data handling, or any questions about this policy, contact us through any of the channels below.
Website
Phone / WhatsApp
WhatsApp
Our Privacy Commitment
- We collect only the data necessary to operate and improve our Services.
- We never sell, rent, or trade your personal or business data.
- We protect your data with industry-standard security measures.
- We give you meaningful control over your data.
- We are transparent about how we use your information.
- We respond to privacy requests promptly and respectfully.
CreativeXpos — All Rights Reserved.