Privacy Policy

Qiki — a trading name of Miamedia Pty Ltd · ABN 58 164 622 806
Last updated: 1 November 2026

1. Introduction

Qiki (operated by Miamedia Pty Ltd, ABN 58 164 622 806, trading as Qiki) provides merchant services including EFTPOS terminals, point-of-sale (POS) systems, tap-to-pay solutions, payment gateways, QR ordering, online ordering, table reservation tools, and the QBR rewards program. We are based in Melbourne, Australia.

We are committed to protecting the privacy of the personal information we collect and handle. This Privacy Policy explains how we collect, use, disclose, store, and otherwise handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy covers information we collect from:

• Merchants — business owners, operators, and staff who use Qiki products and services.
• End consumers — individuals who purchase goods or services from merchants using Qiki-powered POS, ordering, or payment systems.
• Website visitors — anyone who visits qiki.com.au or interacts with our online services.
• Prospective merchants and enquirers — individuals who contact us or express interest in our products.

By using our services or visiting our website, you acknowledge that you have read and understood this Privacy Policy.

2. What Personal Information We Collect

The types of personal information we collect depend on your relationship with us.

Merchant Information

When a merchant signs up for or uses Qiki services, we may collect:

• Business details — business name, ABN/ACN, trading name, business type, registered address, and trading address.
• Contact information — name, email address, phone number, and position/title of business owners, directors, and key contacts.
• Identity verification — date of birth, government-issued identification documents (e.g. driver’s licence, passport), and related verification data as required by law.
• Financial information — bank account details (BSB and account number) for settlement and direct debit billing, billing history, and payment records.
• Transaction data — sales volumes, transaction records, product and menu data, refund history, and terminal activity.
• Technical data — POS terminal identifiers, software version information, device logs, and connectivity data.
• QBR rewards data — enrolment details, points accrued, and redemption history relating to our QBR flight reward points program.

End-Consumer Information

When an end consumer makes a purchase from a Qiki-powered merchant, or uses QR ordering, online ordering, or table reservation features, we may collect:

• Order and transaction details — items purchased, order value, date and time, payment method (card type), and order preferences.
• Contact details — name, email address, and phone number (where provided for online ordering, table reservations, or digital receipts).
• Delivery information — delivery address (where applicable for online orders).
• Payment card data — limited card information as described in Section 7. We do not store full card numbers.

Website Visitor Information

When you visit qiki.com.au, we may collect:

• Technical data — IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
• Usage data — pages viewed, time spent on pages, click interactions, and navigation paths.
• Cookies and tracking data — as described in Section 8.
• Enquiry data — name, email, phone number, business name, and the content of any message submitted through contact forms.

3. How We Collect Personal Information

We collect personal information through the following means:

• Directly from you — when you sign up for our services, complete application forms, contact us by phone, email, or through our website, or interact with our POS systems and ordering platforms.
• From merchants — when end consumers place orders or make purchases through Qiki-powered systems, the relevant transaction and order data is processed through our platform.
• From third parties — including payment processing partners, credit reporting bodies, identity verification services, and referral partners, where necessary to provide our services or comply with legal obligations.
• Automatically — through cookies, analytics tools, and server logs when you visit our website or use our online services.

Where practicable, we collect personal information directly from the individual concerned. We will not collect personal information unless it is reasonably necessary for, or directly related to, one or more of our functions or activities.

4. How We Use Personal Information

Providing and Managing Our Services

• Processing merchant applications and onboarding.
• Setting up and managing POS terminals, payment gateways, and related hardware and software.
• Processing payments, settlements, and direct debit billing.
• Facilitating QR ordering, online ordering, and table reservations.
• Administering the QBR rewards program, including tracking and redeeming flight reward points.
• Providing 24/7 Australian-based technical support and customer service.

Business Operations

• Maintaining accurate merchant and transaction records.
• Generating aggregated, de-identified reporting and analytics to help merchants understand their business performance.
• Managing billing, invoicing, and accounts receivable.
• Improving our products, services, and user experience.
• Internal training, quality assurance, and service development.

Communication

• Responding to enquiries, support requests, and complaints.
• Sending service-related communications, including updates, maintenance notices, and security alerts.
• Providing merchants with information about new features, products, or services that may be relevant to their business (with the ability to opt out at any time).

Legal and Regulatory Compliance

• Complying with applicable laws, regulations, and industry standards, including anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Fulfilling identity verification and know-your-customer (KYC) requirements.
• Responding to lawful requests from regulatory bodies, law enforcement agencies, and courts.

What We Do Not Do

• We do not market to a merchant’s end consumers on behalf of ourselves or other merchants.
• We do not sell personal information to third parties.

5. Data Ownership

• Transaction data, customer data, and product/menu data generated through Qiki services is jointly owned by Qiki and the relevant merchant.
• Merchants retain full access to their own data and may export it at any time.
• Qiki may use aggregated, de-identified data for analytics, product improvement, and industry benchmarking. This data does not identify individual merchants or their customers.
• Qiki does not use jointly held data to market to a merchant’s customers, nor share one merchant’s customer data with another merchant.

6. Disclosure of Personal Information

We may disclose personal information to the following categories of recipients:

• Payment processing partners — for the purpose of processing transactions, settlements, and related payment services.
• Financial institutions — banks and payment networks involved in processing transactions and direct debit arrangements.
• Identity verification and fraud prevention providers — for KYC checks, credit assessments, and fraud detection.
• IT and cloud service providers — who host, maintain, or support our systems and infrastructure, subject to appropriate contractual protections.
• Professional advisers — including accountants, auditors, and legal advisers, where necessary.
• Regulatory bodies and law enforcement — where required or authorised by law, including AUSTRAC, ASIC, and law enforcement agencies.
• Related entities — any related bodies corporate of Miamedia Pty Ltd, for the purposes described in this policy.

We take reasonable steps to ensure that third-party recipients of personal information are bound by obligations of confidentiality and handle personal information in accordance with the APPs.

Overseas Disclosure

Some of our IT and cloud service providers may store or process data in locations outside Australia. Where this occurs, we take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the APPs. Countries where data may be processed include the United States (cloud hosting services). We will update this section if our overseas data processing arrangements change materially.

7. Payment Data and PCI DSS Compliance

Qiki takes the security of payment data seriously. We comply with the Payment Card Industry Data Security Standard (PCI DSS).

• No storage of full card numbers — our systems are designed so that full primary account numbers (PANs), CVVs, and PINs are not stored on our servers. Payment card data is handled by PCI DSS-certified payment processing partners.
• Encryption — all payment data transmitted between Qiki terminals, systems, and payment processors is encrypted using industry-standard protocols (TLS 1.2 or higher).
• Tokenisation — where card-on-file functionality is used, card data is replaced with secure tokens.
• Access controls — access to systems that interact with payment data is restricted to authorised personnel and subject to multi-factor authentication.
• Regular assessments — we undergo regular PCI DSS compliance assessments and vulnerability scans.

8. Cookies and Analytics

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help us understand how visitors use our site and improve the user experience.

Cookies We Use

Google Analytics

We use Google Analytics to collect anonymised data about website usage. Google’s ability to use and share information collected by Google Analytics is governed by the Google Analytics Terms of Service and the Google Privacy Policy. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

Managing Cookies

You can control and manage cookies through your browser settings. Blocking or deleting cookies may affect the functionality of our website.

9. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure:

• Technical safeguards — encryption of data in transit and at rest, firewalls, intrusion detection systems, and regular security patching.
• Access controls — role-based access, multi-factor authentication, and the principle of least privilege.
• Physical security — secure facilities with controlled access.
• Staff training — regular privacy and security awareness training.
• Incident response — documented data breach response procedures in line with the Notifiable Data Breaches (NDB) scheme.
• Vendor management — due diligence and contractual safeguards for third-party service providers.

We retain personal information only for as long as it is needed for the purposes for which it was collected, or as required by law.

10. Access to and Correction of Personal Information

Under the APPs, you have the right to access and correct the personal information we hold about you.

To make a request, contact us at [email protected]. We will respond within 30 days and may need to verify your identity.

Merchants can access much of their data directly through the Qiki POS dashboard and merchant portal.

If you are an end consumer who has interacted with a Qiki-powered merchant, please contact us at [email protected]. In some cases, we may direct you to the relevant merchant.

In limited circumstances, we may refuse access where permitted or required by law. If we refuse, we will provide written reasons.

11. Direct Debit Billing

Where merchants authorise direct debit billing:

• We collect bank account details (BSB and account number) for processing direct debit payments.
• Direct debit arrangements are managed in accordance with the Bulk Electronic Clearing System (BECS) procedures.
• Bank account details are stored securely and not used for any purpose other than processing authorised payments.
• Merchants may cancel or modify their direct debit arrangement by contacting us at any time.

12. QBR Rewards Program

The QBR rewards program allows eligible merchants to earn flight reward points based on their processing activity.

• We collect and use transaction volume data to calculate QBR points.
• Personal information associated with the QBR program is handled in accordance with this Privacy Policy.
• QBR program terms and conditions are provided separately at the time of enrolment.

13. Children’s Privacy

Our services are directed at businesses and adults. We do not knowingly collect personal information from children under the age of 16. If we become aware that we have collected such information, we will take reasonable steps to delete it promptly.

14. Notifiable Data Breaches

In the event of an eligible data breach (as defined under Part IIIC of the Privacy Act 1988), we will:

• Take immediate steps to contain the breach and mitigate any harm.
• Assess whether the breach is likely to result in serious harm.
• If serious harm is likely, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

15. Complaints

If you believe we have handled your personal information inappropriately, please contact our Privacy Officer:

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and notify merchants via email or the Qiki merchant portal. Your continued use of our services after any changes constitutes acceptance of the updated policy.

17. Contact Us

If you have any questions about this Privacy Policy or wish to make a privacy-related request: