System Selection
Part of POS customer records
Collecting customer details without slowing a sale
A short checkout process for asking for needed customer details, finding existing profiles and recording marketing choices separately.
Ask for a detail only when it helps complete the sale or an explained follow-up. Search for an existing profile, collect the smallest useful set of fields and keep an optional request optional. Ask about marketing separately.
Key privacy and process stats for Australian small businesses
- APP 3: Collection of personal information
- Only what is reasonably necessary for functions or activities
- Marketing consent requirement
- Must be explicit and separate from transaction data
- Small business guidance
- OAIC provides tailored privacy advice for small organisations
- POS system support
- Shopify and Square both support customer management in checkout workflows
Prepare the question
Identify checkout tasks that need a named customer, such as delivery, a booking or a repair update. Specify the fields each task needs and a short explanation staff can give. A delivery address should not become a default request for every counter sale.
For a repair, staff might ask: “Would you like us to save a contact number so we can update you about this job?” Confirm the number with the customer. If the customer declines and an approved alternative works, use it. If contact details are essential to fulfil the service, explain that before payment.
For an APP entity that is an organisation, APP 3 limits collection of personal information to what is reasonably necessary for the organisation’s functions or activities. Sensitive information has additional consent requirements.
Search, confirm and attach
Search using a detail the customer offers. Check enough information to select the right profile without reading another person’s private details aloud. A shared surname or phone number warrants care. If no reliable match exists, create a record with only the details needed now.
Square documents adding a customer during checkout or after a sale; its POS checkout path requires customer management to be enabled. Shopify POS lets staff find an existing customer or create one from the cart. Write the counter procedure for the account, device and staff permissions actually in use.
Keep optional collection out of the payment bottleneck
If the customer wants to pay and leave, use an available checkout path and offer an after-sale step only if the customer still wants it. Avoid collecting details on an unsecured note for later entry.
Shopify’s customer-detail setting can be Recommended, which staff may skip, or Required, which prevents checkout if the customer declines. Check whether another cart feature, such as shipping, independently needs customer details. A blanket Required setting is a poor fit for a request that is optional in ordinary sales.
Shopify POS vs Square POS: Customer detail collection
- Customer detail requirementShopify: Can be set as Recommended (skip) or Required (block checkout)
- Marketing consent handlingSquare: Manual entry of email auto-opts in; but explicit consent must be recorded separately.
- Profile creation during checkoutBoth platforms allow creating or finding customers mid-checkout. Requires POS settings to be enabled.
- Privacy complianceBoth comply with APP 3 (Australian Privacy Principles) – only collect what is reasonably necessary.
Record marketing permission separately
Keep a receipt or repair-update address separate from a marketing choice. Square says customers need to have explicitly consented before receiving Square Marketing emails, and records customers who do so in its Subscribed customer group.
Square lets staff edit marketing preferences in its POS. Its Australian customer-creation page says manually entering an email automatically opts the customer into email marketing, while its collection page says explicit permission should be separately recorded.
Because those statements conflict, check the actual account behaviour and preserve the customer’s choice independently of the displayed status. Staff should use a control only after its wording and permissions have been checked.
Refer uncertain identity or marketing permission to an authorised person.
