In a busy takeaway the card side of things feels like someone else's problem, and mostly it should be. The goal for a small kitchen is simple to state: let the card data pass through equipment you do not own and cannot see into, so that if anything goes wrong the exposure is not sitting in your till, your tablet or your notebook. The trouble starts when card numbers end up somewhere they were never meant to live.

The safe path is the card reader. When a customer taps or inserts at a proper terminal from your payment provider, the card details go straight to the bank's systems. Your reader sees a yes or a no, not the number. That is by design, and it is why a standalone reader is the least risky way for a small business to take payment in person. The same is true of a reputable online checkout: the payment page belongs to the provider, not to you.

The danger is the workarounds that creep in when it is busy. Taking a card number over the phone and writing it on an order pad. Letting a delivery platform or a staff member key numbers into a personal device. Keeping a note of a regular's card “to save time”. Every one of these pulls card data into your world, where you now have to protect it, and where losing it is your liability and your reputation, not the bank's.

There is also the human angle at the counter. A card reader turned so the keypad faces away from the queue, and staff who never ask a customer to read their card number aloud, close off the simplest kind of theft. None of this needs new technology. It needs a rule that card numbers only ever go into the reader or the provider's checkout, and never onto paper or a phone.

If you take card details by phone even occasionally, that is the one workflow worth a proper look, because it is the point where a small kitchen quietly takes on obligations it did not mean to. Your payment provider can almost always offer a pay-by-link or a phone-friendly terminal that keeps you out of it entirely.