Privacy policy
Draft. Highlighted items are placeholders. Have this reviewed by a lawyer before the site goes live.
Who we are
[Company legal name], [Registered address], provides PosStop. For questions about this policy or your data, contact [privacy@pos-stop.com].
Two roles
- When you contact us or hold a PosStop account, we decide how your data is used. We are the data controller.
- When a venue uses PosStop, it stores data about its staff and customers in PosStop. The venue is the controller and we process that data on its behalf, under our agreement with the venue. If you're a customer or staff member of a venue, contact the venue about your data.
What we collect
| From | What | Why |
|---|---|---|
| Demo requests | Name, venue name, type of venue, phone or WhatsApp number, anything you tell us | To contact you about PosStop |
| Portal accounts | Name, email address, role, login activity | To give you access and keep accounts secure |
| Venue staff (for the venue) | Name, role, PIN (stored securely), sales and actions taken in PosStop, pay details the venue enters | To run tills, permissions, audit logs and pay runs for the venue |
| Venue customers (for the venue) | Booking requests, receipt email addresses, feedback | To handle bookings, send receipts and pass on feedback |
| Website visits | Basic server logs (IP address, browser, pages requested) | To keep the site secure and working |
Legal basis
We process personal data to provide the service you signed up for (contract), to keep the service secure and improve it (legitimate interests), and where the law requires it (legal obligation). Where we rely on consent, you can withdraw it at any time.
Who we share it with
- Microsoft Azure: hosting and database, [region]
- Resend: sending emails such as reports and receipts
- Google Fonts: loads the fonts on this website [remove if fonts are self-hosted]
- [Any others, e.g. payment providers, SMS]
We don't sell personal data.
International transfers
Data may be stored or processed outside the country where it was collected. Where it is, we use safeguards required by law, such as standard contractual clauses. [Confirm hosting region and transfer basis.]
How long we keep it
- Demo requests: [12 months] unless you become a customer
- Venue data: for the length of the subscription, then [30] days for export, then deleted
- Financial records: as long as tax law requires [6 years]
Your rights
Depending on where you live, including under the Nigeria Data Protection Act 2023 and UK GDPR, you can ask to see, correct, delete, restrict or move your data, and object to how we use it. Contact [privacy@pos-stop.com]; we'll reply within [30] days. You can also complain to the Nigeria Data Protection Commission or the UK Information Commissioner's Office.
Security
Each venue's data is kept separate from other venues' data in our database. Connections are encrypted, staff PINs and passwords are stored securely, and access is limited by role.
Changes
We'll post any changes here and update the date at the top. Significant changes will be emailed to account holders.