Privacy Policy

1. Introduction

OndyPOS (we, our, or us) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our point-of-sale and inventory management service (the Service).

By using our Service, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

2.2 Information Collected Automatically

When you access our Service, we automatically collect certain information:

• Log Data: IP address, browser type, pages visited, time and date of access
• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features used, actions taken within the Service

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To provide, maintain, and improve our point-of-sale and inventory management services
• Account Management: To create and manage your account, process subscriptions, and provide customer support
• Communication: To send service-related notifications, respond to inquiries, and provide updates about the Service
• Security: To detect, prevent, and address technical issues, fraud, and unauthorized access
• Analytics: To understand how users interact with our Service and make improvements
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

We may share your information with third-party service providers who perform services on our behalf:

• Cloud Infrastructure: Amazon Web Services (AWS) for hosting and data storage
• Email Services: AWS Simple Email Service for transactional emails

4.2 Legal Requirements

We may disclose your information when required by law or in response to:

• Valid legal processes (court orders, subpoenas)
• Requests from Namibian law enforcement agencies
• Protection of our legal rights or the safety of others

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

4.4 What We Do NOT Do

We do not:

• Sell your personal information to third parties
• Share your business data with competitors
• Use your data for targeted advertising
• Store credit card numbers or sensitive payment card data

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption
• Access Controls: Role-based access controls limit who can view your data
• Password Security: Passwords are hashed using bcrypt; we never store plaintext passwords
• Infrastructure Security: Our servers are hosted in secure AWS data centers with physical and network security controls
• Regular Monitoring: We monitor our systems for security incidents and unauthorized access attempts

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes described in this policy:

• Active Accounts: Data is retained for the duration of your subscription
• After Cancellation: Data is retained for 30 days after account cancellation to allow for reactivation
• Backups: Backup copies may be retained for up to 90 days for disaster recovery purposes
• Legal Requirements: Some data may be retained longer if required by Namibian law or for legitimate business purposes

7. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Data Portability: Request an export of your business data in a common format
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis

To exercise these rights, please contact us at support@ondypos.com. We will respond to your request within 30 days.

8. Cookies and Tracking

Our Service uses minimal cookies and similar technologies:

• Essential Cookies: Required for authentication and session management
• Security Cookies: Used to prevent cross-site request forgery and protect your account

We do not use cookies for advertising or third-party tracking purposes.

9. Children's Privacy

Our Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

10. International Data Transfers

Your data is stored in AWS data centers. While our primary operations are in Namibia, your data may be processed in data centers located in other regions (such as Cape Town, South Africa) for performance and redundancy purposes. We ensure appropriate safeguards are in place to protect your data regardless of where it is processed.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the Last Updated date
• Sending an email notification for material changes

Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Information