1. Introduction
Kipdesky Technology provides business automation solutions including the Kipdesky POS System (the “App”), web dashboard, desktop apps, and related services. This Privacy Policy explains how we collect, use, process, store, disclose, and protect information when you use our products.
By accessing or using our services, you agree to this Privacy Policy.
2. Scope
This policy applies to:
- Mobile POS application
- Web-based POS dashboard
- Desktop apps (where provided)
- Cloud sync and APIs
- Support channels
- Official website pages
3. Information We Collect
3.1 Account information
- Name, email, phone number
- User role and permissions
- Store and outlet identifiers
- Security/session metadata (where enabled)
3.2 Business data
- Sales, orders, invoices and receipts
- Inventory, products, pricing
- Customers and suppliers (as entered by businesses)
- Expenses, purchases, and operational records
3.3 Device & technical data
- Device type, OS version, app version
- Logs (crash/diagnostics where enabled)
- IP address and user agent (for security & auditing where enabled)
4. Data We Process (by Module)
The POS system stores and processes business records. The examples below reflect the data categories represented in the system’s modules and database models.
Identity & Accounts
User and authentication data used to create accounts, control access, and secure sessions.
- Users (first_name, last_name, phone, email, status, role, outlet_id, store_id)
- Auth sessions (refresh token sessions, device/session metadata)
- OTP / verification (hashed OTP codes, expiry, attempts)
- Rate limiting (hashed keys for abuse prevention)
Business Entities
Core business profile information for stores and outlets, used for configuration, reporting, and operations.
- Stores (name, tpin, address, contact, currency, tax settings, logo, links)
- Outlets (name, type, address, location, contact, ZRA branch + device identifiers)
- Settings (store-scoped key/value configuration)
Customers & Suppliers
Contact and classification information for sales, compliance documents, loyalty tiers, and supplier operations.
- Customers (name, code, phone, email, address, membership tier, status, tax_id)
- Suppliers (name, email, phone, type, status, tax_id, bank/account fields)
Catalog & Inventory
Product listings, pricing, and stock tracking across outlets for POS and inventory management.
- Products (name, sku, barcode, status, channel, image, expiry_date, description)
- Product pricing per outlet (purchase_price, selling_price, tax_rate, currency)
- Product inventory per outlet (quantity, reorder_level, last_updated)
- Inventory transfers, transfer items, adjustments (quantities, reasons, timestamps)
Sales, Orders & Payments
Transactional data required to operate POS, generate receipts, and support financial reporting.
- Sales & sale items (bill_no, totals, taxes, discounts, items, quantities, prices)
- Orders & order items (order_number, status, totals, customer reference)
- Payments & payment methods (method configuration and payment references)
- Invoices / receipts / delivery notes / quotations (document numbers, dates, totals)
Finance & Operations
Expenses, other income, transactions, and purchasing workflows to support operational accounting.
- Expenses & receipts (amounts, categories, dates, optional receipt file paths)
- Transactions (direction, status, category, references, timestamps)
- Purchases / imports and purchase items (supplier and totals; sync status)
- Purchase orders and purchase order items (status, totals, expected dates)
Audit, Logs & Monitoring
Security and operational logging for accountability, troubleshooting, and compliance.
- Audit logs (who did what, when, module, table, record, old/new data)
- System logs (level, source, message, environment, optional context JSON)
- Last IP address / user agent (where enabled) for session safety checks
Assets & Uploads
Files and asset-register data used to store product images, receipts, and business assets.
- Uploads (e.g., product images, receipts, documents) stored under secure paths
- Asset register (asset code/name/category, purchase date, status, assigned user)
ZRA / Tax Integrations
Data needed for Smart Invoice compliance and supported tax classifications.
- ZRA branch data (bhf_id, device_serial, sdc_id, mrc_no where applicable)
- Product ZRA metadata (item class, unit codes, origin codes, tax category codes)
- Invoice/receipt signatures and QR metadata returned from VSDC (if enabled)
Notifications & Subscriptions
Service messaging and plan/payment records for subscription-based access.
- Notifications (title, message, channel, priority, read status, expiry)
- Subscriptions (plan, status, dates, amounts)
- Subscription payments (reference, status, callbacks, provider metadata)
- Scheduled reports (recipients, cron, delivery channel)
Uploads & files
Businesses may upload images (e.g., product images), documents (e.g., receipts), or operational files. Access is controlled by authentication and role-based permissions where applicable.
5. Lawful Basis for Processing (GDPR Principles)
Where applicable under data protection regulations, we rely on:
- Performance of a contract (providing the service)
- Legal obligations (e.g., tax compliance)
- Legitimate business interests (security, fraud prevention, service improvement)
- User consent where required
6. ZRA Smart Invoice Compliance
Kipdesky POS may integrate with Zambia Revenue Authority (ZRA) Smart Invoice systems where enabled. For tax compliance, transaction and invoice data required by law may be transmitted to authorized systems.
Once data is transmitted to official tax systems, retention and handling may be governed by applicable regulations.
7. Google Play Data Safety
What we do
- Use secure authentication
- Protect access with permissions and audit logs
- Encrypt data in transit where applicable
- Support offline-first workflows (data syncs when online)
What we don’t do
- We do not sell personal data
- We do not share personal data for advertising
- We do not use personal data to build ad profiles
9. Data Retention
We retain data for as long as required to provide services, comply with legal obligations, and resolve disputes. Businesses control much of the business data they enter and manage in the system.
10. Security Measures
Access controls
- Role-based access control
- Secure password hashing
- Session controls and token rotation (where enabled)
- Account lockouts / rate limiting (where enabled)
Monitoring & audit
- Audit trails for critical actions
- System logs for troubleshooting
- IP/user-agent tracking (where enabled)
- Secure storage practices for uploads
11. User Rights
Subject to applicable law, users may request:
- Access to personal data
- Correction of inaccurate data
- Deletion of data
- Restriction of processing
- Data portability
12. International Transfers
If cloud services are used, data may be processed in secure data centers outside Zambia under appropriate safeguards and contractual protections.
13. Children’s Privacy
Kipdesky POS is not directed to children under 13.
14. Changes to This Policy
We may update this Privacy Policy periodically. Updates will be published on this page and reflected in the “Last Updated” date.
15. Contact
Kipdesky Technology
Solwezi, North-Western Province, Zambia
Email: [email protected]
Website: https://www.kipdesky.com