ZakiPOS Privacy Policy

1. Who is responsible for your data

The business that uses ZakiPOS (the "merchant") decides what it records about its own customers and staff. The merchant is responsible for that data, and OverZaki processes it on the merchant's behalf and on its instructions.

OverZaki is responsible for the data we use to run, secure and support ZakiPOS itself, such as sign-in data and technical logs.

If you are a customer of a business that uses ZakiPOS and have a question about your data, please contact that business first. We will help them answer you.

2. Data we collect and process

• Account and staff data: name, email address, phone number (if given), role and permissions, the business and branches you work for, and your cashier PIN. PINs are stored only as a one-way hash, never in readable form.
• Shift and cash records: when tills open and close, clock-in and clock-out times, cash counts, pay-ins and pay-outs, and who performed each action.
• Business data: the menu and products, prices, taxes and charges, discounts, tables and sections, branches, devices, printers, inventory and settings.
• Orders and payments: items, notes, order type, table, totals, discounts, tips, the payment method and amount, refunds and voids, and the reports built from them. ZakiPOS does not read, store or send full payment card numbers: card payments are made on the merchant's card terminal or on the page of a licensed payment provider, and we receive only the result, the amount and a reference.
• Customer data entered by the merchant: when staff add a customer to an order, the customer's name, phone number, delivery address, order history, loyalty points, and gift card and house account balances.
• Device and technical data: the device's name and the till it is registered as, app version, operating system, language, IP address, and the request and error logs our servers keep to run the service and keep it secure.
• Data that stays on your device: the sign-in token (kept in the device's secure storage), sales recorded while the device is offline (until they are sent to our servers), printer addresses on your local network, and the app's settings.

3. Device permissions

• Camera: used only to scan a QR code, such as a customer's loyalty code. The picture is read on the device; it is not saved or sent to us.
• Local network: used to find the receipt and kitchen printers on your network and print to them. Printer addresses stay on the device.

ZakiPOS does not use your location, contacts, photos or microphone, and it does not track you across other companies' apps or websites.

4. How we use data

• To provide ZakiPOS: signing in, taking orders and sending them to the kitchen, printing, taking payments, keeping tills and every device in sync with the OverZaki dashboard, and producing reports.
• To keep the service secure: verifying users and devices, preventing fraud and misuse, and investigating problems.
• To support you when you contact us, and to send service messages such as security notices and important changes.
• To improve ZakiPOS, using aggregated statistics that do not identify you.
• To meet legal obligations, such as accounting and tax rules.

We do not sell personal data and do not use it for advertising. ZakiPOS shows no ads and contains no third-party analytics.

5. Legal bases

Where data-protection law requires a legal basis, we rely on performing our contract with the merchant, our legitimate interest in running and securing the service, compliance with legal obligations, and consent where the law requires it (for example, camera access, which you can withdraw in your device's settings).

6. Who we share data with

• The merchant and the staff they authorize, according to the roles and permissions the merchant sets.
• Service providers that host and run ZakiPOS for us, such as cloud hosting and database providers, content delivery networks, the service that delivers app updates, and customer-support tools. They may use the data only to provide their services to us.
• Payment, delivery and messaging providers that the merchant chooses to connect to their account, to the extent needed for that service.
• Authorities, when the law requires it, or to protect the rights, property or safety of OverZaki, our users or others.
• A successor, if OverZaki is involved in a merger, acquisition or sale of assets, under this policy.

We never sell personal data.

7. International transfers

Our servers and service providers may be located outside your country, including in the European Union and the United States. When data is transferred, we use providers that protect it with security measures and contractual commitments.

8. How long we keep data

• We keep a merchant's data for as long as their OverZaki account is active, so the business can see its history and reports.
• When an account or a staff member is deleted, we delete or anonymize the related personal data within 30 days. Copies in our backups are removed within 90 days.
• We keep some records longer when the law requires it, such as sales and tax records, and only for as long as required.

9. Security

We protect data with encryption in transit (HTTPS), access controls by role, one-way hashed PINs and passwords, sign-in tokens kept in the device's secure storage, and monitoring of our systems. No system is perfectly secure. If we learn of a breach that affects your data, we will tell the merchant and, where the law requires, you and the authorities.

10. Your rights and choices

• Depending on where you live, you can ask to access, correct, export or delete your personal data, or to restrict or object to its use.
• Staff can see and correct their details through their business. Business owners manage staff, customers and data in the OverZaki dashboard.
• To make a request, email dev@overzaki.com from your account's email address. We answer within 30 days. Customers of a business should contact that business first.
• You can also complain to the data-protection authority where you live.

11. Deleting your account

To delete your OverZaki account or a staff account and the data that goes with it, follow the steps at www.overzaki.com/zakipos/delete-account.

12. Children

ZakiPOS is a business tool for merchants and their staff. It is not directed to children, and we do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when ZakiPOS changes or the law requires it. We will post the new version on this page with its date, and tell merchants about important changes by email or in the dashboard.

14. Contact us

Over Zaki Information Technology, Salmiya, Kuwait. Email: dev@overzaki.com. Phone and WhatsApp: +965 2228 9957.