Privacy policy of PosXT

This policy applies to the posxt.com site, the app.posxt.com owner dashboard, the demonstration till and the PosXT Caisse software. It supplements the terms of use and is based on Law No. 2008-12 of 25 January 2008 on the protection of personal data and its implementing Decree No. 2008-721. The French version is the reference text.

1. Controller

For your business’s account data (owner, staff with online access, billing), the controller is [company name], [legal form], with its registered office at [registered office address] (“PosXT”). Its legal details are given in the legal notice.

This processing falls under the Personal Data Protection Commission (Commission de protection des données personnelles, CDP). Its declaration is being prepared; the receipt number will be given here: [CDP receipt number].

For any question: support@posxt.com.

2. Data collected and purposes

We collect only what is needed to provide and protect the service. We do not sell, rent or use any data for advertising.

• First contact and account opening: your name, your business’s name, your e-mail address, your phone number and your messages. Purposes: to answer your request, prepare the proposal and open the account. There is no online sign-up.
• Owner account and online staff accounts: name, e-mail address, password hash (never in plain text), two-factor authentication secret, recovery codes (as hashes), sessions and activity log. Purposes: to identify you, protect access and keep a record of changes.
• Subscription and billing: business, NINEA and RCCM, plan, amounts, invoices and payments. Purposes: to bill the service and meet our accounting and tax obligations.
• Support: your messages, and a till diagnostic report if the owner or a manager agrees to send it. Names, phone numbers, e-mail addresses, codes and IP addresses are removed from it before it is sent.
• Technical logs: IP address, address requested, date and browser. Purposes: security of the service and resolving incidents.
• Service e-mails: your e-mail address and name, to send you verification codes and your business’s alerts.

This processing is necessary for the performance of our contract (account, billing, support, service e-mails), to meet our legal obligations (accounting) and for the security of the service (technical logs).

3. Your customers’ and staff’s data

The data you enter in the till (customers, credit book, staff, suppliers, sales) belongs to your business. For this data, you are the controller and PosXT acts as processor: we process it solely to provide the service, on your instructions, and access it for support only with the owner’s agreement. The formalities with the CDP for this processing (declaration and request for authorisation of the transfer outside Senegal) fall to you; we provide the information you need.

• A customer’s phone number is recorded only with their consent, and withdrawing consent erases it.
• For a Wave, Orange Money or Free Money payment, the till records no personal data about the payer: only the transaction reference, the amount and the operator.
• The till lets you export, correct or anonymise a customer’s record at their request. Anonymisation erases their identity but keeps the accounting records, which the law requires to be kept.
• The till’s data is encrypted on the shop computer, with a key held in the system keychain. The data needed for the owner dashboard and for sharing between tills is sent to the PosXT cloud: sales, products, stock, staff names and roles, and credit book records (the customer’s name, and their phone number if they have consented).

4. Retention periods

• Contact requests that go no further: [period].
• Account and business data in the cloud: while the account is open, then [period] after the subscription ends, to let you export your data; it is then deleted.
• Subscription invoices and payments: [statutory retention period for accounting records].
• Diagnostic reports: 30 days.
• Technical logs: [period].
• Cloud backups: daily; the copy on the server is kept for 14 days, the off-server copy for 30 days, then erased by the 35th day at the latest.

5. Recipients and transfers outside Senegal

The data is accessible to authorised PosXT staff, each only as far as their role requires. We use these providers:

• DigitalOcean: hosting of the PosXT cloud server and database, and storage of product photos (DigitalOcean Spaces), in Frankfurt (Germany, European Union).
• Cloudflare: domain name, protection and encryption of connections, delivery of the posxt.com site (Cloudflare Pages), sending of service e-mails from the mail.posxt.com domain (Cloudflare Email), and storage of backup copies, encrypted before they are sent and unreadable by Cloudflare. Its servers are spread around the world.

Synchronised data therefore leaves Senegal: it is hosted in Germany and passes through Cloudflare’s network. This transfer is safeguarded by the encryption of all connections, access limited to authorised PosXT staff and the security and confidentiality commitments made by these providers. It is part of the file submitted to the CDP, which must authorise transfers of data to a third country. The till’s data also stays on the shop computer, in Senegal.

6. Security

• Encrypted connections (HTTPS) on all our sites and between the till and the cloud.
• Mandatory two-factor authentication for the owner and managers.
• Till database encrypted on disk, with a key held in the system keychain.
• Passwords, PIN codes and recovery codes stored as hashes, never in plain text.
• Audit log: every sensitive action leaves a trace.
• A PosXT cloud kept separate from any other service, with its own server, database and backups.

7. Cookies and audience measurement

The posxt.com site uses no audience measurement tool and no tracking cookie.

The app.posxt.com owner dashboard uses only the cookies and browser storage needed to keep you signed in.

8. Your rights

Law No. 2008-12 gives you the right to access your data, have it rectified or deleted, and object to its processing on legitimate grounds. Write to us at support@posxt.com; we reply within [time limit]. If you are a customer of a business that uses PosXT, contact that business first: it is responsible for your data, and we help it to reply.

You can also complain to the Personal Data Protection Commission: www.cdp.sn.

9. Changes to this policy

We update this policy when our processing changes. The version date is shown at the top of the page; a significant change is announced by e-mail or in the owner dashboard.