Privacy Policy

1. Who we are

LimaPOS (the "Service") is owned and operated by Dexlab Technologies Ltd, company registration number PVT-PJUE8VZ ("we", "us"). This policy covers the LimaPOS website, the LimaPOS web app and the people who use them. Our separate LimaPOS Tours app has its own privacy policy.

2. Our role and yours

For your account, your subscription and your use of our website, we decide how personal data is used, so we are the data controller.

For the records your business keeps in LimaPOS about its own customers, guests, suppliers and staff, your business decides what is collected and why. Your business is the controller of those records, and we process them on its behalf as a data processor, only to run the Service for it. If you are a customer of a business that uses LimaPOS, please contact that business about your data.

3. Data we collect

When you create and use an account

• Your name, email address and phone number, your business name and business type, and your reporting currency.
• Your password, stored only as a one-way hash that no one can read.
• Your role (for example manager, branch admin or cashier) and branch, and, if you turn on two-factor sign-in, the secret used to check your authenticator codes.
• If you sign in with Google, the name and email address Google shares with us. We don't receive your Google password.

Business records you enter

• Products, prices, stock levels and any product images you upload.
• Sales, receipts, refunds and payments, including the phone numbers and M-Pesa transaction codes used for M-Pesa payments.
• Customer records you choose to keep, such as names, phone numbers, email addresses, loyalty points, purchase history and amounts owed.
• Supplier records, purchase orders, staff accounts, shifts and cash-ups, and accounting records.
• For restaurants, bars and hotels: orders, table and tab names, guest and room booking details, and notes your staff add, which can include a guest's food allergies.

Allergy notes are health information. Only record what your staff need to serve the guest safely.

Subscription payments

When you pay for a plan, the payment is handled by the provider you choose: M-Pesa (Safaricom), Paystack or IntaSend. We receive the payment result, a reference and, for M-Pesa, the phone number used. We never receive or store card numbers.

When you visit our website

• Contact form: your name, email address, subject and message, which reach our support inbox.
• Visit counts: we count visits to our public pages without cookies and without storing your IP address, browser details or location. A visitor is represented by a scrambled code that cannot be turned back into who you are.
• Referral links: if you arrive through a partner's referral link, we set a cookie that records the partner's code (see Cookies).
• Currency for pricing: we show and charge subscription prices in Kenyan shillings in Kenya and in US dollars elsewhere. To tell which, our server uses the country our network provider attaches to your visit or, when there isn't one, sends your IP address to an IP lookup service (ipapi.co), which returns only a country code. We keep that country code in your session for the rest of your visit so every page shows the same prices. We don't store it with your account or keep the IP address.

Records the Service keeps automatically

• An audit log of sensitive actions in your account, such as voids, refunds, password resets and permission changes, with the user and the time.
• Standard server logs created when the Service is accessed, which include IP addresses, used to keep it running securely and to diagnose faults.

We don't run advertising, we don't build marketing profiles, and we don't sell personal data.

4. How we use data

• To create and run your account, sign you in and keep it secure.
• To provide the Service's features: selling, stock, customers and loyalty, reports, accounting and integrations.
• To bill your subscription and keep records of payments.
• To send messages the Service needs, such as email verification, password resets and the alerts you switch on.
• To answer your questions and support requests.
• To detect and prevent unauthorised access, abuse and fraud.
• To maintain, troubleshoot and improve the Service.
• To meet our legal obligations, including tax and accounting record-keeping.

Data from one business account is never used to provide the Service to another.

5. Legal basis

We process personal data because it is necessary to provide the Service under our contract with you, because we have a legitimate interest in running a secure and reliable service (for example security logs and fraud prevention), because the law requires it (for example financial records), or because you have given consent (for example when you choose to sign in with Google). Where we rely on consent, you can withdraw it at any time.

6. Who we share data with

We share data only with these parties, and only as far as each one needs:

• Hosting and infrastructure providers that run our servers and database.
• Email delivery providers that send our emails: Amazon Simple Email Service, or the email server or provider (such as Brevo or SendGrid) we have configured.
• Payment providers: Safaricom (M-Pesa), Paystack and IntaSend, for subscription payments, and Safaricom for the M-Pesa prompts your till sends to your own Till or Paybill.
• Google, if you choose to sign in with Google, and Google Fonts, which serves the fonts our pages use (your browser requests them directly, so Google receives your IP address).
• ipapi.co, for the pricing currency lookup described above.
• Places your business sends data to. If you set up a webhook, the read-only API or an export, the data goes where your business directs.
• Referral partners. If you signed up through a partner's link, that partner can see that a referral was made and the commission it earned.
• Authorities, where the law, a court order or a valid legal request requires it, or where disclosure is needed to protect people's safety or the security of the Service.
• A buyer or successor, if the business is sold or merged, with this policy continuing to apply.

7. International transfers

Some of the providers above may store or process data outside Kenya. Where that happens, we choose established providers and take steps intended to meet the requirements of applicable data protection law for cross-border transfers.

8. How long we keep data

We keep account and business data for as long as your account is active. After an account closes, we keep data only for as long as we need it for the purposes in this policy or to meet legal, tax and accounting obligations, and then delete or anonymise it. Backup copies are kept on a rolling cycle and are overwritten over time. You can ask us to delete your account and its data at any time (see Your rights).

9. How we protect data

• Each business's records carry its business identifier and every query is limited to it, so one business cannot read another's data. Staff can be limited to their own branch.
• Passwords are stored as one-way bcrypt hashes. Two-factor sign-in with an authenticator app is available, and a business can require it for all its staff.
• The Service is served over HTTPS. Session cookies are HttpOnly and Secure, sign-in attempts are rate limited, and every action that changes data is protected against cross-site request forgery.
• Payment provider keys and similar secrets are encrypted before they are stored.
• Sensitive actions are recorded in an audit log, and financial entries are corrected by reversal rather than silently deleted.

No system can be guaranteed completely secure. You can help by using a strong, unique password, turning on two-factor sign-in, and giving staff only the access they need. If you think your account has been accessed without permission, tell us straight away at support@limapos.africa.

10. Your rights

Under Kenya's Data Protection Act, 2019, and similar laws elsewhere, you may have the right to:

• be told how your personal data is used, and get a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted, unless we have to keep it by law;
• object to, or ask us to restrict, certain processing;
• receive data you gave us in a portable format;
• withdraw consent where we rely on it.

You can do much of this yourself. Managers can correct staff names and email addresses on the Staff page, anyone can reset their password from the sign-in page, two-factor sign-in is managed under Account security, and you can correct or remove the records you entered and export your data to CSV or PDF. For anything else, email support@limapos.africa. We may need to confirm your identity before acting on a request. Staff should first contact the owner of their business account, and customers of a business should contact that business.

If you're unhappy with how we've handled your data, please tell us so we can put it right. You can also complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.

11. Cookies and browser storage

We use only the cookies the Service needs. We don't use advertising, analytics or cross-site tracking cookies.

The app also uses your browser's own storage on the device you use: to remember interface choices (such as a folded sidebar or a guided tour you've already seen), and, on a till, to keep a copy of your product list and any sales made while offline until they sync. Clearing your browser data removes these, and can lose offline sales that haven't synced yet.

12. Children

The Service is a business tool and isn't directed at children. Accounts are for people acting for a business.

13. Changes to this policy

We may update this policy. When we do, we change the effective date at the top, and we tell account holders about material changes through the Service or by email where reasonably practicable.

14. Compliance

We comply with GDPR principles, the Consumer Protection Act, 2012, and the Computer Misuse and Cybercrime Act (CMCA), 2018. Our Compliance page explains what we do in practice under each of them.

15. Contact

For privacy questions and requests, email support@limapos.africa.

Dexlab Technologies Ltd, registration number PVT-PJUE8VZ.