Data Processing Terms

1. Roles

For personal data that a business (“you”) records in POSCountr about its own customers, members, subscribers, suppliers and staff (“Business Personal Data”), you are the Data Fiduciary and Aarvin Ventures is your Data Processor under the Digital Personal Data Protection Act, 2023.

2. What we process, and why

• Data: names, phone numbers, email addresses, GSTINs and states on bills and quotations; member and subscriber details; supplier contacts; staff names and attendance.
• Purpose: only to provide POSCountr to you — billing, invoicing, memberships, subscriptions, purchasing, reports, attendance and exports — and to keep it secure.
• Duration: for as long as you use POSCountr, plus any period the law requires records to be kept.

3. Your instructions

We process Business Personal Data only on your documented instructions — which include your use of POSCountr’s features and settings — unless the law requires otherwise, in which case we will tell you unless the law forbids it. We do not sell Business Personal Data or use it for our own marketing.

4. Our people

Only staff who need access to support or operate the Service can reach Business Personal Data, under confidentiality obligations. Support access to a business is read-only, needs a recorded reason and is audit-logged.

5. Security measures

• Database-level separation of each business (PostgreSQL row-level security) plus application-level checks.
• Role-based access: owners, outlet-bound managers, kitchen staff who see no customer details.
• Hashed passwords and PINs, lock-outs, short-lived and revocable sessions.
• Encryption in transit (HTTPS, HSTS), daily backups with tested restores, and an audit trail of sensitive actions.

6. Sub-processors

You authorise us to use the following sub-processors. We bind each to protections no weaker than these terms, and will update this list before adding a new one that processes Business Personal Data.

7. Personal-data breaches

If we become aware of a breach affecting Business Personal Data, we will notify you without undue delay — and aim to within 72 hours — with what we know, and help you meet your obligations to inform the Data Protection Board and affected people.

8. Helping you with requests

We will help you respond to requests from Data Principals to access, correct or erase their data, using POSCountr’s features where possible and our team where not. If we receive such a request directly, we will pass it to you.

9. Return and deletion

When your use of POSCountr ends, you may ask for an export within 30 days. We then delete Business Personal Data, except where the law requires it to be kept, in which case we keep it only for that purpose and period.

10. Location and transfers

Business Personal Data is stored with Hetzner Online (servers in Singapore and Germany), delivered through Cloudflare. Transfers outside India are made only as the DPDP Act permits.

11. Information and audits

On reasonable request we will provide the information needed to show compliance with these terms. Contact our Grievance Officer below.

12. Contact

We acknowledge every grievance within 48 hours and aim to resolve it within one month of receipt. If you are not satisfied with our response on a personal-data matter, you may approach the Data Protection Board of India.