Privacy Policy

1Introduction and purpose

Tech Oasis POS is a business-management platform. It helps businesses record sales, manage products and stock, keep customer and supplier records, manage staff, shifts and cash-drawer records, issue receipts, view reports, and manage a subscription. Businesses can use the General POS, Restaurant POS or Pharmacy POS interfaces.

The purpose of this policy is to tell you, in plain language, what information we handle, why, who we share it with, how long we keep it, and what choices and rights you have under Ghanaian data protection law, including the Data Protection Act, 2012 (Act 843) and, where relevant, the Electronic Transactions Act, 2008 (Act 772).

2Who operates Tech Oasis POS

Tech Oasis POS is operated by Tech Oasis Ltd (“Tech Oasis”, “we”, “us”, “our”).

• Business registration number: [INSERT REGISTRATION NUMBER, IF APPLICABLE]
• Registered address in Ghana: Greater Accra, Ghana
• Privacy and data protection contact: privacy@techoasisltd.com
• General support: support@techoasisltd.com

We do not claim any registration, licence or certification that we have not confirmed. We are working on our registration with the Data Protection Commission and will update this policy when it is complete.

3Scope and who this policy applies to

This policy applies to:

• Business owners and vendors who register an account and subscribe to the platform;
• Staff members (managers, sales attendants and other users) whom a business owner adds to a workspace;
• Visitors to our website, including people who contact us, request a demo, or use the website chat; and
• Individuals whose information a business enters into the platform, such as that business’s customers, suppliers and (in the Pharmacy POS) patients.

It does not apply to third-party websites or services we link to or rely on (see section 12). Those parties have their own privacy notices.

4Our role and your business’s role

It is important to understand who is responsible for which information.

• Information about your account and subscription (for example, your registration details, login records and billing history): we decide why and how this is used to provide and secure the platform. For this information we act as the party responsible for the processing (a “data controller” in the language of Act 843).
• Information a business enters about its own customers, suppliers, staff and patients: the business decides why and how it is collected and used. In respect of that content, the business is generally the party responsible, and Tech Oasis stores and processes it on the business’s behalf and on its instructions to provide the platform (generally a “data processor”).

We do not automatically become responsible for every way a business uses information it enters. Business owners must make sure they have a lawful basis, any required consent, and appropriate notices for the personal data they put into the platform (see section 9). Our description of these roles is a general explanation; your own legal advisers should confirm how they apply to your situation.

5Information we collect

Depending on how you use Tech Oasis POS, we may handle the following categories of information.

Account registration details

Your name, business name, email address, phone number, business address (if you provide it), the plan, billing cycle, currency and business solution you choose, and your password (stored only in a protected, hashed form, never in readable form). If you sign in with Google, we receive from Google the basic profile information you allow, such as your name, email address, profile picture and a Google account identifier.

Staff accounts, roles, attendance and shift records

For each staff member the business adds: name, email, phone number, job title, role and permissions, branch, profile picture and short biography (if entered), whether they are a pharmacist (Pharmacy POS), and records of when they sign in, which shifts they open and close, opening and counted cash amounts, notes, and the sales and actions made under their account.

Customer and supplier information entered by business users

Customer names, phone numbers, email addresses, loyalty points, purchase totals and balances; supplier names and contact details; purchase orders and goods received. The business decides what to enter.

Pharmacy POS information

Where a business uses the Pharmacy POS, it may record patient details (such as name, phone number, date of birth, sex, allergies and notes), prescription details (such as prescriber, facility, prescription date, notes and attachments), and dispensing records. Information about a person’s physical or medical condition is treated as special personal data under Ghanaian law and needs particular care (see section 9).

Restaurant POS information

Menu items, tables, table orders, kitchen tickets and reservations, which may include a customer’s name or phone number if the business enters it.

Product, inventory, sales, receipt and transaction records

Products, prices, stock levels and movements, transfers between branches, expenses, sales, receipts, discounts, taxes, refunds and voids, payment methods and amounts recorded for each sale, and the staff member who made the sale.

Subscription and billing information

Your plan and billing cycle, invoices, amounts, currency, payment status, Paystack transaction references and confirmation or failure messages. If you pay by card and agree to automatic renewal, we keep the token (authorisation code) issued by Paystack together with the card brand, the last four digits, the expiry month and year and the issuing bank, so that renewals can be charged. We do not receive or store your full card number or security code.

Technical data, device information, logs and usage

Internet address (IP address), browser and device type, operating system, pages or screens visited in the app, dates and times, sign-in and sign-out records, security events (such as repeated failed sign-ins), and a randomly generated identifier that identifies the browser or device you use for the POS. While you are signed in to the POS, the platform records that your session is active, the screen you are on, and the time you were last active. Platform administrators use this to provide live support.

Support requests and communications

Messages you send through the contact form, demo request form, support tickets, website chat or email; the contact details you give; and our replies. We also keep records of notices we send you, such as confirmation emails, payment receipts and subscription reminders.

6How we collect information

• Directly from you: when you register, sign in, complete your business profile, use the POS, contact us, request a demo or pay for a subscription.
• From your business: when a business owner or authorised staff member enters or imports information, including about customers, suppliers, staff and patients.
• From Google: if you choose “Continue with Google”.
• From Paystack: confirmation of the status of subscription payments.
• Automatically: through your browser or device when you use the website or app (for example IP address, device identifier and activity records), and through the cookies and similar technologies described in section 18.

7Why we collect information and how we use it

We use information to:

• create and secure accounts, verify email addresses and let you sign in and recover your account;
• provide the platform’s features, including recording sales, managing stock, staff, shifts and reports, and (where used) the Restaurant and Pharmacy interfaces;
• manage subscriptions: take and confirm payments, issue invoices and receipts, renew or restrict access, and handle failed payments;
• send service messages such as confirmation links, payment receipts, renewal reminders and security alerts;
• provide support, including live support using the session information described in section 5;
• keep the platform safe: detect and prevent fraud, abuse, unauthorised access and security incidents, keep audit and activity records, and enforce our Terms & Conditions;
• maintain, back up, test and improve the platform and fix faults;
• comply with legal and regulatory obligations and respond to lawful requests; and
• handle enquiries, demo requests and complaints.

We do not sell personal data. We only send marketing messages if you have asked for them or where the law otherwise permits, and you can opt out at any time. Accepting our Terms & Conditions is not agreement to receive marketing.

8Lawful bases for processing

Under Ghanaian data protection law, personal data must be processed lawfully and for a specified purpose. Depending on the activity, we rely on one or more of the following:

• Contract: processing needed to create your account, deliver the platform and manage your subscription;
• Consent: for example, when you accept our Terms and this Privacy Policy at sign-up, agree to automatic card renewal, or opt in to marketing. You may withdraw consent for future processing (see section 16);
• Legitimate interests: such as securing the platform, preventing fraud and abuse, keeping audit records and improving our service, where these interests are not overridden by your rights;
• Legal obligation: where we must keep or disclose information to comply with the law; and
• Special personal data: we process this only where the law allows, for example with explicit consent or another basis that the law recognises. Businesses that enter such data are responsible for having that basis.

9Business owners’ and staff responsibilities

A business that uses Tech Oasis POS is responsible for the personal data it enters about others. In particular, business owners and authorised staff must:

• collect only the personal data they need and tell the people concerned how it will be used;
• have a lawful basis and, where required, valid consent (especially for health or other special personal data in the Pharmacy POS);
• keep the information accurate and up to date and delete what they no longer need;
• give staff only the roles and permissions they need and remove access when staff leave;
• keep login details confidential and respond to requests from the people whose data they hold; and
• comply with any registration, notice or security duties that apply to them under Act 843 and other applicable law.

Tech Oasis will assist with reasonable requests that relate to the platform, but cannot decide how a business uses its own records.

10Recording a sale is not receiving the payment

Tech Oasis POS records a vendor’s sales, payment methods and transaction details. Tech Oasis POS does not receive, hold or safeguard the money that customers pay to vendors, and it is not a bank, financial institution, escrow service or payment custodian.

Customers pay vendors directly through the payment arrangements available to those vendors. Where a vendor chooses to accept an online payment (card, mobile money or bank transfer) through the platform, the payment is processed by Paystack and settled by Paystack to the payout account the vendor has connected. A platform service fee of 0.5% of each online payment currently applies. It is deducted by Paystack when the payment is settled and is our charge to the vendor; it is not vendor money that we hold. The current fee is shown in the vendor’s payment settings.

A sale marked as paid or completed in the software is a record entered or confirmed in the system. It is not, on its own, proof that funds have been received, cleared or settled. Vendors remain responsible for checking and reconciling their actual payments and cash.

11Paystack and subscription payments

We use Paystack, a third-party payment gateway, to process payments for Tech Oasis POS subscriptions. When you pay, you are taken to Paystack’s secure payment page, where you enter your card, mobile money or bank details with Paystack, not with us.

We receive information needed to manage your subscription, such as the transaction reference, amount, currency, payment channel, payment status, confirmation or failure message and, for saved cards, the Paystack token and limited card details described in section 5. We do not claim to store full card details.

Paystack is responsible for its own handling of your payment information under its terms and privacy policy. You can read Paystack’s privacy information at paystack.com/gh/privacy/merchant and its terms of use on paystack.com.

12Who we share information with

We share information only where needed to run the platform, and with these kinds of recipients:

• Hosting and infrastructure providers that run the servers on which the platform and its database operate (a virtual private server provided by Namecheap, Inc.);
• Paystack for subscription payments, and for online customer payments where a vendor uses them;
• Google, if you choose to sign in with Google;
• Email delivery providers (we use Resend) to send confirmation links, receipts and notices, and, if enabled, SMS providers for text notices;
• Website tools, including the website chat widget (Tidio), content delivery networks that serve code libraries and fonts, and an exchange-rate service used to display currency conversions in your browser;
• Professional advisers such as lawyers and auditors, under confidentiality duties;
• The business that owns a workspace: information entered into a workspace is visible to that business’s authorised users according to their roles; and
• Our own platform administrators, who can view operational records (such as sales, products and live sessions) to provide support, billing and security. This access is restricted to authorised administrators and is subject to our role-based controls.

These providers may only use information to provide their services to us, and some operate their own independent policies. We require reasonable safeguards from providers we engage.

13Disclosure required by law

We may disclose information to the Data Protection Commission, courts, regulators, law-enforcement or other public authorities where the law requires it, where a valid legal request or court order is made, or where it is necessary to protect our rights, our users or the public from fraud, abuse or serious harm. Where lawful and practical, we will tell the affected business or person.

14Data security

We take reasonable technical and organisational steps to protect information, including:

• encrypted connections (HTTPS) between your browser and the platform;
• hashed password storage, email confirmation, and optional or required multi-factor authentication for platform administrators;
• separation of each business’s data from other businesses by database access rules, and role-based permissions within each business;
• audit and activity records, rate limiting and security monitoring; and
• regular backups of the platform database.

No online system is completely secure, and we cannot promise absolute security or uninterrupted availability. You also play a part: keep your password confidential, use a strong unique password, remove staff access promptly, and tell us at once if you suspect unauthorised use of an account.

15Data retention, account closure and deletion

We keep information for as long as it is needed for the purposes in this policy, including while an account is active and afterwards for as long as is reasonably necessary to resolve disputes, keep financial and audit records, meet legal obligations and enforce our terms.

• Active accounts: records remain available to the business so that it can keep trading and reporting.
• Expired or cancelled subscriptions: access is restricted (see our Terms & Conditions), but the business’s records are not deleted automatically merely because a subscription ends.
• Unconfirmed sign-ups: accounts that never confirm their email address may be removed automatically.
• Account closure: a business owner may ask us to close an account and delete or return its data, using section 17. We may keep information that we are required or permitted by law to keep, such as billing and audit records.
• Backups: routine backups are kept for a limited rolling period (the most recent 14 daily backups). Information deleted from the live platform may therefore remain in backups until they expire.

We do not promise a specific deletion timeline other than any period shown in this section or confirmed to you in writing.

16Your rights

Under Ghanaian data protection law, individuals have rights in relation to their personal data. In summary, and subject to the conditions and exceptions in the law, you may:

• ask whether we hold personal data about you and receive a copy (access);
• ask us to correct inaccurate or incomplete personal data (correction);
• ask us to delete or stop using personal data we no longer have a lawful reason to keep (deletion);
• object to processing that causes, or is likely to cause, unwarranted damage or distress, and to processing for direct marketing (objection);
• withdraw consent you have given, for future processing; and
• complain to the Data Protection Commission (see section 24).

If your personal data was entered by a business (for example, you are a customer, supplier or patient of a business that uses Tech Oasis POS), the best first step is to contact that business, because it decides how your data is used. We will help the business to respond where the request concerns the platform.

17How to make a privacy request

Email privacy@techoasisltd.com with your name, the email address or business linked to the account, and what you are asking for. We may ask for information to confirm your identity (and, if you act for someone else, your authority) before acting. We aim to respond within a reasonable time and within any period set by law. Information we may be required or permitted to keep, or whose release would affect another person’s rights, may be withheld; we will explain why.

18Cookies, sessions and similar technologies

We use a small number of technologies that store information on your device:

• Sign-in session: stored in your browser so that you stay signed in securely;
• Device identifier and preferences: for example, a random device key used to recognise the till, and your chosen currency or interface;
• Offline storage and site cache: the app can keep recent records and site files on your device so it can keep working when your connection drops. This stays on your device and is cleared when you sign out where the app does so;
• Website chat and third-party tools: the chat widget and content delivery services may set their own cookies or receive your IP address when you visit.

We do not currently use third-party advertising cookies. If we add analytics or advertising tools, we will update this policy and, where required, ask for your consent. You can control or delete cookies and stored data in your browser settings, but parts of the platform will not work without the sign-in session.

19International transfers

Some of the providers described in section 12 (including payment, email, chat, sign-in and hosting services) may process information outside Ghana. Where personal data is transferred abroad, we take reasonable steps to make sure it is protected to a standard that is adequate for the purpose, in line with Ghanaian law. Server location: a virtual private server provided by Namecheap, Inc..

20Children’s privacy

Tech Oasis POS is intended for businesses and is not directed at children. You must be at least 18 years old, or otherwise have legal capacity to contract, to register an account. We do not knowingly collect personal data from children through our website or sign-up. A business that records information about a child (for example, a patient) is responsible for doing so lawfully, including obtaining any consent required from a parent or guardian. If you believe a child has given us personal data, contact us so that we can take appropriate action.

21Data breaches

If we become aware of a security incident that affects personal data, we will investigate and take steps to contain it. Where the law requires, we will notify the Data Protection Commission and any other competent authority, and we will notify affected businesses and individuals, within the time the law requires or, where no period is fixed, without unreasonable delay. Businesses that are responsible for the personal data they entered will usually need to notify their own customers or patients; we will give them the information we reasonably can to help.

22Changes to this policy

We may update this policy from time to time. The “last updated” date and version number at the top of this page show the current version. If a change is significant, we will tell you in advance by email or a notice in the platform, and where the law requires your consent we will ask for it again. Continuing to use the platform after a change takes effect, where the law allows, means you accept the updated policy.

23Contact us

Questions or complaints about privacy:

• Privacy and data protection: privacy@techoasisltd.com
• General support: support@techoasisltd.com
• Post: Tech Oasis Ltd, Greater Accra, Ghana

We will try to resolve your concern directly first.

24Data Protection Commission

Ghana’s Data Protection Commission is the authority that supervises compliance with the Data Protection Act, 2012 (Act 843). If you are not satisfied with how we have handled your personal data, you may complain to the Commission. Its contact details and complaint process are published on its website, dataprotection.org.gh.