Privacy Policy

Last updated: 17 October 2026

This document is a translation of the French original. In the event of any discrepancy, the French version prevails.

This policy explains how cysol OÜ, publisher of CYSOL POS (“we”), collects, uses, stores, protects and shares your information when you use the CYSOL POS service. cysol OÜ is a company incorporated under Estonian law, entered in the commercial register under No. 17611417, with its registered office at Sepapaja tn 6, 15551 Tallinn, Estonia.

We are committed to processing our customers' personal data openly and transparently, in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

Definitions

• The service — the CYSOL POS till, its back office and all the features we offer, available at cysolpos.com and through the CYSOL POS app for Android.
• Customer or merchant — the person or business that creates a CYSOL account. If you create an account for a business, it is the business that is the customer.
• You — the customer and, depending on the context, its authorised users.

Who is responsible for your data

Depending on the category of data, we act either as data controller or as processor.

• We are the data controller for the merchant's data: the data of the account it creates with us.
• We are the processor for the data of its staff and its customers: it is the merchant who is the data controller for that data.

In practice: if you are an employee of a business using CYSOL and wish to have your photograph deleted, contact your employer. It is your employer who decides how your data is processed.

For any question about the processing of your data or the exercise of your rights, write to contact@cysolpos.com.

Categories of data collected

We collect several types of data that may allow a person to be identified: first and last name, email address, postal address, telephone number, or any other element allowing that person to be identified directly or indirectly.

• Merchant data — relating to our customers, collected in order to provide them with the service.
• Staff data — relating to our customers' staff, as entered by the merchant: name, photograph, access code, contact details, date and place of birth, nationality, identity document, social security number, bank details, contract and pay, time clock records, salary advances.
• End-customer data — relating to the people with whom our customers interact, if our customers choose to enter it: for example the name, address, tax ID and email address shown on a quote or an invoice.
• Delivery platform orders — if you link a delivery platform (for example Uber Eats) from the Integrations module: the customer's display name, the content of their order, their notes and the fulfilment method. An allergy the customer reports to the platform may reveal health information: it is used only to prepare their order. The customer's and the courier's phone numbers are read live from the platform when you display them on the till, and are never stored by us, nor is the delivery address.

Our customers are solely responsible for setting their own rules and for complying with the legislation applicable to the collection of personal data in the course of their use of the service.

We collect this data on our customers' instructions and have no direct relationship with the data subjects. If you enter data concerning a third party, you must be entitled to do so and, where necessary, inform that person of how it will be used.

How we collect this data

What you provide to us

• On sign-up — email address, password, business name, country, and your name and telephone number if you provide them.
• Operating data — what you enter in the service: products, prices, stock, sales, staff, suppliers, expenses.
• Support requests — when you write to us: a description of the problem, screenshots, anything useful for resolving it.
• How you heard about us — if you choose to answer the question asked once on your dashboard. Answering is optional; it only helps us know where to talk about CYSOL.

What we collect automatically

• Error log — when an error occurs, and only then: the address visited, the IP address, the account concerned and the error message, solely for diagnostic purposes.
• Back-office action history — who changed what, when, and from which IP address. It protects your account, and you can view it yourself in the back office.
• Paired devices — technical identifier of the device, date of last connection, associated IP address, and the device's time and time zone, to check that its clock is correct.
• Acceptance of the terms — when you sign up, the date and time, the IP address, the language of the page and the versions of the terms of service and of this policy that you accepted, so that this acceptance can be proven.

What we do not collect

• No card numbers. The Pro subscription is paid on Stripe's secure page: your card is entered there and stored by Stripe, never by us. We receive only what is needed to track the subscription — its status, its dates, and the amount and number of each invoice.
• No advertising trackers, no third-party audience measurement, no sharing with ad networks.
• No sensitive data — ethnic origin, political opinions, religious beliefs, health, sex life, criminal convictions. You must not enter any such data in the service.

Cookies and local storage

We use no advertising cookies and no audience measurement trackers: our server only counts the pages read, as daily totals, without placing anything in your browser and without keeping any IP address. Our pages call no fonts, maps or social network buttons hosted elsewhere, so your IP address is not passed on to anyone — with one exception: on a computer, to print on a printer connected to it, the QZ Tray module loads its library from the jsDelivr content delivery network, which then sees your IP address. The Android app never uses it. Only mechanisms essential to the operation of the service are used:

As these items are necessary for the service, refusing them prevents use of the till. Full details — the name of each cookie, its exact duration, and what the application keeps once you are signed in — are on our cookies page.

On what grounds we process your data

We process your data only where we have a legal basis for doing so:

• because it is necessary to provide the service: operating it, assisting you, keeping it secure;
• because we have a legitimate interest that does not override your rights: preventing fraud, improving the service;
• because a legal obligation requires us to;
• because you have given us your consent for a specific purpose.

If you have consented to a particular use, you may change your mind at any time. This does not affect processing already carried out.

How we use your data

• to enable you to access and use the service;
• to display your sales history;
• to send you the messages the service requires: address confirmation, password reset, technical notices, security alerts;
• to write to you when your till has been inactive for several days, with a link to stop receiving these messages;
• to respond to your support requests;
• to measure, fix and improve the service;
• to detect and prevent fraud, unauthorised access and unlawful use.

We do not send you any marketing messages without your prior consent, and you may object to them at any time.

Sharing your data

Service providers

We use a limited number of service providers, bound by confidentiality obligations and acting only on our instructions:

• a hosting provider, established in Tunisia, for storing and running the service;
• an email delivery service, for confirmation and reset messages;
• Stripe (Stripe Payments Europe, Limited, Ireland), for payment of the Pro subscription. It receives the business name and the owner's email address, as well as what you enter on its checkout page: card, billing address and, where applicable, VAT number. For the payment itself, Stripe acts as a data controller, under its own privacy policy;
• Google, only if you choose to sign in with your Google account: it confirms your email address and your name to us.
• Google (Gmail), the publisher's email service, which receives a backup copy of the database every night, encrypted — Google does not hold the key that opens it —, as well as the service's error alerts.
• the delivery platforms you link (for example Uber Eats, part of the Uber group), only if you activate an integration. We send them your menu (items, prices, choices, availability), the status of your store (open, paused, closed) and your responses to orders (accepted, declined, ready, missing item); they send us their customers' orders. For the order and the delivery themselves, the platform acts as data controller, under its own privacy policy. Payment for an integration goes through Stripe, like the Pro subscription.
• Google (Firebase Cloud Messaging), only if you turn on alerts in the CYSOL Dashboard app. It carries to your phone the short text of each alert you chose — for example “Z report no. 12 closed · Harbour Café · by Karim” — never an amount. We keep the technical address Firebase gives your phone for as long as it stays signed in; it is deleted as soon as you sign out.

No data from your till — sales, products, staff, customers — is passed to Stripe, or readable by Google, apart from the text of the alerts you choose to receive on your phone. If you stay on the free plan, Stripe receives nothing at all.

We do not allow any service provider to use your data for its own purposes. We do not sell, rent or exchange your data with anyone.

Legal obligations and protection of rights

We may have to disclose your data where this is necessary to:

• comply with a legal obligation, a court decision or a request from a competent authority;
• enforce our terms of service;
• prevent fraud or a security breach;
• protect the rights, property or safety of our customers, the public or ourselves;
• establish or defend our legal rights.

Business transfer

In the event of a merger, sale or reorganisation, your data could be transferred. We would inform you of this, and of the privacy policy that would then apply to it.

Aggregated data

We may publish aggregated statistics that do not allow you to be identified — for example, the total number of businesses using the service.

Your rights

In accordance with the GDPR (Articles 15 to 21), you have the following rights. They are not absolute and may be subject to conditions.

• Right of access — view your data from within the service, and request a copy of it.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request the deletion of your data, in particular where it is no longer necessary, where you withdraw your consent, where you object to the processing and there are no compelling grounds to the contrary, or where the processing has proved to be unlawful.
• Right to object — object to processing on legitimate grounds relating to your situation.
• Right to restriction — request that processing be suspended in certain cases.
• Right to data portability — retrieve your data in a usable format.

To exercise these rights, write to contact@cysolpos.com. You will receive a reply within one month. You may be asked for proof of identity, so that no third party can access your data by impersonating you.

Deleting your account and its data takes one minute from the back office, or can be requested by email: the steps, and what is kept, are on the Delete your account page.

If you are an employee or customer of a business using CYSOL, it is that business that is responsible for your data: send your request directly to it.

Where your data is hosted

Everything your business produces is kept in one place: your sales, your tickets, your products, your stock, your staff, your expenses, your history. This data is hosted by a single provider, in data centres located in Tunisia, in a controlled environment.

Tunisia is outside the European Union and is not covered by an adequacy decision of the European Commission. We implement, with our hosting provider, the standard contractual clauses adopted by the Commission to govern this transfer; you may write to us to find out more.

Only one copy leaves this server: the nightly backup, encrypted (AES-256), sent to the publisher's Gmail mailbox and deleted after thirty days. Google does not hold the key that opens it; its servers may be located outside the European Union. Apart from this copy, we do not spread your data across several providers, and we know at all times where to find it.

What is sent for billing. Only the data strictly necessary for payment of the Pro subscription is passed to Stripe, established in Ireland: name, email address, billing address and, where applicable, company name and VAT number.

No data from your till is passed to it: not your sales, not your products, not your staff, not your customers. And if you stay on the free plan, it receives nothing at all.

How long we keep your data

We may keep certain data for longer if the law requires it, to settle a dispute, or to assert our rights. When there is no longer any reason to keep it, it is deleted or anonymised.

On the Starter plan, history older than thirty days cannot be viewed, but it is not deleted: it becomes accessible again if you upgrade to the Pro plan.

Minors

The service is aimed at professionals and is not intended for minors. We do not knowingly collect their data. If we learn that a minor has sent us any, we will delete it. If you become aware of such a case, please let us know.

Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, unlawful use, alteration or disclosure:

• all communications are encrypted using the HTTPS protocol;
• passwords are stored as irreversible hashes, never in plain text;
• device pairing keys are stored only as a fingerprint;
• backup copies are encrypted (AES-256) before they leave the server;
• automatic separation ensures that no business can access another's data.

In the event of a security incident affecting your data, we would inform you without undue delay, specifying its nature, the data concerned and the measures taken, and would notify the competent supervisory authority.

Changes to this policy

We may change this policy. Changes are published on this page, and any material change is notified to you by email at least thirty days in advance. If you do not accept these changes, you may close your account at any time. Continued use of the service constitutes acceptance.

Contact us

For any question about this policy or our practices: contact@cysolpos.com, or through the contact page.

cysol OÜ — publisher of CYSOL POS — Sepapaja tn 6, 15551 Tallinn, Estonia

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the supervisory authority to which we are subject, or with the data protection authority of your country of residence in the European Union.

Legal notice · Terms of service · Cookies · Refund policy · Delete your account