Privacy Policy

1.1 Positack (Pty) Ltd (registration number 2026/210756/07, VAT number 4830290369), A1 Farm Holm Hill, Beacon Bay, East London, 5241, South Africa. Telephone +27 83 439 4236.

1.2 Information Officer: Armand Charles Moss, registered with the Information Regulator under number 2026-000958 (registered 22 January 2026). Email privacy@positack.co.za. There is no deputy information officer.

1.3 This policy is governed by the Protection of Personal Information Act 4 of 2013 (“POPIA”). We are a South African company and we do not target customers in the European Union or other regions.

2.1 PosiTack is used by businesses (“venues”: restaurants, bars, farm stalls, guesthouses and shops) to run their tills, kitchens, stock, bookings, staff, payroll and customer programmes. This means personal information reaches us in two different ways, and the law treats them differently.

2.2 If you are a venue’s employee or customer: the venue decided to collect your information and what to do with it. Section 3 below tells you what kind of information the system can hold about you, so you know what to ask your venue about, but the venue — not PosiTack — must give you its own privacy notice, obtain any consent, and answer your requests. We will help the venue do so. If you contact us directly we will pass your request to the venue and tell you we have done so. Our contract with each venue (Schedule 1 to our Terms of Service) obliges us to keep your information confidential, secure it, and process it only on the venue’s instructions.

2.3 If you are a venue owner or User: sections 3 to 15 apply to you directly.

3.1 About venue owners and Users (we are responsible party):

3.2 About a venue’s staff (the venue is responsible party; we are operator). Depending on the modules the venue uses, the system can hold:

3.3 About a venue’s customers and guests (the venue is responsible party; we are operator):

3.4 Special personal information (POPIA section 26). The system can hold, on a venue’s instruction: biometric fingerprint templates; health information (sick leave, medical-aid details, medical grounds in disciplinary records); trade-union membership (deductions); and criminal behaviour (alleged offences recorded in disciplinary records, section 26(b)). The venue must have a lawful ground for each before entering it: for fingerprints, the employee’s written consent (section 27(1)(a)) unless the venue has confirmed another ground; for health and union data in payroll and HR, processing necessary for the establishment, exercise or defence of a right or obligation in law (section 27(1)(b)), or the employer-specific authorisations in sections 29 and 32 (section 27(1)(f)); for criminal behaviour, section 27(1)(b) or section 33. PosiTack does not rely on any ground of its own; it processes these as operator.

3.5 Supplier invoices and till slips. When someone at a venue chooses to scan a supplier invoice or till slip, the image they photograph or upload (which may show a supplier’s staff names and contact details) is sent to an AI service provider for text extraction, as described in sections 6 and 7.

3.6 Source of information. We collect information about venue owners and Users from them directly, from our Gateway when they pay, and automatically from their devices. All staff, customer and supplier information is entered by the venue or its Users, or by the customer themselves when ordering, booking or joining a loyalty programme at the venue’s invitation.

Where the apps come from. PosiTack POS (the till), PosiTack Kitchen Display (the kitchen screen) and PosiTack Back Office run on Android. We offer each of them on Google Play and as a direct download from positack.co.za. There are also Windows versions. Copies installed from Google Play are updated by Google Play. Copies downloaded from our website update themselves from our servers.

What an app tells us. Each time an installed app checks in with our servers, it tells us its version, build number and platform (for example Android or Windows). We use this to offer the right updates and to help you when you ask for support.

Camera. The till and the back office use the camera to scan barcodes and QR codes (such as a pairing code), only when you choose to scan. The code is read on the device itself by Google ML Kit, which is built into the app. We do not store camera images from scanning. ML Kit sends Google information about the device, the app and how the scanner performed; Google says it is sent encrypted and not shared with third parties. It never includes the camera images. The back office also lets you photograph a supplier invoice or till slip so that it can be read for you; those photos are handled as described in section 3.5.

Location. The back office asks for your device’s location only when you tap “Use my location” while setting the address of a branch or of QR ordering. It reads your position once and uses it to fill in the address. The apps do not track your location and do not use your location in the background.

Kitchen display. The kitchen display is linked to a venue with a pairing code. It does not use a personal account. It may start by itself when the device is switched on.

Google Play. When you install one of our apps from Google Play, Google processes information about you and your device under its own terms and its Privacy Policy, not ours. Google does not give us the personal information of people who install our apps from Google Play; we receive only overall statistics.

Your choice to connect. Google Business Profile is optional. When you connect a Google account, Google asks you to authorise PosiTack to manage the business listings that account can access. We use that permission only to provide the Social features you choose to use.

What we access and why. We read your business accounts and locations, profile details, Google reviews (including reviewer names, photos, ratings and comments), and business-performance reports and search terms. We show these to authorised users in your venue. When you choose to publish or remove a review reply, or save business-profile changes, we send that action to Google. For example, a reply you publish in PosiTack appears on your business’s Google listing, subject to Google’s moderation.

What we store and protect. We store encrypted Google access and refresh tokens, account and location references, your selected locations and branch mappings, and a record of actions your users take, including replies they publish. Review text and business-performance reports are fetched live from Google rather than kept as a permanent copy in our database. Google data is not sold, used for advertising, or used to train AI. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and control. Google receives the replies and profile changes you choose to send. Our hosting provider processes the connection information to run the service; access by PosiTack is limited to authorised support, security and operational purposes. You can stop the connection in Social → Channels → Disconnect. This clears our saved active Google sign-in and hides that connection’s locations. You can also remove PosiTack’s access in your Google Account’s third-party connections. Activity history and backup records follow section 9; contact privacy@positack.co.za to request deletion of connection-related personal information.

Your choice to connect. Facebook and Instagram are optional. When you connect, you sign in on Facebook’s own page (Facebook Login for Business) and Meta asks you to authorise PosiTack for the Facebook Pages you choose and the Instagram professional accounts linked to them. We never see your Facebook password. We use that permission only to provide the Social features you choose to use.

What we access and why. We read the list of Pages your Facebook login manages, each Page’s linked Instagram professional account, the posts and media already on those Pages and accounts (text, captions, images, links, dates, and like, reaction, comment and share counts), and a Page’s opening hours. We show these to authorised users in your venue. When you choose to publish a post or photo, or save a Page’s opening hours, we send that action to Meta, and it appears on your Page or Instagram account, subject to Meta’s rules.

What we store and protect. We store encrypted Facebook access tokens for your login and for each connected Page, Page and Instagram account references and names, your selected Pages and branch mappings, the posts your users create in PosiTack (with their photos), and a record of actions your users take. Photos you attach are kept with our image-hosting provider, because Instagram must collect a published photo from a public web address. Posts already on your Pages and accounts are fetched live from Meta rather than kept as a permanent copy in our database. Data from Meta is not sold, used for advertising, or used to train AI, and we use it in line with the Meta Platform Terms and Developer Policies.

Sharing and control. Meta receives the posts, photos and Page changes you choose to send. Our hosting and image-hosting providers process the connection information to run the service; access by PosiTack is limited to authorised support, security and operational purposes. You can stop the connection in Social → Channels → Disconnect. This clears our saved Facebook sign-in and hides that connection’s Pages and accounts. You can also remove PosiTack in your Facebook settings under Business integrations; Meta then tells us and we clear the saved sign-in in the same way.

Deleting your data. You can ask for the data PosiTack holds from your Facebook login to be deleted from your Facebook settings (Business integrations → PosiTack → remove, and ask for your data to be deleted), or by emailing privacy@positack.co.za. When Meta sends us your request we clear every saved Facebook sign-in that belongs to you, in every venue, hide the Pages and accounts it connected, and give you a confirmation code with a page where you can check the request’s status. Activity history and backup records follow section 9.

4.1 For information where we are the responsible party:

4.2 For information where the venue is the responsible party, the venue decides the purpose and basis; we process only on its instruction under Schedule 1 to our Terms.

4.3 Automated decisions. The Service does not make decisions about you by automated means that have legal or similarly significant effects. Payroll calculations, stock reorder suggestions and loyalty point awards are automatic calculations from data the venue entered, reviewed by the venue.

5.1 From PosiTack. We do not currently send direct marketing. Before we do, we will register with the National Consumer Commission’s opt-out registry and screen our list against it. We will send marketing (news about PosiTack features, offers) by email or other electronic message only if you have opted in by a positive action, on a form substantially similar to Form 4 of the POPIA Regulations, that states what we will send and how. We do not treat a pre-ticked box or a failure to opt out as consent. If you are an existing customer we may tell you about similar PosiTack services under section 69(3) of POPIA, and every such message lets you opt out. Every marketing message will identify us (business name, physical address, email address and telephone number) and how to opt out. Withdraw consent at any time using the unsubscribe link or by emailing privacy@positack.co.za; we then keep only your address and the opt-out date on a suppression list so we do not contact you again.

5.2 From a venue. If a venue sends you marketing through PosiTack, the venue is the direct marketer. It must have your consent and give you an opt-out in each message. Use that opt-out or contact the venue. We provide venues with opt-out tools and we require them, in our Terms, to comply with POPIA and the CPA’s opt-out registry.

6.1 We do not sell personal information. We share it only with:

6.2 We have written terms with each of these providers that require them to protect personal information and process it only for the stated purpose.

7.1 Our production servers, database and email server are hosted in Johannesburg, South Africa. Personal information is processed in South Africa; limited copies may be held on PosiTack-controlled systems in South Africa for support, backup and testing. Backups are kept in South Africa.

7.2 Information leaves South Africa only in these cases: (a) connection data passes through Cloudflare’s global network on its way to our servers; (b) supplier invoices and till slips a venue chooses to scan are sent to Cloudflare Workers AI or Anthropic, which may process them outside South Africa, including in the United States; (c) WhatsApp messages a venue sends go through Meta in the United States (when that feature is available); (d) data a venue chooses to sync goes to Intuit in the United States; (e) when a venue connects Google Business Profile, connection requests, replies and profile changes are processed on Google’s global infrastructure, which may be outside South Africa. We rely on section 72(1)(a) of POPIA: each recipient is bound by a written agreement requiring protection substantially similar to POPIA. Where a venue uses one of these features, it does so as responsible party and confirms it has a lawful ground. Separately, when someone scans a barcode or QR code in our apps, Google ML Kit sends Google information about the device, the app and how the scanner performed, which may be processed outside South Africa. It does not include the camera images or details about who scanned.

8.1 We take reasonable measures, appropriate for a hosted software business of our size, to protect personal information against loss, damage, unauthorised access and destruction (POPIA section 19). They are:

8.2 We do not hold independent security certifications.

8.3 No system is perfectly secure. Venues and Users must protect their own passwords, PINs and devices.

9.1 After a retention period ends we delete the information or de-identify it so it can no longer be linked to you. Where a legal hold, court order or regulator requires longer retention we keep only what is required, for that purpose.

10.1 Under POPIA and PAIA you may:

10.2 How to exercise them. Email privacy@positack.co.za or write to the Information Officer at our address. We may ask you to prove your identity. We respond within 30 days; where a request is complex we may extend by up to 30 days and will tell you why. Requests are free, except for a copy of a record requested under PAIA, for which the prescribed fee may apply (see the PAIA Manual). If you are a venue’s employee or customer and your information was entered by the venue, we will forward your request to the venue and tell you, because the venue must decide it; we act on the venue’s instruction. A venue that needs our help beyond its own tools pays our standard rate of R450 per hour (including VAT) after two free hours a year (Schedule 1 clause 8.1).

11.1 The Service is for businesses and is not directed at children. We do not knowingly open accounts for anyone under 18.

11.2 Venues may record a child’s first name and age when a parent or guardian books a children’s party or family accommodation. That information is entered by the parent or guardian, with their consent (POPIA section 35), for the venue’s booking. The venue is responsible for it and we hold it as operator. If you believe a child’s information has been entered without a competent person’s consent, tell the venue, or privacy@positack.co.za and we will refer it to the venue, which must decide.

12.1 Essential cookies and browser storage keep the site secure, support sign-in and remember requested settings. Optional cookies require your explicit choice. Use Cookie settings in the footer to review or withdraw that choice. We keep a dated record of choices, changes and the notice shown for one year, using a random identifier rather than your name or email. Our Cookie Notice lists the storage used, active providers, retention periods and available controls.

13.1 If we have reasonable grounds to believe that personal information for which we are the responsible party has been accessed or acquired by an unauthorised person, we will notify the Information Regulator through its portal and the affected people as soon as reasonably possible after discovering it, taking into account the legitimate needs of law enforcement and the measures reasonably necessary to determine the scope of the compromise and restore our systems (POPIA section 22(2)). We may delay notifying affected people only where a public body responsible for investigating offences, or the Regulator, determines that notification would impede a criminal investigation (section 22(3)). The notice will say what happened, what we are doing, and what you can do to protect yourself.

13.2 If the compromise affects a venue’s staff or customer data, we notify the venue immediately after we become aware of it (POPIA section 21(2)), so that it can notify the Regulator and the affected people as responsible party (Schedule 1 clause 5).

14.1 Contact our Information Officer first: Armand Charles Moss, privacy@positack.co.za, +27 83 439 4236, A1 Farm Holm Hill, Beacon Bay, East London, 5241, South Africa.

14.2 If you are not satisfied you may complain to the Information Regulator (South Africa):

15.1 We may update this policy. Material changes are announced by email to venue owners and by a notice in the back office at least 30 days before they take effect; other changes take effect when published with a new date. Earlier versions are available on request.