Privacy Policy

onlinePOS is operated by TechWare House, Opp. VTI, Sargodha Road, Chiniot. This policy explains how we handle information when a shop uses our software. If anything here is unclear, write to [email protected] and we will answer in plain language.

1. Two different sets of people

This policy covers two groups, and the difference between them matters.

Shops are our customers: the business that signs up, and the owners, managers and salespeople who log in. We decide what we collect about them, so for that information we are the controller.

Shoppers are the shop's customers, whose names, phone numbers, purchases and outstanding balances a shop records in its own account. We do not decide what a shop records or why. We store it on the shop's behalf and act on the shop's instructions, so for that information the shop is the controller and we are the processor. If you are a shopper and want your details corrected or removed, ask the shop. They hold the record, and we will help them act on it.

2. What we collect about a shop

• Account and business details. Shop name, branch addresses and phone numbers, the shop's chosen address on onlinepos.pk, logo, and the tax registration numbers the shop enters for invoicing: NTN, STRN and CNIC where applicable.
• User accounts. Name, email address, phone number, role and password. Passwords are stored as a salted hash and never in a form we or anyone else can read back.
• Billing records. What the shop has been invoiced, what has been paid, and when.
• Technical records. IP address, browser type, and the time of each sign-in, kept so we can investigate a break-in attempt or a support problem.

3. What a shop puts into its own account

Everything a shop records while running its business is stored in that shop's account and belongs to the shop. That typically includes:

• Products, categories, brands, barcodes, purchase and sale prices, HS and PCT codes, and stock levels.
• Sales and sales returns, including the items, the amounts, the discount, the tax, the payment method and the salesperson who rang it up.
• Customers: name, phone number, address, credit limit and running ledger balance.
• Suppliers, purchases, purchase returns and supplier payments.
• Expenses, bank and cash accounts and their transactions.
• Staff records: name, contact details, salary, attendance, advances and payslips.

We do not sell this data, mine it for advertising, or share it between shops. Each shop's data is stored against its own store identifier and every query in the software is scoped to it.

4. Enquiries from this website

If you send the contact form on this site, we keep your name, email address, phone number, business name, message and IP address so we can reply and so we can tell a genuine enquiry from an automated one. We use it to answer you and for nothing else.

5. Cookies and staying signed in

We use cookies only to run the software. There are no advertising, tracking or analytics cookies on the application.

• A session cookie, which identifies your browser while you are signed in.
• A sign-in token, which is what lets an owner or manager stay signed in for up to thirty days rather than logging in every morning. Salespeople are signed out sooner, because a shared till terminal should not stay open.
• A security token on every form, which is what stops another website submitting a form to us in your name.

Signing out deletes the sign-in token on our side as well as in your browser.

6. Who else ever sees a shop's data

Only where the shop's own use of the software requires it:

• The Federal Board of Revenue. If a shop switches on FBR digital invoicing, each invoice it issues is transmitted to FBR's system with the details FBR requires: the items, amounts, tax and the buyer's registration number where the shop has entered one. We transmit exactly what the shop recorded. We never alter a tax rate, a total or a buyer's details on the way through. FBR invoicing is off unless a shop turns it on.
• WhatsApp. If a shop sends an invoice or a message to a customer over WhatsApp, that message and the customer's phone number pass through WhatsApp's systems and are handled under Meta's terms. The shop chooses when to send.
• Our email provider, for transactional mail such as password resets and invoices.
• Our hosting provider, which stores the database and files.
• A court, regulator or law enforcement agency, where we are legally required to produce something. Where we are permitted to tell the shop first, we will.

7. Our own access

A small number of our staff can access a shop's account to provide support, to reproduce a problem, correct a bad record, or restore something. We do this to fix a specific problem, usually because a shop has asked us to, and not to browse. Support access happens through the administrator panel and is recorded.

8. Security

• Traffic between your browser and onlinepos.pk is encrypted in transit.
• Passwords are salted and hashed.
• Each shop's records are separated by store and branch at the query level, so one shop cannot read another's.
• Access within a shop is limited by role. A salesperson does not see what an owner sees.

No system is perfectly secure. If a breach affects a shop's data, we will tell the affected shops what happened, what was involved and what we are doing about it, without delay.

9. How long we keep things

A shop's data is kept for as long as the account is active. After an account is closed we keep it for 60 days so it can be recovered if the closure was a mistake or a bill was in dispute, and then delete it. Backups are overwritten on their own cycle, so a copy may persist in a backup for a short time after deletion.

Billing records and anything we are required to keep for tax purposes are kept for as long as Pakistani law requires, whatever else has been deleted.

10. Your rights

A shop can see, correct and export its own data from inside the software at any time, and can ask us for a full export in a machine-readable format. A shop can ask us to delete its account and everything in it. We will do so, subject to the records we are legally required to keep.

To make any of these requests, write to [email protected] from the email address on the account.

11. Where data is stored

Our database and backups are held on a secure server. WhatsApp, our email provider and FBR operate their own infrastructure, which may be outside Pakistan.

12. Changes to this policy

If we change this policy in a way that materially affects how we handle a shop's data, we will tell the shop by email and update the date at the top of this page before the change takes effect.

13. Contact

TechWare House, Opp. VTI, Sargodha Road, Chiniot
[email protected]
WhatsApp 03317419152