Data processing agreement

This agreement is between the business that uses Zero POS (“you”), as controller, and Colossus Investments Limited (“we”, “us”), as processor.

It forms part of our terms of service, and applies whenever we process personal data for you in providing Zero POS. Words defined in the terms, such as workspace, users and customer data, mean the same here.

It sets out what article 28 of the UK GDPR, and of the EU General Data Protection Regulation (GDPR), requires between a controller and a processor, and it applies in the same way under the data protection laws of Gibraltar and Andorra. Together, these laws are called data protection law here.

If this agreement and the terms disagree about customer data, this agreement prevails.

Subject matter: processing customer data to provide Zero POS to you.

Duration: for as long as the terms apply, and afterwards until the customer data is deleted, as Deletion and return describes.

Nature and purpose: storing customer data, and retrieving, organising, calculating with, showing, printing, sending and exporting it as you and your users ask, for example to record a sale against a customer, send a receipt or a booking confirmation, build a rota or work out commission; and keeping Zero POS working and secure.

People the data is about:

• your customers, including people who book online and people who receive a gift card or a voucher;
• your staff, and anyone else you give access to your workspace;
• the people you deal with at your suppliers;
• anyone else whose details you or your users record.

Types of personal data, as you choose to record them, and those Zero POS records by itself:

• customers: name and title, contact details (email, phone and address), date of birth, identity number, notes, purchases, treatments and appointments, loyalty points, store credit, gift cards and vouchers, and whether they agreed to receive offers and, when they change that choice from a link in an offer email, when they did so and the IP address and browser it came from;
• staff: name, sex (where recorded), contact details, username, photo, role and access, availability, rotas, check-in and check-out times, absences, including holidays and sick days, holiday allowances, pay rates, commission, bonuses, targets, sales, and the pay Zero POS works out for them;
• suppliers’ contacts: names and contact details;
• everyone who uses your workspace: the activity history of who changed what, and when.

Some of it can be special category data, such as sick days, or health details written in a treatment note. Zero POS keeps no medical documents and asks for no diagnosis: for a sick day it records the dates, and whether a sick note was provided and which dates it covers. If you record health details, it is up to you to have a lawful basis for doing so.

We process customer data only on your documented instructions, including on transfers to other countries, unless the law requires us to do otherwise. In that case, we will tell you before we do, unless the law forbids it.

Your instructions are the terms, this agreement, and what you and your users do in Zero POS, such as recording a sale, sending an offer or downloading a report. Any other instruction must be given in writing; email will do.

If we believe an instruction breaks data protection law, we will tell you.

You are responsible for the customer data you record and for your instructions: for having a lawful basis, telling people how you use their data, and getting any consent you need, for example before emailing offers.

We do not use customer data for our own purposes, sell it or use it for advertising.

Only people who need to reach customer data to provide or support Zero POS can do so, and each of them is bound to keep it confidential.

Our support staff enter your workspace only as the terms describe: with the owner’s permission or, without it, only to look, unless they record a reason why they must change something. Every visit appears in your workspace’s activity history.

We take appropriate technical and organisational measures to protect customer data against accidental or unlawful destruction, loss or alteration, and against disclosure or access without permission. Our security page describes the main ones, and we keep them under review.

They include:

• keeping each workspace’s data apart from every other’s;
• permissions by role, checked on our servers, not only on screen;
• passwords kept only as one-way hashes, sign-in with passkeys, and limits on repeated sign-in attempts;
• encrypted connections (HTTPS) between devices and Zero POS;
• an activity history of the changes that matter, which nobody can edit from inside the app;
• a second factor for our own staff before they can open, download or close a workspace.

You look after the security of your own devices and accounts, as the terms describe.

You give us general authorisation to use sub-processors. Those we use now are:

• Vercel, which hosts Zero POS;
• MongoDB Atlas, from MongoDB, Inc., the database in which Zero POS keeps its data;
• Resend, which delivers emails Zero POS sends, such as receipts from shops that have not connected their own email account;
• Sentry, which receives reports of errors on our servers; a report can occasionally include a detail from customer data, such as a record’s id or the domain of an email address, never the address itself.

Each sub-processor is bound by a written contract that protects customer data as this agreement does, and we remain responsible to you for its work.

Before we add or replace a sub-processor, we will tell the workspace owner by email, and update this list. If you have reasonable grounds to object, tell us; if we cannot resolve your objection, you may close your workspace before the change takes effect.

When you connect your own provider, such as your own email account for receipts and offers, that provider is not our sub-processor: it works for you, under your own agreement with it.

Some of our sub-processors are based outside the United Kingdom, Gibraltar, Andorra and the European Economic Area, for example in the United States.

We transfer customer data only as data protection law allows: to countries recognised as protecting personal data adequately, or with appropriate safeguards, such as standard contractual clauses.

People can ask you to see, correct or delete their data, or object to how you use it. In Zero POS you can find and correct what you hold about a person, and download your records. Where you need more, we will help you answer, as far as we reasonably can.

If someone asks us about customer data, we will pass the request on to you without undue delay, and will not answer it ourselves unless you ask us to.

Taking into account the nature of the processing and the information available to us, we will also help you with your own obligations on security, breach notification, data protection impact assessments and prior consultation with a data protection authority.

If we become aware of a personal data breach affecting customer data, we will tell the workspace owner by email without undue delay.

We will tell you what we know, and more as we learn it: what happened, the kinds of data and roughly how many people are involved, the likely consequences, and what we are doing about it, so that you can meet your own obligations to report it.

We will take reasonable steps to contain the breach and limit its effects.

While your workspace is open, and for 30 days after it is closed, the owner can download all its data at any time (Settings → Workspace & data).

After those 30 days, we delete the workspace and the customer data in it, unless the law requires us to keep some of it. Deleted data can remain for a while in the copies we keep to recover from a failure, until those copies are replaced.

We will make available the information you reasonably need to show that we meet the obligations in this agreement.

If that information is not enough, you, or an auditor you appoint who is bound to confidentiality, may audit our compliance with this agreement: with reasonable notice, no more than once a year unless a breach or a data protection authority requires it, and in a way that keeps other businesses’ data safe.

The terms’ clauses on liability apply to this agreement too, as far as data protection law allows.

This agreement is governed by the same law as the terms, and disputes about it go to the same courts.

We may update this agreement when the law, or our sub-processors, change. We will tell the workspace owner by email before a change that affects you applies.

For anything about this agreement, write to info@zerolines.life.