Privacy Policy

1. Introduction & Scope

This Privacy Policy outlines how TODO: Legal Entity Name Pvt Ltd ("CPOS", "we", "our", or "us") collects, uses, processes, stores, and protects personal data when you visit our website (cpos.pro), use our software applications (app.cpos.pro, mini.cpos.pro), or contact our sales and support teams.

We process personal data in strict compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and applicable Indian data protection regulations.

2. Categories of Personal Data We Collect

We only collect personal data that is strictly necessary for specified, lawful purposes:

• Account & Business Information: Name, business name, registered address, GSTIN, mobile number, and email address when you register an outlet or request a demo.
• Restaurant Operations Data: Staff user names, roles (Cashier, Waiter, Manager), shift timestamps, and transaction logs.
• Customer CRM Data (Processed on Behalf of Restaurant): Guest phone numbers or names inputted by the restaurant for loyalty cashback or WhatsApp digital bills. In this capacity, CPOS acts as a Data Processor on behalf of the restaurant (the Data Fiduciary).
• Technical & Log Data: IP address, device type, browser user agent, and crash logs collected for fraud prevention and service stability.

3. Lawful Grounds & Purpose of Processing

Under the DPDP Act 2023, personal data is processed based on:

• Consent: Explicit, affirmative consent collected via unticked checkboxes for demo inquiries, marketing updates, and account creation.
• Certain Legitimate Uses: To fulfill contractual obligations (e.g. processing subscription invoices, generating GST tax bills, and security auditing).

4. Data Minimization & Retention

We do not retain personal data longer than necessary for the fulfillment of its designated purpose, except where required by Indian statutory law (e.g. 8 years for financial invoice records under the Indian GST Act 2017).

5. Rights of the Data Principal

Under the DPDP Act 2023, you have the following enforceable rights:

• Right to Access Information: Request a summary of personal data being processed and third parties with whom it has been shared.
• Right to Correction & Erasure: Request correction of inaccurate data or deletion of data no longer required.
• Right of Grievance Redressal: Submit a complaint regarding data processing to our Grievance Officer.
• Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, use our self-serve Data Subject Request (DSR) Portal or email our Grievance Officer.

6. Grievance Redressal Officer

In accordance with Section 13 of the DPDP Act 2023, our designated Data Protection & Grievance Redressal Officer is: