Privacy Policy
How Averion POS collects, uses, protects and shares information, in line with Uganda's Data Protection and Privacy Act, 2019, and how cookies are used on this site.
1. Scope and roles
This policy covers the public website, the signup process and the Service. For the account and contact details of workspace owners and users, and for visitors to this website, the Company is the data controller. For the personal data a business enters into its own workspace about its customers, staff and suppliers, that business is the controller and the Company is its data processor; section 4 explains what that means for you. We handle personal data in accordance with the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account and workspace | Name, email, phone, business name and address, tax identification number, workspace address, role, password (stored only as a one-way hash), two-factor settings | You, at signup and in settings |
| Billing | Plan, invoices, payment references and status. Card and mobile-money details are handled by the payment provider and are not stored by us. | You; payment providers |
| Usage and device | Pages and features used, actions taken (audit trail), IP address, browser and device type, timestamps, approximate location derived from IP | Automatically |
| Support | Messages you send us, contact-form submissions, call notes | You |
| Integration credentials | EFRIS gateway account details you enter; stored encrypted and used only to submit your documents | You |
3. How we use it and our lawful bases
- To provide the Service (performance of a contract): creating and running your workspace, authenticating users, processing sales and documents, billing and support.
- To keep the Service secure and reliable (legitimate interests and legal obligation): audit trails, fraud and abuse prevention, rate limiting, backups, incident investigation.
- To meet legal duties (legal obligation): tax and accounting records, responding to lawful requests from authorities, record-keeping under Ugandan law.
- To improve the Service (legitimate interests): analysing aggregated usage, testing and developing features.
- To communicate (contract, legitimate interests, or consent where required): service notices, invoices, security alerts, and, only where you have agreed, product news you can opt out of at any time.
We do not sell personal data and do not use it for automated decisions with legal or similarly significant effects.
4. Data you hold about your customers
When you record customers, staff or suppliers in your workspace, you decide what to collect and why; you are responsible for having a lawful basis and for the notices you give them. We process that data only to provide the Service to you and on your instructions, keep it isolated in your workspace, do not use it for our own purposes, and delete or return it at the end of the relationship as described in the Terms. Requests from your customers to access or correct their data should be directed to you; we will assist as your processor.
6. Where data is stored and cross-border transfers
The Service is operated from Uganda, but our hosting and backup providers may store data on servers outside Uganda. Where personal data is transferred outside Uganda we do so in accordance with the Data Protection and Privacy Act, 2019: to providers that offer adequate protection under contractual safeguards, and, where the Act requires it, with your consent, which you give by accepting this policy at signup. You may withdraw that consent by closing your workspace; we cannot provide the Service without hosting your data.
7. Retention
- Workspace data: for the life of the workspace and thirty (30) days after it ends, for export; then deleted, subject to the items below.
- Fiscal, tax and accounting records: at least five (5) years or as long as the Tax Procedures Code Act and other Ugandan law require, even after the workspace ends.
- Audit trails and security logs: up to twenty-four (24) months, longer if needed for an investigation or claim.
- Backups: rotated on a fixed schedule; a deleted workspace disappears from backups as they expire.
- Support and contact messages: up to three (3) years.
8. Security
We protect information with encryption in transit (TLS on every connection), encryption of stored credentials and secrets, one-way hashing of passwords, optional two-factor authentication, per-workspace isolation enforced in the application and the database, role-based permissions inside each workspace, rate limiting, audit logging and regular backups. Access to production systems is restricted to authorised personnel. No method of transmission or storage is completely secure; if we become aware of a breach affecting your data we will notify you without undue delay and, where required, the Personal Data Protection Office.
9. Your rights
Under the Data Protection and Privacy Act, 2019 you may ask us to: confirm whether we hold personal data about you and give you access to it; correct inaccurate data; delete data we no longer need to keep; restrict or object to processing based on legitimate interests; withdraw consent where processing relies on it; and receive data you gave us in a portable form. Workspace owners can exercise most of these directly in their settings. To make a request, contact us using section 13. We may need to verify your identity, and we may refuse or limit a request where the law allows, for example where records must be kept for tax purposes. You also have the right to lodge a complaint with the Personal Data Protection Office in Uganda.
10. Cookies
The website and Service use cookies and similar storage:
| Type | Purpose | Choice |
|---|---|---|
| Strictly necessary | Keeping you signed in, protecting forms against cross-site request forgery, remembering your workspace and cookie choice | Always on; the Service cannot work without them |
| Security | Bot protection on public forms where it is enabled | Set by the protection provider only on those pages |
| Analytics | Understanding how the public website is used, only where a measurement tool is enabled and you have accepted it in the banner | Optional; decline in the banner or withdraw later by clearing site data |
Inside a workspace, local browser storage is also used to keep the point of sale working offline; it holds only your own workspace's data on your own device.
11. Children
The Service is for businesses and is not directed at children under eighteen. We do not knowingly collect personal data from children; if you believe a child has provided it, contact us and we will delete it.
12. Changes
We may update this policy. Material changes will be notified to workspace owners by email or in-app before they take effect; other changes take effect when published here with a new version number and effective date.
13. Contact and complaints
Privacy questions and requests: the Contact page . If you are not satisfied with our response you may complain to the Personal Data Protection Office of Uganda. See also our Terms of Service.