DAS POS

Privacy Policy

Effective 6 October 2026.

Your privacy matters to us. This Privacy Policy explains how Derick ArchiTech Studio Limited ("DAS", "we", "us" or "our") collects, uses, shares and protects personal data through DAS POS, our websites at pos.archderick.com and our applications (together, the "Service"), in accordance with the Data Protection and Privacy Act, 2019 of Uganda and its regulations.

1. Our two roles

As a controller, DAS determines how personal data is used for the people who register for and sign in to the Service, visitors to our websites, and anyone who contacts us. As a processor, DAS processes the personal data that businesses using the Service (each a "Business") submit about their customers, patients and staff, on each Business's instructions. For that data, the Business is the controller; please direct any request about it to the Business, and we will assist it.

2. Information we collect

Account information: your name, email address, phone number, role and business details; your password, which we store only in a protected, irreversible form; your sign in verification settings, trusted devices and sign in records.
Business Data: what a Business submits, such as products, prices, stock, sales and documents, and information about its customers, patients and staff. This may include contact details, purchase and payment history, wallet balances and, for health businesses, health information.
Payment records: amounts, methods and references, such as mobile money transaction identifiers or card approval codes. We do not collect or store full card numbers.
Technical and security information: IP address, browser and device type, pages visited, times, and error and security logs. When you choose to send a problem report, it includes an image of the screen, with typed values hidden, and your recent steps in the app.
Website and chat information: messages sent through our website help chat, a name and email address if you provide them, the page, IP address and device, and any rating you give.
Marketing preferences: whether you have agreed to receive news and offers from us.
Birthday and profile details: your date of birth, which we request from everyone who signs in, and, only if you choose to add them, a profile photo, a cover photo, gender, job title, city, country and a short description of yourself. Your age is not shown to others unless you choose.

3. How we use information, and our legal basis

To provide, maintain and support the Service and your account, as necessary to perform our contract with you.
To keep the Service and its users secure, including preventing fraud, abuse and attacks, limiting excessive requests and investigating problems, based on our legitimate interests and legal obligations.
To bill for the Service and maintain financial records, based on our contract and legal obligations.
To respond to messages and resolve problems you report, based on our legitimate interests and, where you ask us, your consent.
To improve the Service, using aggregated or deidentified information wherever possible, based on our legitimate interests.
To send news and offers, only with your consent, which you may withdraw at any time.
To send a birthday greeting by email on your birthday and, if you manage a Business's plan, a single use birthday discount code, based on our legitimate interest in caring for the people who use the Service. Greetings to a Business's customers are sent on that Business's behalf. You may ask us to stop at any time.
To comply with the law and with lawful requests from courts and authorities, based on our legal obligations.

4. How we share information

We do not sell personal data. We share it only as necessary with service providers that process it on our behalf under obligations of confidentiality and security:

Hetzner Online GmbH, which hosts the Service on servers in Nuremberg, Germany;
Upstash, which provides fast storage used for security limits and temporary records;
Cloudflare, which stores uploaded files, such as photos, logos and documents, and protects our forms from automated abuse;
Resend, which delivers the emails the Service sends;
MTN Mobile Money, Airtel Money and other payment providers, when a payment is made through them;
Google, which provides the map on our Contact page, only after you allow maps in Cookie settings.

The complete and current list, including what each provider does, which data it handles and where, is published at pos.archderick.com/legal/subprocessors. We give 30 days' notice there before adding or replacing a provider. We do not send personal data to any artificial intelligence service, and we do not use it to train artificial intelligence models.

We may also disclose personal data where required by law, a court or a competent authority; to protect the rights, property or safety of DAS, our users or others; to our professional advisers; and to a buyer or successor of all or part of our business, which will be bound by this Privacy Policy.

5. International transfers

The Service is hosted in the European Union, in Germany, where personal data receives protection at least equivalent to that provided by Uganda's Data Protection and Privacy Act. Some of the providers listed above may process data in other countries. We transfer personal data outside Uganda only where it is adequately protected or as otherwise permitted by law, and by using the Service you acknowledge these transfers.

6. How long we keep information

Account information and Business Data: for as long as the account is open and up to 90 days after it is closed, after which it is deleted or anonymised, except as described below.
Financial and transaction records: for as long as tax and other laws require.
Security and error logs, and problem reports: up to 12 months.
Website chat conversations: up to 24 months.
Marketing preferences: until you unsubscribe, and afterwards a record of that choice so that we do not contact you again.
Your date of birth and profile details: for as long as your account is open. Records of birthday greetings and gift codes: up to 24 months.

We may retain information for longer where reasonably necessary to resolve disputes, enforce our agreements or comply with the law.

7. Security

We protect personal data with measures that include encrypted connections, protected password storage, sign in verification, automatic locking and sign out, a separate database for each Business, access based on each person's role, request limits, monitoring and backups. No system can be guaranteed to be completely secure. If a breach affects personal data, we will act promptly and notify the authorities and affected individuals where the law requires.

8. Your rights

Subject to applicable law, you may request access to your personal data, its correction or deletion, object to or restrict its use, and withdraw your consent. Many of these you can do yourself in the Service: download your data, update your profile, change your email preferences or unsubscribe, change your cookie choices, and request deletion of your account. You may also write to archderick@gmail.com. We may need to verify your identity, and we will respond within the time permitted by law. For information a Business holds about you as its customer, patient or employee, please contact that Business first. You also have the right to lodge a complaint with the Personal Data Protection Office of Uganda.

9. Children

The Service is intended for businesses and adults. We do not knowingly collect personal data from children for our own purposes. Businesses such as hospitals and clinics may record information about children in their care; they do so as controllers and are responsible for obtaining any necessary consent.

10. News and offers

We send news and offers only to people who have agreed to receive them. Every such email includes a link to unsubscribe, and you may also write to archderick@gmail.com.

11. Changes to this policy

We may update this Privacy Policy from time to time and will let you know through the Service or by email when a change is significant.

12. Contact us

Derick ArchiTech Studio Limited, P.O. Box 204567, Nakawa, Kampala, Uganda. Email: archderick@gmail.com. Telephone: +256 771 099486.