Privacy Policy

01

Scope and Identity

This Privacy Policy explains how Sadavir Utama Nusamedia, as the operator of SUN POS, obtains, collects, uses, stores, discloses, and protects Personal Data when you access the website, create an account, use the SUN POS application, contact Customer Support, or use related products and services.

This policy applies to SUN POS websites, applications, cloud services, support, and features. Third-party services or integrations selected by users may also be subject to those third parties' privacy policies.

02

Roles of SUN POS and Merchants

SUN POS acts as the Personal Data Controller for processing whose purposes and means it determines, including account management, authentication, security, devices, subscriptions, service payments, communications, support, and service administration and improvement.

For Personal Data of end customers, employees, staff, or internal users entered and managed by a merchant, the merchant generally acts as the Personal Data Controller and SUN POS acts as the Personal Data Processor on the merchant's instructions.

In certain circumstances, these roles may differ depending on the feature, integration, or applicable legal relationship. SUN POS and merchants remain responsible for their respective obligations under applicable laws and regulations.

03

Personal Data That May Be Processed

The types of data processed depend on the features, plan, devices, integrations, and information the user or merchant chooses to enter into the service.

• Account, merchant, and business data: owner or responsible person's name, business name, outlet name and code, business category, email, phone number, username, profile photo or logo, role, account status, outlet address or location, country, coordinates, time zone, and business settings.
• Employee and internal-user data: name, phone number, photo or photo gallery, position or role, status, outlet, work schedule, access rights, username, and activity relating to logins, data changes, and processed transactions.
• Authentication and security data: password or PIN hashes, protected session tokens, temporary OTP codes, verification status, login information and attempts, and security and audit records.
• Merchant customer data: customer ID, name, phone number, email, optional photo, and links to reservations, orders, transactions, pending payments, or transaction history.
• Reservation and order data: booker identity and contact details, date and time, guest count, table, service, related staff, status, duration, and reservation or order notes.
• Transaction data: transaction, invoice, or order number, date and time, outlet, products or services, quantities, prices, discounts, vouchers, taxes or fees, tips, notes, related customers, processing cashier or staff, status, voids, and refunds.
• Payment and subscription data: payment method, amount due, amount received, change, outstanding amount, payment time and status, refunds, payment provider, provider payment references, and app-store purchase or subscription information.
• Device and technical data: device identifier, device name and type, platform or operating system, model, app version and build, IP address, user-agent, last active time, session information, request or activity logs, and error information needed for security and troubleshooting.
• Location, media, and device-permission data: device location when users select an outlet location or use payment features that require it, outlet coordinates, images selected or uploaded by users, and use of cameras, Bluetooth, NFC, or related devices for barcodes, printers, scanners, and payments.
• Communication data: enquiries or reports to Customer Support, email address and contact details, attachments, responses, and support follow-up records.

04

Credentials, Biometrics, and Sensitive Payment Data

SUN POS does not store authentication passwords or PINs in plain text. These credentials are stored as one-way hashes and used to verify user access.

When users enable biometric authentication, verification is performed by the device operating system. SUN POS receives only a success or failure result and does not receive or store fingerprints, facial data, or biometric templates.

For payments processed through payment providers, SUN POS may receive limited information such as method, amount, status, time, provider name, and transaction reference. Full card numbers, CVVs, card PINs, and payment OTPs are processed directly by payment providers and are not stored by SUN POS.

05

How Data Is Obtained

• Provided directly by account owners, merchants, administrators, staff, customers, or people contacting Customer Support.
• Entered by merchants or authorized users when managing customers, staff, reservations, orders, transactions, outlets, and other features.
• Generated automatically through use of websites, applications, devices, sessions, synchronization, or security features.
• Received from integrations enabled by users, including Google, Apple, Google Maps, app stores, and payment providers.

06

Purposes of Processing

• Account, merchant, and staff data is used for registration, authentication, and management of outlets, roles, access rights, devices, and service administration.
• Customer, reservation, transaction, and payment data is used to operate point-of-sale, customer management, reservations, orders, pending payments, reports, reconciliation, refunds, and transaction history on merchant instructions.
• Device, session, location, and log data is used to provide selected features, maintain security, prevent misuse, manage device access, diagnose problems, and maintain service stability.
• Payment and subscription data is used to process purchases, verify payment status, grant plan entitlements, and handle cancellations or refunds.
• Communication data is used to answer enquiries, provide support, resolve issues, and communicate service information.
• Data may be used to meet legal obligations, resolve disputes, enforce agreements, and protect the rights and security of SUN POS, merchants, users, and others.

07

Bases for Processing

SUN POS processes Personal Data on one or more lawful bases, including consent where required, performance of a contract or pre-contractual steps, compliance with legal obligations, protection of vital interests, performance of public-interest tasks where applicable, and other legitimate interests, balancing SUN POS interests against data subject rights.

Merchants are responsible for ensuring that Personal Data of customers, employees, staff, and others entered into SUN POS is lawfully obtained and processed, limited to relevant needs, and accompanied by notice or consent where required.

08

Data Sharing and Processing Parties

SUN POS does not sell Personal Data. Data is disclosed or made accessible only as needed to provide services, follow merchant instructions, maintain security, or meet legal obligations.

• Infrastructure, hosting, database, cache, object storage, content delivery network, email, and technical support providers.
• Authentication, mapping, app-store, subscription, and payment providers, including Google, Apple, and Square depending on the features used.
• Integration, operating-system, hardware, printer, scanner, or payment-device providers selected by users.
• Merchant administrators and users granted access within the relevant organization, group, or outlet.
• Professional advisers, auditors, or parties to lawful corporate transactions subject to appropriate confidentiality obligations.
• Government agencies, law enforcement, courts, or other competent authorities acting under lawful authority and requests.

09

Storage and Retention

Data may be stored on user devices and infrastructure supporting SUN POS accounts, synchronization, media storage, security, support, payments, and subscriptions.

Account, merchant, customer, staff, transaction, and media data is retained while the account or service is used and afterward as necessary for processing purposes, accounting or legal obligations, security, dispute resolution, and enforcement of agreements.

OTPs, tokens, sessions, and security logs are retained for limited periods according to their function and security needs. When no longer needed, data may be deleted, destroyed, anonymized, or subject to restricted access, unless further retention is required or permitted by law.

10

Security and Personal Data Protection Failures

SUN POS applies reasonable technical and organizational measures appropriate to the nature and risks of data, including access restrictions, session and device management, credential hashing, protected communications, logging of certain activities, and recovery and deletion procedures. However, no system is entirely risk-free.

Users must protect credentials, limit access according to need, manage devices securely, update applications and operating systems, and report suspicious activity promptly.

In the event of a Personal Data protection failure, SUN POS will respond and notify required parties within the time limits and requirements of applicable laws and regulations.

11

Data Subject Rights

Subject to applicable regulations and your relationship with SUN POS or a merchant, you may request information, access, correction, updates, copies, portability where applicable, cessation or restriction of processing, withdrawal of consent, deletion or destruction, and object to automated decision-making with significant effects where such features are used.

Rights may be limited where necessary for security, transactions, the rights of others, dispute resolution, or legal obligations. SUN POS may request verification of identity and authority before acting on a request.

12

Personal Data Request Procedure

Requests may be sent to support@sadavir.com with the suggested subject 'SUN POS Personal Data Request'. Include your name, related email or phone number, merchant or outlet name, relationship to the merchant, request type, and sufficient verification information without sending passwords, PINs, or OTPs.

For end-customer or staff data managed by a merchant, requests should first be submitted to the merchant as the Personal Data Controller. SUN POS will assist the merchant or forward the request to the authorized party where necessary.

Requests will be recorded, verified, and followed up within the time limits required by applicable laws and regulations. SUN POS will communicate the outcome or lawful reasons where a request cannot be fully fulfilled.

SUN POS account deletion requests may also be initiated through the in-app Data & privacy menu or pos.sadavir.com/en/account-deletion. Account deletion does not remove records that must be retained for legal, accounting, security, fraud-prevention, or dispute-resolution obligations; access to retained data will be restricted according to its purpose.

13

Cross-Border Transfers and Processing

Technology, app-store, authentication, mapping, payment, or infrastructure providers may process data in different regions or countries. Where Personal Data is transferred outside Indonesia's jurisdiction, SUN POS will ensure an equivalent or higher level of protection, adequate and binding safeguards, or another basis permitted by applicable laws and regulations.

14

Children's Data

SUN POS is intended for business activities and is not designed for direct use by children. Merchants may nevertheless enter children's customer data in connection with transactions or reservations. Merchants must ensure appropriate authority and parental or guardian consent where required. Contact SUN POS if you become aware of children's data being processed without appropriate authority.

15

Merchant and User Responsibilities

• Ensure Personal Data is lawfully obtained, relevant, accurate, and limited to what is needed to use SUN POS.
• Provide privacy notices and obtain consent from customers, staff, or others where required.
• Assign roles and access rights only to authorized users and disable access that is no longer needed.
• Do not enter passwords, PINs, OTPs, full card details, health data, children's data, or other specific Personal Data into notes or free-text fields unless strictly necessary and supported by an appropriate legal basis.
• Assist with data subject rights and promptly report suspected unauthorized access or disclosure.

16

Policy Changes

SUN POS may update this Privacy Policy to reflect changes to products, processes, service providers, or legal requirements. The latest version and update date will appear on this page. Where changes materially affect consent-based processing, notice will be given before they take effect as required by applicable rules.

17

Privacy Contact

For privacy questions, data-rights requests, or reports, contact Sadavir Utama Nusamedia at support@sadavir.com or the address listed on the SUN POS website.