Privacy Policy
Last updated: 2026-10-16
This policy explains how posfactori ("we", "us"), operator of posfactori, handles personal data. It covers two different situations, because our role is different in each:
- Our own customers — the businesses that subscribe to posfactori and the people who sign in to run them. For this data we are the controller.
- The data our customers process with posfactori — their guests, diners, delivery customers and staff. For this data the business is the controller and we are its processor, acting only on its instructions under our Data Processing Agreement.
1. Who we are
posfactori, —, registration/VAT number —. For anything about personal data, write to [email protected].
2. Data we process as controller
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Account data | name, email, phone, password (stored only as a one-way hash), language | to create your account, sign you in, secure it | contract |
| Business data | business name, VAT number, addresses, opening hours | to provide the service and invoice you | contract, legal obligation |
| Billing data | plan, invoices, payment status (card details are handled by Stripe, never stored by us) | to charge the subscription and keep accounting records | contract, legal obligation |
| Security and usage logs | IP address, sign-in times, audit log of sensitive actions, error reports | to protect accounts, investigate abuse, fix faults | legitimate interest |
| Support messages | what you send us | to answer you | contract, legitimate interest |
| Analytics (website only) | pages visited, device type | to improve the website — only with your consent (see the Cookie Policy) | consent |
We do not sell personal data and we do not use it for advertising profiles.
3. Data we process as processor
When a business uses posfactori, it may store data about its guests and staff: names, phone numbers, delivery addresses, order history, loyalty points, reservations, reviews, staff schedules and clock-in times. That business decides why and how this data is used and is responsible for informing the people concerned. If you are a guest of a business that uses posfactori and you want to exercise your rights, contact that business first; we will help it respond. Guests who create an account on a business's online menu can sign out and ask the business to delete their account at any time.
4. Who receives data
We use carefully chosen service providers ("sub-processors") to run the service — hosting, DNS and network protection, email, SMS, payments, printing and error monitoring. Each is bound by a data processing agreement. The current list, with what each one does and where, is on the Sub-processors page. Some features send data to third parties only when a business switches them on, for example a card terminal provider, a delivery marketplace, or the Greek tax authority (AADE myDATA) for legally required e-receipts.
We may also disclose data when the law requires it.
5. International transfers
Our servers are in the European Union. Where a sub-processor may access data from outside the EU/EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
6. How long we keep data
- Account and business data: while the subscription is active, then deleted or anonymised within 90 days of closing the account, unless you ask earlier.
- Invoices and accounting records: as long as tax law requires (typically 6–10 years).
- Sales and fiscal records of a business: as long as the business keeps its account, so it can meet its own record-keeping duties; exportable at any time.
- Security logs: up to 12 months. Database backups: rotated, kept at most 8 weeks.
7. Security
Data is encrypted in transit (HTTPS with HSTS). Each business's data is isolated at the database level (row-level security), passwords and PINs are stored as salted hashes, sensitive actions are logged, and backups are restore-tested every week. Access by our staff is limited to what is needed to run and support the service.
8. Your rights
You can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest, and you can withdraw consent at any time. Write to [email protected]; we answer within one month. You also have the right to complain to your data protection authority — in Cyprus or where you live or work.
9. Children
posfactori is a business tool and is not directed at children under 16.
10. Changes
We will post changes here and, if they are significant, tell account owners by email before they take effect.