1. Who we are and what this policy covers
SovranPOS is a product of SOVRAN DIGITAL LTD, a company registered in England and Wales under company number 17051226, with its registered office at Office 17116, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom.
This policy explains how we handle personal data when you visit pos.sovrandigital.com, contact us about a demo, open a SovranPOS account or use the SovranPOS cloud application and related services (together, the “Service”). It applies alongside our Terms of Service and Cookie Policy.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to people in the European Economic Area, the EU General Data Protection Regulation (EU GDPR).
2. Our role: controller and processor
For data collected through this website, demo requests, our own customer accounts and billing, we are the controller. We decide why and how that data is processed.
For the business records a venue keeps inside SovranPOS — products, sales, stock, staff accounts, working time, customer or loyalty records and similar operational data — the venue is the controller and we act as its processor under Article 28 UK GDPR and, where applicable, Article 28 EU GDPR. The venue decides what goes in and who may see it. We process it on the venue’s documented instructions and only to provide, secure and support the Service.
A data processing agreement (DPA) is available for every business customer. Write to privacy@sovrandigital.co.uk and we will send it before onboarding. The DPA sets out the subject matter, duration, purpose, data categories, security measures, sub-processors, deletion and return of data, and our duties as processor.
3. Data we process
3.1 Website visitors
- Technical data transmitted by your browser: IP address, browser type and version, operating system, device type, the page requested, the time of the request and the referring page.
- A theme preference (light or dark) stored in your browser’s local storage under the key
sovranpos-theme. It is not sent to us. - Data transmitted to Google when the page loads the Inter font from Google Fonts: your IP address, browser information and the font requested. See section 5.
The public website does not use analytics, advertising pixels, session recording or cross-site tracking. We do not create visitor profiles.
3.2 Demo requests and direct contact
Our contact form opens your email application with the details you entered. Nothing is transmitted to our server until you send that email. When you write to us or call, we process the data you provide, which may include your name, business name, email address, telephone number, city, type of business, the number of tills or locations and your message.
3.3 Accounts, contracts and billing
- Business and contact details: company name, billing address, contact person, email address and telephone number.
- Account and security data: user names, role, hashed password, optional two-factor authentication data and recovery codes, login and security events.
- Contract and payment data: plan, term, invoices, payment status and correspondence. Card payments on the terminal are processed by the payment provider; we receive the payment result, not the card number.
- Support data: the content of emails, calls and diagnostic information you send us or that we need to reproduce a fault.
3.4 Operational data entered by a venue
When a venue uses the Service, it may enter or generate data about its business, its staff and its customers. This can include:
- sales, orders, payment results, refunds, discounts and shift reports;
- products, prices, stock levels, suppliers and purchases;
- staff accounts, roles, PINs (stored as hashes), working time, schedules, absences and, where used, payroll-related master data;
- customer or loyalty records, contact details and purchase history;
- fiscal records, TSE signatures, Z-reports, DSFinV-K exports and activity logs, including the user, time, action and IP address;
- files and settings the venue chooses to store in the Service.
We do not ask venues to enter special categories of personal data (for example health data, religious beliefs or biometric data). A venue that chooses to process such data must have its own lawful basis and must tell us before onboarding.
3.5 AI-assisted features
Some optional features use artificial intelligence to generate suggestions or summaries. Where a venue uses them, the data needed for the request is processed to produce the result. The output is a suggestion, not an automated decision with legal or similarly significant effect. A person at the venue decides whether to use it. We do not use venue data to train our own AI models; where a third-party AI service is used, its role and the applicable safeguards are described in the DPA.
4. Why we process data and on what legal basis
| Purpose | Legal basis | Typical retention |
|---|---|---|
| Answering a demo or contact request | Steps before entering a contract or our legitimate interest in responding (Art. 6(1)(b) or (f) UK GDPR) | 24 months from the last contact |
| Providing the Service, managing accounts and support | Performance of the contract (Art. 6(1)(b)) | For the contract term and the statutory retention period |
| Invoices, tax, accounting and fiscal records | Legal obligation (Art. 6(1)(c)) | For the period required by tax and commercial law |
| Security, abuse prevention, error diagnosis | Our legitimate interest in a secure, working Service (Art. 6(1)(f)) | A limited period, then deleted or anonymised |
| Improving features and documentation | Our legitimate interest in developing the Service, using aggregated or anonymised information where possible (Art. 6(1)(f)) | No longer than necessary |
| Marketing emails or newsletters | Consent (Art. 6(1)(a)); we do not currently send newsletters | Until consent is withdrawn |
| Optional AI-assisted features | Performance of the contract or our legitimate interest in providing the feature (Art. 6(1)(b) or (f)) | For the request and the normal retention of the underlying record |
Where we rely on legitimate interests, we have balanced our interest against your rights. You may object at any time using the contact details below.
5. Cookies, fonts and similar technologies
The public website uses no analytics or advertising tools. Our own pages set
one functional cookie, sovranpos_lang,
to remember whether the site is shown in English or German. It is set from
the visitor’s country on the first visit or when the EN/DE switch is
used, contains no identifier, is not used for tracking and expires after one
year. The theme preference described above stays in local storage until you
clear it. Cloudflare may set a strictly necessary bot-management cookie if a
request triggers a security check; see section 6.
After a user signs in, the SovranPOS application uses a strictly necessary session cookie to keep the session secure. It is HttpOnly and ends on logout or expiry. Full details are in our Cookie Policy.
The public pages load the Inter font from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA. When the font is requested, Google receives your IP address, browser information and the requested file. We use the font to display the site consistently. The legal basis is our legitimate interest in a consistent, fast presentation (Art. 6(1)(f)); the request is necessary to deliver the page as designed. Google Fonts does not set cookies for this request. If you block the request, the site remains readable using your system font.
Our public website is delivered through Cloudflare, which processes connection and security data as described in section 6.
6. Who receives data
We do not sell, rent or trade personal data. We share it only with providers that help us run the Service, and only as far as needed:
| Recipient | Purpose | Location and safeguards |
|---|---|---|
| Hetzner Online GmbH | Hosting the application and database; off-server backups | Falkenstein, Germany (EEA) |
| Cloudflare, Inc. | CDN, TLS termination and security filtering for the public site | USA and global network; UK IDTA, EU standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework where applicable |
| Google Ireland Limited / Google LLC | Delivery of the Inter web font on public pages | Ireland and USA; EU standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework where applicable |
| Adyen | Card payment on the payment terminal | Card data is handled by Adyen under its own terms; we receive the payment result |
| Certified TSE provider | Signing transactions as required by German fiscal law | Germany / EEA; used only for the fiscal signing function |
| Email and communication providers | Sending and receiving contract, support and account email | Germany or the EEA; appropriate safeguards where a transfer occurs |
| Professional advisers and authorities | Tax, accounting, legal advice and responses to lawful requests | As required by law and subject to confidentiality |
Our sub-processors act on documented instructions. Business customers can find the current list in the DPA and are notified of changes in accordance with its terms.
7. International transfers
The application and its database are hosted in Germany. Backups are copied to storage away from the application server within the EEA. Most processing therefore stays inside the UK and EEA.
Some website services — Cloudflare and Google Fonts — may process connection data outside the UK or EEA. Where that happens, we rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework, as applicable to the recipient.
8. How long we keep data
- Demo and contact requests: 24 months from the last contact, then deleted unless a contract follows.
- Customer accounts and contracts: for the contract term and afterwards for the statutory retention period for tax, accounting and fiscal records. We delete or anonymise data that is no longer needed.
- Server logs: for a limited period needed for security and fault diagnosis, then deleted or anonymised, unless they must be kept to investigate a specific incident.
- Operational backups: the nightly database dump and operational files rotate after 14 days. The fiscal archive is kept separately for the statutory period and is not removed by that rotation.
- Local storage: the theme preference stays until you clear your browser storage.
- Venue data: processed for as long as the venue’s account is active and then per the DPA and the venue’s instructions, subject to statutory retention duties that apply to fiscal and business records.
9. How we protect data
We use TLS on the website and the application, bcrypt hashing for passwords and staff PINs, optional two-factor authentication, role-based permissions, tenant-scoped records and an activity log. Access to production systems is restricted. The database is backed up nightly and the backup is copied away from the application server.
Card payments are completed on the payment terminal. The till records the payment result, not the card number. No system is completely secure; if you believe you have found a security issue, write to info@sovrandigital.co.uk before disclosing it publicly.
10. Your rights
Under the UK GDPR and, where applicable, the EU GDPR, you have the right to:
- be informed about how your data is used and to obtain a copy of it (access);
- have inaccurate or incomplete data corrected;
- have data erased where the law allows;
- restrict or object to processing, including direct marketing;
- receive data you provided in a structured, commonly used, machine-readable format (portability);
- withdraw consent at any time, without affecting processing that happened before the withdrawal;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects — we do not make such decisions about visitors or customers;
- complain to a supervisory authority.
To exercise a right, write to privacy@sovrandigital.co.uk. We may ask for information to confirm your identity, and we answer within one month unless the request is complex, in which case we tell you why and extend the period as the law allows. Requests are free unless they are manifestly unfounded or excessive.
If your data was entered into SovranPOS by a venue, the venue is the controller. Please contact the venue first; we will support it in answering your request.
11. Information for venues, staff and guests
Venues are responsible for the lawfulness of the data they enter, for informing their staff and customers, and for their own retention duties. We provide the DPA, role permissions, export functions and deletion tools needed to meet those duties.
Staff should contact their employer about time records, schedules, payroll data and activity logs. We process that data on the employer’s instructions.
Guests and customers of a venue should contact the venue about receipts, loyalty accounts or customer records. The venue decides what is recorded and for how long; we provide the technical service.
12. Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will delete it.
13. Changes to this policy
We may update this policy when the Service, our providers or the law change. The date at the top of the page shows the current version. We will inform business customers of material changes by email or in the application before they take effect, where the law requires it.
14. Contact and complaints
For privacy questions, requests or a DPA:
SOVRAN DIGITAL LTD — Data protection
Office 17116, 182–184 High Street North, East Ham, London, E6 2JA,
United Kingdom
Email: privacy@sovrandigital.co.uk
Telephone: +44 7441 428241 (UK) ·
+49 1575 9755088 (DE)
You can complain to the UK Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk, telephone 0303 123 1113. Our ICO registration number is ZC142403. If you live in the EEA, you may also complain to the supervisory authority in your country of residence, work or the place of the alleged infringement.
We would prefer the chance to put a problem right first. Write to us and we will answer.