1. Who we are
The ared point-of-sale system (the aredPOS and aredKDS apps, ared Backoffice in the browser, and our servers) is built and operated by Pos sistemos, MB, company code 308110793, Salaspilio g. 9-16, LT-12188 Vilnius, Lithuania (“we”). Contact: info@ared.lt, +370 690 79059.
2. Scope
This policy covers personal data we handle when a business (our customer, the merchant) uses ared, when its staff sign in to aredPOS, aredKDS or Backoffice, when a shopper asks for an e-receipt, and when someone contacts us or visits ared.lt.
3. Our role
- Merchant data (products, sales, receipts, staff accounts, shoppers’ contact details for e-receipts) belongs to the merchant. We process it as a processor on the merchant’s instructions under our data processing agreement (GDPR Art. 28). Shoppers and staff should contact the merchant first; we will help the merchant.
- Our own data (contracts and invoicing, customer contacts, technical logs and crash reports, correspondence) – here we are the controller.
4. What we process and why
- Staff accounts (on the merchant’s behalf): name, username/e-mail, password (stored only as a hash on the server and in the Apple Keychain on the device), role, and which actions were performed on the register. Purpose: sign-in and the legally required audit trail. Basis: contract, legal obligation.
- Sales and receipts (on the merchant’s behalf): items, prices, discounts, payment method, card type and last 4 digits (never the full card number), notes, register and shop details, time. Fiscal documents are registered in real time with the Lithuanian tax authority’s (VMI) i.EKA system. Basis: legal obligation, contract.
- E-receipts (on the merchant’s behalf): if the shopper asks for one, the cashier enters an e-mail address or phone number, used only to send that receipt by e-mail or SMS.
- Card payments: card data is processed by the merchant’s payment provider (SumUp or Adyen) in its own terminal or software; we never receive the card number, expiry date or CVC. The SumUp software inside aredPOS asks for location permission (required by the card schemes for in-person payments) and may process merchant and payment data as an independent controller – see SumUp’s and Adyen’s privacy notices. We do not receive location data.
- Ordering platforms (if the merchant connects one, e.g. Bolt Food): order details including the shopper’s name or note; shopper data is deleted 24 hours after the order is closed.
- Technical logs and crash reports (we are controller): a random device identifier, the signed-in staff user ID and e-mail, merchant/shop/register identifiers, device model and OS version, error details. Logs do not contain shoppers’ e-mails or phone numbers. Basis: legitimate interest in a secure, working service.
- Customers and correspondence (we are controller): contracts, invoices, contacts, messages.
- ared.lt: no analytics, advertising or tracking cookies; the host may keep standard access logs.
We do not sell personal data, use it for advertising, or track people across other companies’ apps or websites.
5. Recipients
Railway Corp. (servers, EU – Amsterdam), Datadog, Inc. (logs and crash reports, EU – Frankfurt), MessageBird B.V. “Bird” (e-receipt e-mail/SMS, EU/EEA), Pusher Ltd. (real-time updates between register, kitchen display and server; record identifiers only; EU cluster), VMI i.EKA (fiscal registration, required by law), SumUp / Adyen (card payments, independent controllers), Apple (app distribution). Sign-in (Keycloak) runs on our own servers on Railway.
6. Transfers outside the EU/EEA
Data is stored in the EU. Where a US provider (Railway, Datadog) could access it, the EU Standard Contractual Clauses apply, and for Datadog also the EU–US Data Privacy Framework.
7. Retention
Fiscal documents and the electronic cash-register journal: 6 years (required by law). Other merchant data: for the contract term, then returned or deleted within 30 days (except what the law requires us to keep). Ordering-platform shopper data: 24 hours after the order closes. Technical logs and crash reports: up to 30 days. Invoices and accounting records: as required by accounting law.
8. Security
Encrypted connections (TLS), encrypted storage of passwords and keys, role-based access, backups, monitoring.
9. Your rights
Access, rectification, erasure, restriction, objection (where we rely on legitimate interest) and portability. For data we process for a merchant, contact the merchant – we will help them. Otherwise write to info@ared.lt; we reply within 30 days. You can complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, www.vdai.lrv.lt).
10. Children
ared is a business product and is not intended for anyone under 16.
11. Changes
We will tell merchants about material changes by e-mail; the current version is always on this page.