Privacy policy

Last updated: 11 November 2026

This policy explains what personal data DHM Group Limited ("we") collects through the Shitisha POS website, store dashboard and till app, why, and the choices you have. It is written to meet the Data Protection Act No. 3 of 2021 of Zambia.

Who Is Responsible

For your account and billing details, we are the data controller. For the records a business keeps in Shitisha POS (its products, sales, staff and so on), the business is the data controller and we process that data on its behalf, only to provide the service.

Contact: DHM Group Limited, Plot 4280, Chikola Loop Area, Chingola, Zambia. [email protected]

What We Collect

  • Account details: the name, email address and phone number of owners and managers, a hashed (not readable) password, and a profile photo if you choose to add one.
  • Business records you enter or create: stores, products and prices, stock, sales, payment method, amount and reference (for example a mobile money or card slip reference), and receipt numbers.
  • Staff details: names, roles, the stores each person works at, and a hashed till PIN.
  • Billing: your plan, invoices and the proof-of-payment files you upload for bank transfers.
  • Tills: the name you give each till, its store, and when it last synced.
  • Technical data: IP addresses and request logs our servers keep for security and troubleshooting, and essential cookies that keep you signed in. We do not use advertising or analytics cookies.

We do not collect card numbers or mobile money PINs. The till only records what the cashier types after a payment is taken on a separate card terminal or phone.

The Till App

The app for Android, iOS and Windows asks for these permissions, and uses them only as described:

  • Camera: to scan barcodes. Images are processed on the device and are never stored or sent.
  • Bluetooth and nearby devices: to find and connect to receipt printers. On Android 11 and older, Android calls this a location permission; the app does not read, store or send your location.
  • USB: to talk to a receipt printer plugged into the tablet or PC.
  • Photos: on iPhone and iPad, only when you choose a profile photo. Only the photo you pick is uploaded.
  • Internet and network: to sync sales and catalog changes with our servers, and to reach network printers on your premises.

Sales are saved on the till first so you can keep selling offline, then sent to our servers. Synced sales stay on the till for 90 days; unsent sales are never deleted from the till. Uninstalling the app removes the data stored on that device.

The app checks for updates when it starts. That check sends the app version, the platform and an anonymous install identifier to our update provider, Shorebird. It contains no business or personal data.

Why We Use It

  • To provide the service you signed up for: running your tills, syncing and showing your records. (Performance of a contract.)
  • To bill you and confirm bank transfer payments, and to keep financial records the law requires. (Contract and legal obligation.)
  • To keep the service secure, prevent abuse and fix problems. (Legitimate interests.)
  • To send account emails such as invitations, password resets, invoices, low-stock alerts and the daily summary. We do not send marketing email without your consent.

We do not sell personal data, use it for advertising, or let third parties track you in our apps.

Who Processes It for Us

We use service providers to host the service: a virtual private server provider, Neon (databases), Cloudflare R2 (file storage), an email delivery provider and Shorebird (app updates). They process data only on our instructions. Some of their data centres are outside Zambia; we use providers that protect data under contract and with encryption in transit.

We disclose data to authorities only when Zambian law requires it.

How We Protect It

Each business has its own separate database and its own file storage. Data travels over encrypted connections (HTTPS). Passwords and PINs are stored only as hashes. Access by our staff is limited to what is needed to run and support the service.

How Long We Keep It

We keep your data while your account is active. If you cancel, or your account stays locked for unpaid fees for 90 days, we keep the data for 90 more days so you can come back, then delete the business database and files. Invoices and payment records are kept for as long as tax law requires. See Deleting your account.

Your Rights

Under the Data Protection Act you may ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and withdraw consent where we rely on it. Email [email protected] and we will reply within 30 days. If you work for a business that uses Shitisha POS, contact that business first: it controls its staff and sales records.

If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner of Zambia.

Children

Shitisha POS is a business tool and is not meant for anyone under 18.

Changes

If we change this policy we will update the date above, and tell account owners by email before a significant change takes effect.