Bisama POS
Privacy Policy
1Who We Are
Bisama Technologies operates Bisama POS, a point-of-sale and business management platform serving merchants across Ghana. For the purposes of Act 843 and this Policy, Bisama Technologies is the Data Controller for account and platform data, and acts as a Data Processor on behalf of each Tenant/Company for the customer data that the Tenant/Company inputs into the Software, such as its own customers' names and phone numbers used for receipts or loyalty programmes.
2Information We Collect
a) Information you provide
- Account details, including full name, username, email address, phone number, and business or branch information;
- Profile data, including profile photo, role, and password, which is stored as a salted hash and never in plain text;
- Business data, including products, inventory, sales, invoices, customers, suppliers, and payroll records entered into the Software; and
- Payment details processed through licensed mobile money and card payment partners. Bisama does not store raw card numbers or mobile money PINs.
b) Information collected automatically
- Device and log data, including IP address, browser type, device identifiers, and access timestamps, used for security and troubleshooting; and
- Usage data, including feature interactions, session activity, and error logs, used to improve reliability and performance.
3How We Use Your Information
We use the data we collect strictly to do the following:
- Provide, operate, and maintain the Software and its features;
- Process transactions, generate receipts, and manage subscriptions and billing;
- Authenticate users and protect accounts against unauthorised access;
- Send essential service communications, such as security alerts, password resets, and billing notices;
- Provide customer support and respond to enquiries;
- Detect, investigate, and prevent fraud, abuse, or security incidents; and
- Comply with legal, tax, and regulatory obligations under Ghanaian law.
We do not use your business or customer data to train third-party artificial intelligence models, sell it to advertisers, or share it with data brokers.
4Legal Basis for Processing
We process personal data on the following bases: performance of the contract between you and Bisama; your consent, where required, such as for marketing communications you opt into; compliance with a legal obligation; and our legitimate business interest in securing and improving the Service, balanced against your rights.
5No Selling or Unauthorised Sharing of Data
- Service providers strictly necessary to operate the Service, such as cloud hosting, SMS or email delivery, and mobile money or card payment processors, each bound by confidentiality and data-processing agreements;
- Legal compliance, where disclosure is required by a valid court order, subpoena, or statutory obligation under Ghanaian law;
- Business transfers, in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections for the affected data; and
- Your explicit consent, for any purpose not covered above.
6Data Retention
We retain personal and business data for as long as your account remains active, and thereafter for the period necessary to comply with legal, tax, and accounting obligations under Ghanaian law, typically up to six years for financial records, or until you request deletion, subject to Section 8.
7How We Protect Your Data
- Passwords are stored using strong one-way hashing algorithms and are never visible to Bisama staff;
- Data in transit is encrypted using industry-standard TLS/SSL;
- Access to production data is restricted to authorised personnel on a need-to-know basis;
- Regular backups, monitoring, and security reviews are performed to reduce the risk of unauthorised access, loss, or breach; and
- A multi-tenant architecture logically isolates each Tenant/Company's business data from that of every other Tenant/Company.
8Your Rights
Under the Data Protection Act, 2012 (Act 843), and in alignment with international best practice, you have the right to do each of the following:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Request deletion of your personal data, subject to legal retention requirements;
- Object to or restrict certain processing activities;
- Withdraw consent at any time, where processing is based on consent; and
- Lodge a complaint with the Ghana Data Protection Commission if you believe your data rights have been violated.
To exercise any of these rights, contact us at info@bisamapos.com. We will respond within a reasonable time, and in any event within the timelines prescribed by applicable law.
9Cookies and Similar Technologies
We use essential cookies and local storage to maintain your session, remember your theme preference for light or dark mode, and keep you securely logged in. We do not use third-party advertising or tracking cookies.
10Children's Privacy
The Service is intended for business use by adults. We do not knowingly collect personal data from children under 18 years of age. If we become aware that a child's data has been collected without appropriate consent, we will delete it promptly.
11International Data Transfers
Where data is processed or stored outside Ghana, such as on cloud infrastructure, we ensure that such transfers are protected by contractual safeguards providing a level of protection consistent with Act 843 and, where applicable, the EU General Data Protection Regulation. See our Data Protection (GDPR) Statement for further detail.
12Data Breach Notification
In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify affected Users and, where required, the Ghana Data Protection Commission, without undue delay and in accordance with applicable law.
13Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the dashboard or by email prior to taking effect.
14Contact Us
For privacy questions, data requests, or complaints, contact our data protection team at info@bisamapos.com.