Privacy policy

Scope and roles

This policy applies to Nodhum POS's public website, merchant administration tools, point-of-sale applications, QR ordering, kitchen and customer displays, storefront features, support channels, and related services that link to it.

When we decide why and how personal data is used—for example, website enquiries or account administration—Nodhum POS acts as the data controller. When a merchant uses Nodhum POS to handle information about its customers, staff, orders or loyalty members, the merchant usually decides the purpose of that processing and Nodhum POS acts on the merchant's instructions. In that situation, please contact the merchant first about your data.

Information we collect

The information depends on how you interact with Nodhum POS and may include:

• Account and contact details such as your name, work email, phone number, role, organisation and authentication information.
• Merchant and outlet information such as catalogue, outlet, register, device, team, supplier and configuration data.
• Commerce records such as order items, transaction references, discounts, refunds, receipts, inventory movements and fulfilment status.
• Customer information entered by a merchant such as names, contact details, addresses, loyalty activity, preferences, order notes and support messages.
• Technical and usage information such as IP address, device and browser type, timestamps, diagnostic logs, security events and feature interactions.
• Support and communications including the content of enquiries, demonstrations, service requests and feedback.

Payment providers may collect payment credentials under their own privacy notices. Nodhum POS may receive a payment reference, method, amount and status needed to reconcile the transaction.

How we use information

We use personal data only for defined purposes, including to:

• provide, configure, secure and support the Nodhum POS services;
• authenticate users and manage permissions, outlets and devices;
• process and synchronise orders, receipts, inventory, loyalty and reports;
• communicate about the service, support requests, incidents and account changes;
• detect misuse, investigate errors and protect users, merchants and the platform;
• meet accounting, regulatory, legal and contractual obligations; and
• improve performance and features using aggregated or de-identified insights where practical.

Depending on the context and applicable law, processing may be based on consent, the performance of a contract, compliance with a legal obligation, or legitimate interests that do not override your rights.

How we share information

We do not sell personal data. We may disclose it only as needed to:

• the merchant that operates the account, its authorised users and outlets;
• hosting, communications, support, security, analytics and infrastructure providers working under contract;
• payment, delivery, accounting or other integrations enabled by the merchant;
• professional advisers, auditors and insurers under appropriate duties of confidentiality;
• authorities or other parties when disclosure is required by law or necessary to protect legal rights and safety; or
• a successor in connection with a merger, financing, reorganisation or sale, subject to appropriate safeguards.

Each merchant controls which integrations and authorised users it enables. Third-party services may apply their own terms and privacy notices.

International transfers

Some service providers or integrations may process information outside the Sultanate of Oman. Where personal data is transferred internationally, we assess the transfer and use contractual, technical and organisational safeguards appropriate to the destination, the information and applicable law.

Retention and security

We keep personal data only for as long as needed for the purposes described here, the merchant's documented instructions, contractual commitments, dispute resolution, and legal or accounting requirements. Retention periods vary by record type and account configuration. We delete or de-identify information when it is no longer required, unless the law requires it to be preserved.

We use proportionate administrative, technical and physical safeguards designed to protect personal data. These include access controls, tenant separation, encryption where appropriate, monitoring and incident-response practices. No online service can promise absolute security; please contact us promptly if you believe an account or device has been compromised.

Your choices and rights

Subject to applicable law and relevant exceptions, you may ask to access, correct, update, copy, transfer, block or delete your personal data, or withdraw consent for future processing. You may also object or complain about how your information is handled.

If your information was provided to Nodhum POS by a merchant, send your request to that merchant first. We support merchants in responding to verified requests. We may ask for information needed to confirm identity and authority before acting on a request.

You may also raise a complaint with Oman's Ministry of Transport, Communications and Information Technology. Personal Data Protection resources

Children's data

Nodhum POS's services are intended for businesses and authorised workplace users, not for children to open accounts independently. Merchants must obtain any consent or authorisation required before using the service to process a child's personal data. Contact us if you believe a child's data has been provided without proper authority.

Cookies and similar technologies

Our website and services may use essential cookies or local storage to maintain sessions, security and preferences. If we introduce non-essential analytics or advertising technologies, we will provide suitable notice and choices before using them where required. Browser controls can block or remove cookies, but some service functions may then stop working correctly.

Changes to this policy

We may update this policy as our services, practices or legal obligations change. We will post the revised version here and update the date above. If a change materially affects how we use personal data, we will provide additional notice when appropriate.