Privacy Policy
Draft — not yet in force1. Who is responsible for the data
| Organisation | Role | Responsible for |
|---|---|---|
| Your business's bank | Controller | The records of your business, its tills and its payments held in the ZAM Service, which Techween hosts and operates for the bank |
| Techween | Publisher of the App; processor for the bank | Publishing the App, and running the ZAM Service on the bank's instructions under a written data processing agreement and Kuwaiti banking secrecy. Techween does not use the data for any purpose of its own |
| Your business | Controller of its own copies | Statements exported from the App, and the till devices themselves |
2. What data the App handles
2.1 Stored on the till device
In the device's secure storage (iOS Keychain or Android encrypted storage):
- the till's credential, issued when the device was linked;
- the push notification token last registered for the device;
- your sound, pay-by-sound and appearance settings, and the currency and time zone of the service;
- if a customer display is paired, its address on your network, the access token it issued and the merchant details sent to it.
In the App's files: the merchant logo, cached, and any statements you export (PDF or Excel), which stay in the App's documents folder until you delete them and, on iPhone and iPad, are visible in the Files app.
2.2 Sent to the ZAM Service when a device is linked
The link code; a random device identifier the App creates (not a hardware serial number); the push notification token; the device's operating system and version, model, manufacturer and brand, whether it is a physical device, and on iPhone and iPad the device name set in the device's settings; and a report of the device's integrity (whether it is rooted, jailbroken, an emulator, under a debugger, hooked or a modified copy of the App).
2.3 Sent and received when you take payments
The App sends the amount and your note for each request, and cancellations and voids with the PIN and optional reason. It receives the till's details (till name and identifier, your business's name, contact email and phone, logo and colours, and the bank's name), and for each payment its reference, amount, note, times, status, authorization code, and the customer's display name supplied by the customer's bank.
2.4 Shared from the device by you
When you export a statement or share a payment, the App hands the file or text to the app you choose through your phone's share menu. It then leaves Techween's and the bank's control.
2.5 Sent to a paired customer display
Over your local network, without encryption (Part A, Section 7): the payment details above including the customer's display name, and your business's name, contact details, logo and colours. The till's credential is never sent.
2.6 What the App does not collect
The App does not collect location, contacts, photos or advertising identifiers, and contains no advertising or analytics software and no crash reporting. The microphone is used only while a payment code is on screen with pay by sound in "answer" mode: the sound is decoded in the device's memory and is neither stored nor sent. The camera is used only to scan a link code. NFC, where the device has it and tap to pay is switched on, is used only to present the payment code on screen to a customer's phone held against the device; nothing is read from the customer's phone. None of the three is used for anything else.
3. Why the data is processed
| Purpose | Data | Basis |
|---|---|---|
| Link the till and take payments | Credential, device identifier, payment fields | The Merchant Agreement and these Terms |
| Notify the till of approvals, declines and reversals | Push token, payment reference and status | The Merchant Agreement and these Terms |
| Security and fraud prevention | Device details and integrity report, request logs | The bank's legitimate interest and its obligations under Central Bank of Kuwait rules |
| Settlement, statements and disputes | Payment records | The Merchant Agreement; the bank's legal obligations |
4. Who receives the data
- The ZAM Service, hosted by Techween for your business's bank.
- Your business's bank, and the customer's bank for the payment it approved.
- Google Firebase Cloud Messaging, which delivers notifications to the till and receives the device's push token and the notification (payment reference and status).
- Google Fonts, from which the App downloads the typefaces for exported PDF statements; Google receives the device's internet address.
- Regulators and authorities where the laws of Kuwait require.
Nobody sells this data, and it is not used for advertising.
5. Where it is kept
The ZAM Service is hosted by Techween for the bank in [PLACEHOLDER — Google Cloud, Doha, Qatar, subject to the Central Bank of Kuwait's no-objection / Kuwait], encrypted, with access limited to named Techween staff under the bank's audit. Data on the till device stays on the device.
6. How long it is kept
| Data | Retention |
|---|---|
| Credential, settings and paired display on the device | Until the device is unlinked or the App is removed |
| Exported statements on the device | Until you delete them |
| Device registration at the ZAM Service | Until the till is unlinked, then with the payment records |
| Payment records and request logs | At least ten (10) years, as Central Bank of Kuwait record-keeping rules require |
7. How it is protected
Every connection to the ZAM Service uses TLS 1.2 or higher, and the till's credential is kept in the device's secure storage. The App refuses to run on a compromised device and checks again whenever it returns to the screen. Voids need a manager PIN that the App cannot read back. Staff access to the ZAM Service is individually identified and logged.
8. Your rights
Subject to the laws of Kuwait, the people whose data the App handles may ask to access or correct it, or object to its use. Requests about the records of your business and its payments go to your business's bank, which holds them; requests about the App go to Techween at the address below. You may complain to the Central Bank of Kuwait or to the Communication and Information Technology Regulatory Authority (CITRA).
9. Changes to this Policy
We will publish changes in the App and on techween.net, and ask again in the App before a change that matters takes effect.
10. Contact
Techween: support@techween.net · Data protection contact: [PLACEHOLDER] · Postal address: [PLACEHOLDER]