Privacy Policy

Syd Solution Tech ("we," "our," or "us") respects your privacy and is committed to protecting personal information processed through SydPOS ("the Service").

SydPOS is a business management platform providing point-of-sale, inventory management, sales reporting, customer management, and enterprise resource planning functionalities through Android applications and web-based services.

This Privacy Policy explains how we collect, use, store, protect, share, retain, and delete information when businesses and their authorized users access our Service.

We aim to comply with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines, its implementing rules and regulations, and other applicable data protection laws.

Depending on the features used, SydPOS may process the following categories of information.

2.1 Business Account Information

• Business name and contact details
• Business address and branch information
• Account holder's name
• Email address and telephone number
• Usernames and authentication credentials
• Subscription and billing information

2.2 Employee and Authorized User Information

• Employee names and user identifiers
• Assigned roles and permissions
• User activity and audit logs
• Transaction and operational activity
• Login and authentication records

2.3 Sales and Transaction Information

• Sales transactions and transaction identifiers
• Product and service information
• Quantities, prices, discounts, and taxes
• Payment methods and payment status
• Refunds, returns, and transaction adjustments
• Receipts and invoice information

2.4 Inventory and Operational Information

• Product catalogs and stock quantities
• Inventory movements and adjustments
• Purchasing information and supplier records
• Branch information
• Operational expenses
• Sales and business performance reports

2.5 Customer Information

When entered by a business using SydPOS, customer information may include:

• Customer names
• Contact numbers and email addresses
• Purchase histories
• Customer accounts and loyalty information
• Other information supplied by the business for authorized operational purposes

Businesses are responsible for determining what customer information they need to collect and ensuring that such collection and processing are lawful.

2.6 Device and Technical Information

Depending on the device, application configuration, and enabled features, SydPOS may process:

• Device identifiers used for application management
• Device model and operating system version
• Application version
• Internet Protocol address
• Application activity and diagnostic information
• Error reports and crash logs
• Synchronization status and technical logs

We process this information to support application operations, troubleshoot technical issues, maintain system security, and improve reliability.

We process information for legitimate business and operational purposes, including:

1. Creating and managing business accounts.
2. Authenticating users and managing access permissions.
3. Processing sales and recording transactions.
4. Managing products, inventory, purchasing, and suppliers.
5. Generating business reports and analytics.
6. Supporting customer and loyalty management functions.
7. Synchronizing information between authorized devices and connected services.
8. Providing technical support and troubleshooting.
9. Detecting unauthorized access, fraud, and security incidents.
10. Maintaining system reliability and improving the Service.
11. Managing subscriptions and billing.
12. Complying with applicable laws and lawful requests.

We do not use business transaction data for unrelated purposes without an appropriate lawful basis.

Where applicable, personal information may be processed on the following legal grounds:

• Contractual necessity: To provide services requested under an agreement.
• Legal obligations: To comply with applicable legal and regulatory requirements.
• Legitimate interests: To maintain security, prevent fraud, and operate or improve our services, where permitted by law.
• Consent: Where consent is required for specific processing activities.

Where Syd Solution Tech processes customer or employee information on behalf of a business, the business is generally responsible for identifying and establishing the applicable lawful basis.

Businesses using SydPOS generally determine the purposes and means of processing their customer, employee, and transaction information.

In such circumstances:

• The business generally acts as the Personal Information Controller.
• Syd Solution Tech generally acts as a Personal Information Processor, processing information on behalf of the business.
• Syd Solution Tech may separately act as a Personal Information Controller for its own account administration, subscription, support, and security-related processing.

Businesses are responsible for managing authorized users, configuring access permissions, and complying with applicable privacy requirements concerning the information they collect.

Syd Solution Tech does not claim ownership of business data merely because it is processed or stored through SydPOS.

SydPOS may support offline operations through local storage on authorized devices.

Depending on the system configuration:

• Transaction and operational information may be stored locally.
• Locally stored information may be synchronized with connected services when network connectivity becomes available.
• Authorized users may access synchronized information based on their assigned roles and permissions.

Businesses should protect devices containing locally stored information against loss, theft, unauthorized access, and misuse.

Uninstalling SydPOS or clearing local application data does not necessarily delete information previously synchronized with the server.

We do not sell personal information to data brokers or advertisers.

We may disclose information to the following recipients where necessary and legally permitted:

• Authorized personnel of the business account.
• Hosting, infrastructure, and technical service providers.
• Providers supporting application diagnostics, security, authentication, communications, or payments, where integrated and enabled.
• Regulatory authorities or law enforcement agencies when legally required.
• Other recipients authorized by the business or data subject, where applicable.

Third-party providers may process information only for relevant purposes and subject to applicable contractual and data protection requirements.

Information is not shared with unrelated businesses for their independent marketing purposes without a lawful basis.

We take reasonable organizational, physical, and technical measures to protect information against unauthorized access, loss, alteration, disclosure, and misuse.

Depending on the system component, these measures may include:

• User authentication and access controls
• Role-based permissions
• Encrypted communications
• Security monitoring and audit logging
• Restricted access to production systems
• Backup and recovery procedures
• Security maintenance and vulnerability remediation

No electronic storage or transmission system can be guaranteed to be completely secure.

Businesses and authorized users are responsible for protecting their account credentials, maintaining device security, and assigning access only to appropriate personnel.

We retain information only for as long as reasonably necessary to fulfill the purposes identified in this policy or to satisfy applicable contractual, regulatory, legal, accounting, and security requirements.

Retention periods may vary according to the type of information and the applicable legal obligations.

The following retention periods apply to inactive accounts and their associated data:

• Free trial accounts: If the business does not subscribe, its account and associated data will be deleted seven days after the free trial ends.
• Expired subscriptions: If the business does not renew its subscription, its account and associated data will be deleted two months after the subscription expires.

These deletion schedules are subject to applicable legal retention requirements described below.

Business transaction records may need to be retained for statutory recordkeeping requirements even after a subscription ends.

When information is no longer required, it will be deleted, anonymized, or otherwise securely disposed of in accordance with applicable requirements.

Business account administrators may request deletion of their accounts and associated information by contacting Syd Solution Tech through its official website.

Account deletion request page: https://sydpos.ph/request-account-deletion

Authorized employees may also contact their business administrator regarding account removal.

Upon receiving a valid deletion request, we will:

1. Verify the requester's identity and authority.
2. Review the relevant account and applicable retention requirements.
3. Delete or anonymize eligible information.
4. Retain information only when required or otherwise permitted by law.
5. Provide confirmation or an explanation of any applicable retention limitations.

Some information may remain in protected backups until the applicable backup retention period expires, subject to appropriate access restrictions.

Deletion of an individual employee account does not automatically require deletion of business transactions that the employee previously processed.

Under the Philippine Data Privacy Act of 2012, individuals have rights concerning their personal information, subject to applicable legal conditions and exceptions.

These may include:

• The right to be informed
• The right to access personal information
• The right to object to certain processing
• The right to correct inaccurate information
• The right to request erasure or blocking
• The right to data portability
• The right to file a complaint with the National Privacy Commission
• The right to damages where legally applicable

Requests involving information controlled by a business using SydPOS may need to be directed to that business.

Syd Solution Tech will provide appropriate assistance where required.

SydPOS may integrate with third-party services for infrastructure hosting, application diagnostics, communication, payments, or other business functions.

Each provider may have its own privacy practices.

We encourage users and businesses to review applicable third-party privacy notices.

Third-party integrations will be disclosed where applicable and implemented subject to relevant privacy and security requirements.

Information may be processed or stored outside the Philippines if Syd Solution Tech or its authorized service providers use infrastructure located in other jurisdictions.

Where cross-border processing occurs, appropriate safeguards will be implemented as required by applicable law.

SydPOS is intended for business operations and is not designed for use by children.

We do not intentionally collect personal information directly from children for independent consumer accounts.

Businesses must ensure that any information concerning minors processed through the Service is collected and handled lawfully.

If a security incident affecting personal information occurs, Syd Solution Tech will investigate and take appropriate containment and remediation measures.

Where required by applicable law, we will coordinate with affected business customers and notify relevant authorities and affected individuals within applicable deadlines.

We may update this Privacy Policy to reflect changes in our services, data processing activities, legal obligations, or security practices.

The revised policy will be published with an updated effective date.

Where required, we will provide additional notice of material changes.

For questions, privacy concerns, data access requests, or deletion requests, please contact:

We will review privacy-related requests and respond in accordance with applicable laws.