GDPR Compliance

The General Data Protection Regulation (GDPR) sets standards for collecting and processing personal data of individuals in the European Union. Tudepos supports customers who need to comply with GDPR when handling EU customer data through our platform.

Our role

When you use Tudepos to manage your retail business, you are typically the data controllerfor your customers' personal data. Tudepos acts as a data processor, processing personal data on your behalf according to your instructions and our agreement.

Data processing agreement

Enterprise customers and those handling EU personal data may request a Data Processing Agreement (DPA) that outlines our obligations as a processor, including data handling, sub-processors, and breach notification procedures. Contact legal@tudepos.com to request a DPA.

Lawful bases for processing

As a controller, you are responsible for identifying the lawful basis for processing personal data (e.g., consent, contract, legitimate interest). Tudepos provides tools to help you manage customer records and honour data subject requests.

Data subject rights

Under GDPR, individuals have the right to:

• Access their personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent where processing is consent-based

Tudepos enables you to export and delete customer records to help fulfil these requests. Contact our support team if you need assistance.

International transfers

Data may be processed in jurisdictions outside the EU. Where applicable, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) to ensure adequate protection for transferred data.

Sub-processors

We use trusted third-party providers for hosting, email delivery, and analytics. A list of sub-processors is available upon request. We notify customers of material changes to our sub-processor list.

Data retention

You control how long customer data is retained in your Tudepos account. We recommend establishing retention policies aligned with your legal obligations and deleting data that is no longer needed.