Privacy policy for the TWT Kasse app

Scope

This privacy policy applies to the TWT Kasse Android app (de.tatwelletech.kasse) of TWT- Tat Welle Tech GbR. It adds to our privacy policy for the website.

Controller

What the app is

The app is a way into your account on our platform. It shows and edits the same data as the web portal. No business data stays on the device, except documents you save there yourself.

Which data is processed

• Account data: your name and e-mail address, to sign you in and to manage your account (Art. 6(1)(b) GDPR).
• Your company's business data that you enter yourself: sales and receipts, register closings, the cash book, supplier invoices and the details of your customers and suppliers (name, address, e-mail, phone, VAT ID). We process this data on behalf of the company that holds the account (Art. 28 GDPR).
• Files you choose to have an e-invoice validated or converted, and documents you upload as supplier invoices.
• A record of the changes made to documents, for security and to keep the books traceable as German bookkeeping rules require (Art. 6(1)(c) and (f) GDPR).
• For notifications: an identifier of this installation, the device model and the app's version. Notifications are sent by our own service on our own servers, not through Google Firebase. The identifier is deleted when you sign out.

Card payments on the phone (Tap to Pay)

When your shop takes a card on the phone, the software of our payment processor Stripe (Stripe Payments Europe, Ltd.) reads the card and sends the card data directly to Stripe. We receive only what the receipt shows: the card brand, the last four digits, the card application and the approval code. During a card payment Stripe requires the phone's approximate location and checks the device, to prevent fraud; the app asks for it at the first card payment.

Stripe's privacy policy

Technical security device (TSE)

Every sale is signed by a technical security device, as § 146a of the German Fiscal Code requires. We use the cloud TSE of fiskaly GmbH as our processor. It receives a sale's transaction data (amounts, payment types, time, register), no data about your customers.

Receipt printer and cash drawer

The app reaches the receipt printer and the cash drawer over Bluetooth, and only devices you have paired with the phone yourself. Only the receipt and the command to open the drawer travel over that connection. The app does not search for nearby devices.

Barcode and document scanner

The barcode and document scanners are screens of Google Play services; the app itself has no access to the camera. A scanned document is uploaded to our servers and read there. Google may collect diagnostic data under its terms for ML Kit.

What the app does not do

The app shows no advertising, uses no advertising ID, contains no analytics or tracking services and reads neither contacts nor photos. It asks for the location only during a card payment, as described above.

Unlocking with your fingerprint

When you unlock the app with your fingerprint, the match is made by Android on your device alone. We receive no biometric data.

Security and where the data lives

Every connection is encrypted (TLS). The app's sign-in credentials are kept in Android's protected key store. The platform runs on our own servers in Germany.

Retention and deletion

Account data is kept for the term of the contract. After the contract ends, the data can be exported for 90 days; then access is closed, and all data that need not be kept is deleted within 30 days. Records that tax law requires us to keep are kept until the legal period ends: eight years (§ 147 AO, § 14b UStG).

How to request the deletion of your account

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Our privacy policy gives the details and names the competent authority:

Privacy Policy

To exercise any of these rights, please contact us at: info@tatwelletech.com