Privacy Notice for the Moloni POS app
This Privacy Notice aims to help you understand how Moloni processes your personal data when you use the Moloni POS app, available for iOS and Android, as a mobile point-of-sale terminal.
Roles and Responsibilities
Moloni Unipessoal, Lda. is an integral part of the Visma Group, a Norwegian group of software development companies. Moloni acts as the Data Controller for personal data related to your account and app usage (authentication, support, security, and subscription billing). When you use the app to process personal data of third parties within the scope of managing your business (e.g., employees, customers), Moloni acts as a Data Processor, under the terms of the service agreement and data processing agreement concluded with your organisation, with your organisation being the Data Controller for that processing.
Contact Us
If you have any comments or questions about this Privacy Notice, or any privacy concerns, including possible data breaches or inappropriate processing, please contact us via our support channels for routing or, if you wish to contact Moloni's Data Protection Officer directly, send an email to dpo@moloni.com.
You can also contact our operational address at:
Av. José Malhoa, n.º 2 - Tardoz
Ed. Malhoa Plaza, Escritório 1.5
1070-325 Lisboa, Portugal
Processing Activities
Data Processed for Service Provision
The app allows you to configure points of sale, organize the item catalogue, create and search for customers, issue sales documents, and calculate sales commissions, syncing in real-time with your Moloni account.
The lawful basis for this processing relies on the execution of the contract for services you have with Moloni, pursuant to GDPR Article 6(1)(b), and may also be based on legal obligations regarding tax and invoicing matters, pursuant to point (c) of the same Article, where applicable.
This data is retained under the terms of the Moloni Service Privacy Notice and our Data Retention Policy available at https://www.moloni.pt/legal/?file=retencao-dados.
Device Permissions
The app may use the device's camera as a barcode scanner for items and the location feature to discover nearby Bluetooth devices.
App Improvement and Security
We strive to ensure that the app operates correctly and securely. In this context, we note that this app does not collect diagnostic, usage data, or device identifiers for its own analytics, advertising, or error detection purposes distinct from the data processed for service provision described above.
Categories of Data Processed by the App
The table below summarises, by category, whether the app processes personal data falling under that type, based on the app's functionality and current declarations in the app stores:
How Your Personal Data May Be Shared
Within the Visma Group
The Visma Group consists of several subsidiaries. To ensure a consistent overall view and insights within an integrated knowledge framework, we may share your personal data among Visma Group companies. The objective is to optimise operations and provide you with a more integrated and seamless experience.
Outside the Visma Group
We may also share your personal data with external third parties, limited to the following contexts:
Subprocessors / Data Processors
We use data processors to process personal data. These processors are typically cloud-based service providers. When using data processors, we enter into a data processing agreement to safeguard your privacy rights. If processors are located outside the EU/EEA, we ensure the legal basis for such international transfers, for example, by implementing EU Standard Contractual Clauses. If you require more detailed information about our subprocessors, please contact dpo@moloni.com.
Public Authorities
Police and other authorities may request access to information held by us. This may include personal and non-personal data.
In all such cases, we follow strict internal policies and procedures to evaluate access requests and seek legal advice whenever necessary. We share only information strictly required by law, and only on the basis of court orders or other binding documents.
To prevent unauthorized access to any information we hold, we implement technical measures such as encryption and access controls. The Visma Security Program ensures high standards of security and confidentiality.
Furthermore, we ensure legal obligations in contracts with our subprocessors, guaranteeing that they also implement organizational and security measures similar to ours.
If we receive access requests from authorities outside the EEA, we ensure compliance with Article 32 of the Data Act. Internal policies and routines comply with this regulation.
Your Rights
You may exercise the following rights regarding our processing of your personal data:
- Access: You have the right to request a copy of the personal data we process about you.
- Rectification: You have the right to request the rectification of inaccurate personal data concerning you.
- Erasure: You may request the erasure of personal data concerning you.
- Restriction: You can ask us to restrict the processing of your personal data.
- Data Portability: You can ask us to provide you or others with your personal data in a structured, commonly used, and machine-readable format.
- Objection: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes. You also have the right to object to processing based on public interest or the exercise of official authority.
Please note that exceptions or limitations to the above-mentioned rights may apply depending on the specific circumstances of your situation. In such cases, we will provide detailed information about the applicable exception or limitation and assist you in exercising your rights to the fullest extent possible under applicable laws and regulations.
If you wish to exercise any of your data protection rights, please submit a support request on the Moloni website or send an email to dpo@moloni.com.
Finally, you also have the right to lodge a complaint with a data protection authority regarding our processing of your personal data. In Portugal, the supervisory authority is the National Data Protection Commission (Comissão Nacional de Proteção de Dados - CNPD), which can be contacted at geral@cnpd.pt.