Privacy policy
Last updated 26 September 2026
Deco POS is point-of-sale software used by stores, cafes, bars and venues in New Zealand. This policy explains what personal information the Deco POS service collects, why, and how it is looked after. It is written to comply with the New Zealand Privacy Act 2020.
Who we are
Deco POS is operated by Retail Systems HB Limited, New Zealand. Questions about this policy or about your information go to hello@decopos.nz.
Two kinds of people
Stores - the businesses that use Deco POS. We hold their account details and everything they record while trading.
Customers of those stores - people who buy from a store, order from it online, hold an account or a loyalty balance with it, or order through a delivery marketplace. For their information the store is the agency that collects it and decides how it is used; Deco POS stores and processes it on the store's behalf.
What we collect
- Store accounts - the store's name, address, GST number, contact details, staff names and back-office logins (passwords and till codes are stored only as hashes), billing details and the settings the store chooses.
- Trading records - sales, refunds, payments, tabs, orders, stock movements, shift reports, and which till and staff member recorded them. Card payments are processed by the store's EFTPOS provider; Deco POS never sees a card number.
- Customer records a store keeps - a customer's name, phone, email, account balance, loyalty balances, membership standing, and any allergies or notes the store records so it can serve them.
- Online and marketplace orders - for an order placed on a store's ordering page, or delivered to the store by Uber Eats, we receive the order, the name given with it, a contact number or email where the customer supplied one, any special instructions and declared allergies, and the marketplace's own order number. Uber Eats orders are also handled under Uber's own privacy terms.
- Device and support data - which tills are registered, their software version, when they were last seen, memory readings, and - when a store asks for support - an activity log from the till describing what it did (sales, prints, payment terminal messages). The log never contains card numbers, PINs, till codes or passwords.
Why we use it
- To run the service: record sales, print dockets and receipts, keep tills in step, and produce the store's reports.
- To pass an order or a payment to the systems a store has connected - its EFTPOS provider, Uber Eats, Stripe, Xero, an email or text-message service - only as far as that connection needs.
- To support and improve the service: diagnose faults from logs and error records, and bill stores for their use.
We do not sell personal information, and we do not use a store's customer records for our own marketing.
Who it is shared with
- Services a store connects - Uber Eats (menus, order status), Stripe (online payments), Xero (invoices and daily takings), an SMS provider (order-status texts), and an email provider (receipts and invoices). Each receives only what its job needs and holds it under its own privacy policy.
- Automated document reading - a supplier invoice a store uploads is read by an AI service (OpenAI) to extract its line items. Only the uploaded document is sent.
- Hosting - the service runs on servers we operate, with encrypted backups.
- When the law requires it.
How it is protected
Data travels over TLS. Passwords and till codes are hashed. Credentials for connected services are encrypted at rest. Each store's data is kept in its own database. Access to a store's back office needs that store's own login.
How long we keep it
Trading records are kept for as long as the store is a customer, and afterwards for as long as New Zealand tax law requires (seven years). Till activity logs and server error records are kept for a short period for support and then removed. A store can ask for its data to be deleted when it leaves.
Your rights
Under the Privacy Act 2020 you can ask to see the personal information held about you and ask for it to be corrected. If a store holds it, ask the store; if it is about your Deco POS account, email hello@decopos.nz. If you are not satisfied with how a request is handled you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Changes
When this policy changes the date at the top moves and the current version is always at decopos.nz/privacy.