UPOS privacy policy
Last updated:
This policy explains what data the UPOS service collects, what it is used for, who it is shared with, how long it is kept and how it is protected.
The service and its operator
UPOS is a retail system for shops: a browser-based back office (web), a till application for Windows and a mobile app for Android. UPOS is part of the DT ecosystem; the service is operated by DT.
You sign in to UPOS with a DT account (DT ID). Shop staff can also sign in to the till with a login, password or PIN code issued by the shop.
This policy applies to all parts of UPOS and to this website.
Who is responsible for what
A shop enters data about its products, sales, customers and staff into UPOS itself and is responsible for that data. UPOS processes it on the shop's behalf and only to provide the service.
Your DT account data (name, phone number) is stored in the DT Identity service and managed by DT.
What data is collected
When you use the service, the following data is collected and stored:
- DT account: name, phone number and account identifier — received from DT Identity when you sign in. Your password is not stored in UPOS: DT Identity verifies it.
- Shop and business data: organisation and branches, products and prices, stock receipts and balances, sales receipts and returns, payment methods (cash, card, etc. — card numbers are not collected), expenses, till shifts and reports.
- Customers and debtors: name, phone number, passport details, address, debt and payment history — entered by the shop.
- Company details: the taxpayer number (STIR) of a legal entity or the personal identification number (JShShIR) of a sole trader, the name and other details.
- Staff: name, phone number, login, branch and access rights, PIN code. Passwords and PIN codes are never stored in plain form — only as an irreversible hash.
- Device data: device name and identifier — to link the Windows till application to a shop.
- Technical logs: request time, IP address and error messages — for security and troubleshooting.
- The “Leave a request” form on the website: name, phone number, business type, number of branches, region, address, a point on the map (optional) and campaign tags (UTM) — so that we can contact you.
Mobile app: camera and permissions
The Android app uses the camera only to scan product barcodes. Camera frames are not saved as photos and are not sent anywhere — the app receives only the decoded code. If you do not grant camera access, the app still works: you can search for products manually.
Scanning runs on the device itself using the Google ML Kit library. To monitor its own operation, ML Kit may send Google a device identifier as well as diagnostic and performance data. Details: developers.google.com/ml-kit/android-data-disclosure.
Locking the app with a PIN code or fingerprint is optional. Biometric data is checked by the device's operating system — it is never passed to the app or to us.
The app requests only these permissions: internet and network state (for offline / online mode), camera (scanner) and biometrics (optional lock). It does not request location, microphone, contacts, SMS, file storage or Bluetooth permissions. The app itself does not send device identifiers (Android ID, advertising ID).
What the data is used for
- Providing the service: sales, stock, prices, debts and till shifts.
- Synchronisation: sales recorded by a till while offline are sent to the server once the connection is back, so the web, till and app show the same data.
- Reports: sales, stock, debts and shifts.
- Security: verifying sign-ins, protecting accounts, detecting abuse and faults.
- Support: answering your questions and requests.
Data is not used for advertising and is never sold. No advertising identifier or tracking tools are used.
Transfer and protection
- Data between the apps and the server is transferred encrypted over HTTPS (TLS).
- Sign-in tokens are kept in protected storage: in the Android app — in the device's encrypted storage (Android Keystore), in the Windows till application — encrypted by the operating system, in the browser — in HttpOnly cookies that page scripts cannot read.
- So that the till can work offline, the product catalogue and sales not yet sent are stored on the device itself and sent to the server once the connection is back.
- Each shop sees only its own data; within a shop, access to data is limited by roles and permissions.
How long data is kept
- Account and shop data is kept for as long as the account is active. After your DT account is deleted, your personal profile in UPOS is kept until your deletion request is completed; requests are completed within 30 days.
- Sales, debt, payment and till shift records belong to the shop (company) and are kept for the period required by the tax and accounting laws of the Republic of Uzbekistan.
- Technical logs are kept for a limited period and then deleted.
- Website requests are kept for as long as needed to review them and contact you.
Your rights
- Access and correction: you can view and correct shop and profile data in UPOS; DT account data (name, phone) — in the DT cabinet: id.dt.uz/cabinet.
- Deletion: your DT account is deleted in the DT cabinet; your profile, access and device sign-in keys in UPOS — on request, within 30 days. Details: the Delete account page.
- To ask how your data is processed, withdraw consent or file a complaint, message DT support on Telegram: t.me/DT_ECOSYSTEM_SUPPORT.
If your data was entered by a shop (for example, you are a customer or debtor of that shop), please contact the shop first — the shop decides on correcting or deleting such data. If you cannot reach the shop, write to us.
Children
UPOS is a business service intended for users aged 18 and over. We do not knowingly collect data about children.
Changes to this policy
This policy may be updated. A new version is published on this page and the “Last updated” date at the top changes.
Contact
Privacy questions and requests — DT support on Telegram: t.me/DT_ECOSYSTEM_SUPPORT. The service is operated by DT.