Privacy Policy

Dynamic Web Lab FZE LLC ("PausePOS", "we", "us", or "our") is committed to protecting your privacy and complying with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the PausePOS platform, websites, and related services (the "Service").

This Policy applies to all personal data we process as a Data Controller (for our own customers and staff) and as a Data Processor (for the customer data our Customers upload to the Service).

We act as a Data Controller for personal data you provide directly to us (e.g., your account contact information). When you use the Service to process personal data of your own customers or staff, we act as a Data Processor on your behalf, and our Data Processing Agreement (DPA) governs that processing.

We collect the following categories of personal data:

• Identity Data: Name, trade licence number and Tax Registration Number (TRN); and, only where we need to verify who is signing up for an account, an Emirates ID or passport number.
• Contact Data: Business address, email address, phone number, WhatsApp number.
• Transaction Data: Sales records, payment references, invoices, refund records, customer names, and amounts.
• Technical Data: IP address, browser type, device type (e.g., Sunmi, Android, Windows, iOS), operating system, session duration, page views.
• End-customer Data: Names, phone numbers, email addresses, and purchase history of your customers that you load into the Service.
• Communications: Support requests, emails, chat messages, and feedback you send to us.

We use personal data only for specified, explicit, and legitimate purposes, including:

• Providing, operating, and maintaining the Service.
• Processing payments and managing your subscription.
• Generating electronic invoices in PINT-AE format and submitting them to your chosen Accredited Service Provider.
• Verifying your identity where needed to prevent fraud or to meet a legal obligation.
• Responding to your support requests and providing customer service.
• Detecting, preventing, and addressing fraud, security incidents, and abuse.
• Complying with UAE legal, regulatory, and tax obligations.
• Sending you service-related notices (security alerts, billing, policy changes) — these are not marketing.
• With your consent, sending marketing communications about new features, plans, and offers (you can withdraw consent at any time).

We process personal data only where the PDPL allows it:

• Consent: For marketing communications and optional (analytics) cookies. You can withdraw consent at any time.
• Contract: To provide, secure and support the Service you subscribed to, including preventing fraud and abuse, and to take steps you ask for before subscribing (for example, a demo).
• Legal obligation: To comply with UAE law, including tax law, and with orders of UAE courts and authorities.
• Legal claims: To establish, exercise or defend legal claims.

Customer Data — the Pause POS application, your account and the business data you load into it — is stored in the United Arab Emirates, on servers provided by Oracle Cloud Infrastructure in its Dubai region. Daily encrypted backups are also stored in the UAE, with Microsoft Azure in its UAE North (Dubai) region.

Our marketing website (pausepos.com) and our public demo, which contains sample data only, are hosted in Germany by Contabo GmbH; they do not hold Customer Data. Do not enter real personal data in the demo. Traffic to our website, and to the Service where Cloudflare handles it, passes through Cloudflare's global network (CDN, DNS and DDoS protection), and error reports may be processed by Sentry, so limited data in transit or in error reports may be processed outside the UAE. See Section 7 for all sub-processors and Section 8 for the safeguards.

We use the following sub-processors to provide the Service. Each is bound by a written agreement that requires it to protect personal data and to use it only to provide its service to us:

Customer Data is stored in the UAE. A limited amount of personal data may be processed outside the UAE: network traffic handled by Cloudflare, error reports processed by Sentry, and website analytics processed by Google with your consent. We transfer personal data outside the UAE only as Articles 22 and 23 of the PDPL allow: these providers operate under comprehensive personal data protection laws (such as the EU General Data Protection Regulation) with independent supervisory authorities, the transfers are necessary to provide the Service under our contract with you, we limit the data sent (for example, error reports exclude IP addresses, cookies and request bodies), and each provider is bound by contractual terms that require it to protect personal data. The UAE has not yet published its list of approved countries or the Executive Regulations on transfers; when it does, we will review this section and change our safeguards if needed. You can ask [email protected] for details.

We do not sell, rent, or trade personal data. We share personal data only with: (a) sub-processors listed in Section 7 to provide the Service; (b) UAE government authorities, the Federal Tax Authority, or law enforcement where required by UAE law or valid court order; (c) banks and payment processors to process your subscription payments; (d) auditors, legal counsel, and professional advisors under confidentiality obligations; and (e) a successor entity in the event of a merger, acquisition, or sale of PausePOS, with notice to you.

We retain personal data for as long as necessary to provide the Service and comply with UAE legal obligations. Specific retention periods:

• Account and billing data: For the duration of the subscription plus 7 years, the longest record-keeping period in UAE tax law.
• Your POS data (sales, invoices, customer records you load into the Service): While your account is active and for 90 days after termination so you can export it, then deleted. You are responsible for keeping the business records UAE tax law requires you to keep.
• Audit logs: kept for the life of your account database, which is deleted with your other Customer Data after the post-termination retention period.
• Support communications: 3 years from last interaction.
• Marketing consent records: Until consent is withdrawn, plus 3 years.
• Backups: Deleted after 30 days on a rolling basis.

We implement technical and organizational measures to protect personal data, including: TLS encryption in transit, role-based access control with least privilege, two-factor authentication available for user accounts, a separate database for every customer, isolation of services in separate containers and networks, and daily off-server backups stored with encryption at rest.

If a personal data breach affects personal data we control, we will notify the UAE Data Office and the affected individuals as Article 9 of the PDPL requires. Where we process data for a Customer, we notify that Customer as soon as we become aware of a breach, so it can meet its own obligations.

As a data subject, you have the following rights. To exercise any of these rights, email [email protected] and we will respond within 30 days:

If you are a customer of a business that uses Pause POS (for example, a café), that business controls your data. Please contact it first; we will help it respond to your request.

• Right of access (PDPL Art. 13): Request information about, and a copy of, the personal data we hold about you.
• Right to correction (PDPL Art. 15): Request correction of inaccurate or incomplete data.
• Right to erasure (PDPL Art. 15): Request deletion of your personal data, subject to legal retention obligations.
• Right to restrict processing (PDPL Art. 16): Request that we limit how we process your data.
• Right to data portability (PDPL Art. 14): Receive your data in a structured, commonly used, machine-readable format.
• Right to object (PDPL Art. 17): Object to processing, including for direct marketing.
• Right to withdraw consent (PDPL Art. 6): Withdraw any consent you previously gave, at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint (PDPL Art. 24): Lodge a complaint with the UAE Data Office, the regulator named in the PDPL.

We use essential cookies that are strictly necessary for the Service to function (authentication, session management, security). With your consent, we also use Google Analytics 4, provided by Google, to understand how visitors use our marketing website. Analytics cookies are only set after you choose "Accept All" in the cookie banner, and Google may process this data outside the UAE. We do not use advertising cookies, and Google's advertising features are disabled. You can withdraw consent at any time by clearing cookies for pausepos.com and choosing "Essential Only".

We may send you marketing emails about new features, plans, and offers only if you have given consent (via the signup form, an opt-in checkbox, or by requesting a demo). You can withdraw consent at any time by clicking "unsubscribe" in any marketing email or by emailing [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing for the Service itself.

The Service is intended for use by businesses and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child in error, please contact [email protected] and we will delete it within 7 days.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects. The Service does not currently include AI features; if we add optional AI features, they will be suggestions only and require human review before any business action is taken.

We may update this Privacy Policy from time to time. Material changes will be notified by email and in-app notification at least 30 days before they take effect. The latest version is always available at pausepos.com/privacy.

For all privacy questions, data subject requests, or complaints, please contact our Data Protection Officer: