Privacy policy

01 · Who we are

SOFTNEXIA SARL (“Softnexia”), a limited liability company with a share capital of MAD 100,000, registered office at 276, Bd Ibn Tachfine, 3rd floor, Casablanca, Morocco (ICE 003687144000055), publishes posnex.ma and the POSNEX point-of-sale software.

Softnexia is the data controller for the processing described here within the meaning of Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data. Processing is declared to the CNDP, the Moroccan data protection authority.

Contact: contact@posnex.ma, or by post at the registered office.

02 · The public site: analytics without tracking

The posnex.ma showcase site has no forms and collects no identifying personal data. It uses no tracking cookies, no advertising pixels and no third-party analytics.

To know which pages are read, we use Umami, an open-source analytics tool we host on our own servers: no data is sent to any third party. Umami sets no cookie and stores no IP address; each visit is identified by an anonymous fingerprint computed from the IP address, the browser and a secret salt rotated every day, which makes cross-day correlation impossible.

The information collected is limited to the page viewed, the referring page, the country, the device type and the browser language. If your browser sends the “Do Not Track” signal, nothing is measured.

Only strictly necessary technical cookies are set: the display language and theme (light or dark) chosen by the visitor.

Personal data collection only starts when you create an account in the POSNEX application, which carries no analytics at all.

03 · Data processed in the application

When you create a merchant account, Softnexia processes:

• Account data: name, e-mail address, password (hashed, never stored in clear text), language, role.
• Business data: trade name, address, phone, legal identifiers (ICE, IF, RC) if you enter them, logo, POS settings.
• Operational data you enter: products, stock, sales, receipts, invoices, quotes, suppliers, and your own customers' records (name, phone, e-mail, loyalty points), for which you remain the data controller.
• Subscription data: chosen plan, subscription invoices, uploaded transfer receipts, payment status. Card payments are handled by YouCan Pay; Softnexia never sees or stores card numbers.
• Technical data: login logs (date, IP address, browser), audit log of sensitive actions, support tickets and messages.

04 · Purposes and legal bases

• Providing the POSNEX service (POS, stock, invoicing, reports): performance of the contract.
• Billing the subscription and keeping accounts: legal obligation and performance of the contract.
• Securing accounts, preventing fraud and tracing sensitive actions: legitimate interest.
• Answering support requests: performance of the contract.
• Informing you about service changes: legitimate interest, with the option to opt out at any time.

Softnexia does not sell your data and does not use it for advertising.

05 · Isolation between businesses

Each business is isolated from the others at database level (row-level security policies). A user can only access the data of the business(es) they belong to, according to their role (owner, manager, cashier).

Softnexia staff only access an account for a support operation, at the customer's request, and every access is logged.

06 · Recipients and processors

Your data is processed by Softnexia and by the technical providers strictly necessary for the service:

• Server and database hosting (OVH, European Union).
• Transactional e-mails (Resend).
• Card payment of the subscription (YouCan Pay, Morocco).
• Sales channels you choose to connect yourself (for example the Tkadya marketplace): only the catalogue data needed is sent.
• No analytics provider: Umami runs on our own servers.

These providers are contractually bound to confidentiality and process data only on behalf of Softnexia. Data may be disclosed to authorities where the law requires it.

07 · Hosting and transfers

Data is hosted in the European Union on hardened servers, encrypted in transit (TLS) and backed up regularly. Any transfer outside Morocco complies with law 09-08 and appropriate safeguards.

08 · Retention periods

• Account and business data: for the duration of the subscription, then 12 months after closure to allow reactivation or export.
• Subscription invoices and receipts: 10 years (accounting obligations).
• Login and audit logs: 12 months.
• Showcase-site analytics (aggregated, no identifying data): 24 months.
• Support tickets: 24 months after closure.

Operational data (sales, invoices, stock) belongs to you: you can export it at any time from the application.

09 · Your rights

Under law 09-08 you have the right to access, rectify, object to and delete your personal data, and to withdraw consent where processing is based on it.

To exercise them, write to contact@posnex.ma describing your request; you will receive an answer within 30 days. You may also refer to the CNDP (www.cndp.ma).

If you are a customer of a business using POSNEX, address your request to that business first: it is the controller of your customer record, and Softnexia assists it in answering.

10 · Cookies

The site and the application only set strictly necessary cookies: authentication session (application), display language and theme. They are not used for advertising; the showcase site's analytics work without any cookie (see article 02), so no consent banner is required.

You can delete them at any time from your browser settings; the application will then ask you to sign in again.

11 · Changes

Softnexia may update this policy. The update date appears at the top of the page; in case of substantial change, account holders are notified by e-mail.