Komos app privacy policy
Last updated:
This is the privacy policy of Komos, the Android app of your business's Komos till (POS). Further down, the till is simply called "the till".
In short
- The app only talks to your business's till (and to the demo, if you try it); it uses no analytics, advertising or tracking. This website counts visits without cookies (section 14).
- Your staff and sales data belong to your business; Komos keeps copies for it, in Spain.
- You can ask us to delete data; we will tell you what must be kept by law and for how long.
1. Who is responsible
- Controller
- Rubén Lozano Díaz, self-employed
- Application
- Komos (es.komos.app)
- Privacy contact
- contacto@komos.es
2. What this policy covers
This policy covers the Komos app for Android and the Komos till it connects to. It does not cover the customer portal or Komos Reservas, which have their own notices, except for cookies (section 15). This website (komos.es) is explained separately, in section 14.
3. Who decides about each piece of data
Komos is responsible for the data of the app and the device. The staff and sales data of a business's till belong to that business, which is the controller; Komos only handles it on the business's behalf (as processor), in the copies it keeps for the business.
4. What the app keeps on your device
- The till's address, a value that identifies your till (the certificate fingerprint), the signed-in session (session cookie) and temporary photos.
- In the demo, the app also keeps a demo access cookie and the sample till's session; both are deleted when you leave the demo.
- None of this goes into Android backups.
- The camera only reads QR codes: images are read on the device and are not saved.
- The app sends data only to your business's till and, in the demo, to demo.komos.es. It uses no analytics, advertising or tracking.
- The Share button in diagnostics sends the text only where you choose.
- Android's web component (Google) keeps safe browsing on; the app turns off sending usage metrics.
5. What the till keeps in the business
Staff names and roles, an encrypted digest of their PINs (never the PIN), sales, open tabs and their names, payments by method (no card data), invoices, shifts and the till's action history (audit log), by user ID. It keeps no personal data of end customers. All of it stays on the till.
Retention: shift records, 4 years; staff roster, 13 months; the rest, for as long as the business uses the till.
6. What the till sends to Komos
| Data | When | How long it is kept |
|---|---|---|
| A regular notice that the till is working ("heartbeat"): installation ID, versions, status, uptime and network address | Every 6 hours | Each notice stays in our access log for 400 days and is then deleted. We also keep the last notice received from each till, which is replaced by the next one. |
| Settings copy: staff, roles, encrypted PINs, menu, photos | Every night | While you use Komos, we keep the most recent copy of each till and those received in the previous 15 days. If you retire a till, its copies are deleted 12 months later. If the business leaves Komos, we delete nothing for 3 months; at 3 months only the most recent copy of each till remains, and at 12 months all are deleted. A Komos administrator can recover a deleted copy for 35 days; after that it is gone. |
| Archive of tickets and invoices (without staff names) | Every day | We keep each month for 6 years, counted from the end of its year, because the law requires it. If the business leaves Komos, we tell you so you can download it and we delete it 12 months after closing, even if 6 years have not passed; from then on the business keeps it. A Komos administrator can recover what was deleted for 35 days. |
| Technical logs, only if a manager turns on detailed diagnostic mode (debug mode), without names or PINs | While it is on | 15 days; a Komos administrator can recover them for 35 more days |
7. The demo
When you enter the demo, demo.komos.es receives the access code, only to check it: it does not keep it. It also receives what you type into the sample till. This is shared sample data that other people with access to the demo can see: do not enter real data. What you type is deleted when the demo restarts, after 7 days at most. The demo's technical logs, which do not keep what you type, are deleted after 30 days.
8. Why we use the data
- To provide the service the business has contracted, including restoring and the tax archive: contract and the business's legal obligation.
- Licence, updates and security: legitimate interest.
- Support logs: because a manager turns on detailed diagnostic mode (debug mode).
9. Who receives the data
Amazon Web Services, as hosting provider, with the data in Spain (AWS region eu-south-2). Komos staff, over a private network. The business owner, through the portal. We do not sell data or transfer it outside the European Union. Google only distributes the app on Google Play, under its own policy.
10. Security
Encryption in all communications (TLS), a check that the app is talking to your till and not to another machine (certificate pinning), signed notices from the tills, encrypted storage, and limited, audited access for Komos staff.
11. Your rights
You can ask for access, rectification, erasure, restriction, objection and portability by writing to contacto@komos.es or by following the page Delete account and data. If you are not satisfied, you can complain to the Spanish Data Protection Agency (www.aepd.es).
12. Children
Komos is for businesses and is not aimed at children.
13. Changes to this policy
We will publish changes at this same address and update the date above.
14. This website
This section is only about the komos.es website, not about the app or the till. To know how many people visit it we use Cloudflare Web Analytics, with Cloudflare as processor. It counts page views, the page you come from, the country and the type of device. To serve the counter and work out the country, Cloudflare processes the IP address of your connection, but does not store it. It installs no cookies and does not follow you across websites, which is why the website shows no cookie notice.
15. Cookies
This section covers komos.es and the customer portal (portal.komos.es). The komos.es website installs no cookies, and Cloudflare's analytics does not use cookies either. The portal only uses what is essential for it to work or what you choose, which does not need your consent (article 22.2 of the LSSI); that is why we show no cookie notice. We list it all the same:
| Name | Site | What it is for | Type | Duration |
|---|---|---|---|---|
__Host-komos_portal_session | portal.komos.es | Keeping you signed in. Essential. | First-party | Up to 30 days without use and 90 days at most |
__Host-komos_portal_reg | portal.komos.es | Remembering your sign-up while you complete it. Essential. | First-party | 30 minutes |
__Host-komos_portal_oauth and __Host-komos_portal_code | portal.komos.es | Completing sign-in with Google or with a code. Essential. | First-party | 10 and 15 minutes |
aws-waf-token | portal.komos.es | Security: checking that whoever asks for a code is not a robot. Installed by Amazon Web Services on our behalf. Essential. | First-party, installed by AWS | The check is valid for 30 minutes when signing up and 5 minutes when asking for a code |
komos.portal.lang (browser local storage) | portal.komos.es | Remembering the language you choose. | First-party | Until you delete it |
komos.captcha.reloaded (tab storage) | portal.komos.es | Reloading the page just once if the security check fails. Essential. | First-party | Deleted when used or when the tab is closed |
| Technical data of the browser session, such as the page to return to (tab storage) | portal.komos.es | Keeping the portal working while you use it. Essential. | First-party | Deleted when the tab is closed |
You can delete all of this from your browser settings; if you delete the session, you will have to sign in again.