Data hosted in Europe
At an independent European hosting provider, with no transfer outside the European Union.
Compliance
How does UNITICE protect your customers' personal data?
UNITICE is the multi-OS cloud checkout platform. For your customers' data — records, loyalty, reservations — you are the controller and UNITICE acts as processor, within the meaning of article 28 of the GDPR.
Who does what
The GDPR distinguishes the controller, who decides why the data is collected, and the processor, who processes it on the controller's behalf (Regulation (EU) 2016/679, articles 4 and 28). Your business is the controller. UNITICE processes the data on your instructions, in order to run the till, online ordering or reservations.
Our commitments as a processor
Security of processing
Encryption, one environment per location and continuous monitoring, as required by article 32.
Limited access
Only the UNITICE technical team accesses the servers, to run the service.
Incident reported
In the event of a data breach, UNITICE informs you as soon as possible, as Article 33 provides.
Compliant processors
UNITICE uses only GDPR-compliant subcontractors.
Retention and archiving
The data remains accessible for the statutory periods, archived on archive storage certified to ISO/IEC 27001, and HDS if needed.
AI with no private data
When artificial intelligence is used, no non-public customer data is sent to it.
The detail of the technical measures is on the platform security page.
What remains your responsibility
Inform your customers, collect their consent for direct marketing and respond to their requests for access, rectification or erasure. UNITICE helps you respond, as article 28 requires of the processor.
Since 25 May 2018, no prior declaration to the CNIL is required any longer for a customer file. You document your processing in a register (Article 30): even in a small shop, customer management is included, because it is not occasional. A data breach that presents a risk is notified to the CNIL as soon as possible, if possible no later than 72 hours after it is discovered (Article 33). Depending on the case, two steps remain: send the CNIL the contact details of your data protection officer, if you appoint one (Article 37), and complete a prior formality for certain particular processing, such as health data.
A question about your data?
Frequently asked questions on the GDPR
Is UNITICE a controller or a processor?
Processor for your customers' data, which you record in the till. For data on its own site, such as the contact form, UNITICE is the controller.
Do I have to declare my customer file to the CNIL?
No. Prior declaration disappeared with the GDPR, on 25 May 2018. You keep a record of your processing, even in a small shop, and you notify the CNIL of a data breach that presents a risk, if possible within 72 hours.
Where is my customers' data hosted?
At an independent European hosting provider. When the law requires a country of storage, the data are kept there.
What does UNITICE do in the event of a data breach?
UNITICE notifies you as soon as possible, so that you can, if needed, notify the CNIL within 72 hours.
Does my customers' data leave the European Union?
No. No data is transferred outside the European Union, and UNITICE uses only GDPR-compliant processors.
How long is the data kept?
For the legal periods. They stay accessible, archived on ISO/IEC 27001-certified archive storage, and HDS if needed.
Is my customers' data sent to an AI?
No. When artificial intelligence is involved, no non-public customer data is sent to it.
To go further
Security
UNITICE security: encrypted fiscal data, one environment per location, continuous monitoring by a supervision centre, backups every night.
Discover
Privacy
Data collected by the UNITICE site, purposes, retention periods, functional cookies, cookie-free audience measurement and your GDPR rights.
Discover
Compliance
Tax compliance of POS software: the 4 legal conditions, inalterability, security, retention and archiving, and how UNITICE responds to them.
Discover