1. Data controller

The Hiboutik services are published by:

In the course of its activities, ZAGARELI SA acts:

• As data controller for the management of its customers, their accounts, its business relationships and its services.
• As data processor for the personal data recorded by merchants in the Hiboutik point-of-sale software.

For any question relating to the protection of personal data, or to contact our Data Protection Officer (DPO), you can write to: rgpd@hiboutik.com.

2. Services covered

This policy covers:

• The Hiboutik websites, mainly www.hiboutik.com.
• The Hiboutik SaaS point-of-sale software.
• The Hiboutik Android app, which provides access to the point-of-sale software in a full-screen WebView interface.
• The HibouLink program, available for Android, Windows, macOS and Linux, which transmits receipts from the Hiboutik servers to the printers configured by the merchant.

3. Data processed

In managing its own customers and its services, Hiboutik may process the following data:

• Identification and contact data: last name, first name, email address, telephone number and business.
• Account data: login details and authentication information.
• Commercial and financial data: orders, subscriptions, invoices and payments.
• Support data: support requests and exchanges with our teams.
• Technical data: IP address, connections, information relating to the use of the services, and security logs.

Merchants may also record in Hiboutik personal data about their own customers, in particular their contact details and purchase history. For this data, the merchant acts as data controller and Hiboutik as data processor.

4. How the apps and programs work

Hiboutik

The Android app provides access to the web interface of the point-of-sale software from an Android device. The data used is the data needed for authentication and for using the SaaS service.

HibouLink

HibouLink is a program available on Android, Windows, macOS and Linux. It retrieves receipts from the Hiboutik servers and sends them to the printers configured by the merchant, via Bluetooth, Wi-Fi or USB depending on the system and hardware used.

Receipts may contain personal information relating to merchants' customers. This information is processed solely to carry out the requested printing.

HibouLink operates as a technical gateway and does not keep any local copy of receipts once they have been sent to the printer.

Communications between the apps, the programs and the Hiboutik servers are protected by HTTPS/TLS encryption.

The Hiboutik and HibouLink apps and programs do not include any embedded third-party advertising or analytics SDKs.

5. Purposes of processing

Data is processed for the following purposes:

• Creating and managing user accounts.
• Providing and operating the point-of-sale software.
• Authentication and securing access.
• Commercial and contract management, and billing.
• Customer support and technical assistance.
• Maintenance and improvement of the services.
• Compliance with legal and regulatory obligations.

Data processed on behalf of merchants is used in accordance with their instructions and with the provisions of our Data Processing Agreement (DPA).

6. Recipients and data security

Data may be accessed by authorized ZAGARELI SA staff and by technical service providers involved in hosting, maintenance, security and the operation of the services.

It may also be disclosed to the competent authorities where required by law.

Data is never sold or transferred for commercial purposes.

Hiboutik implements technical and organizational measures designed to protect data, including:

• Access control and permission management.
• Securing of infrastructure.
• Encryption of communications using HTTPS/TLS protocols.
• Protection of systems and security logs.

7. Hosting and retention

Data is hosted exclusively in data centers located in Europe, within infrastructure used by Hiboutik to provide its services.

It is retained for as long as necessary for the purposes pursued, subject to applicable legal and regulatory obligations.

Point-of-sale data may in particular be subject to specific retention and archiving obligations. The corresponding terms are set out in our DPA and the applicable contractual provisions.

8. Deletion of accounts and data

Any request to delete a Hiboutik account can be made through the messaging system built into the Hiboutik account. This method is preferred, as it allows the account and its holder to be identified more precisely.

Alternatively, the request can be submitted using the contact form available on our website.

To secure the request, the user must provide the information needed to identify the account concerned, in particular its login, the business name and the associated email address.

Demo accounts may be permanently deleted once the request has been verified.

For production accounts, a customer who wishes to have all of their data hosted by Hiboutik deleted must first make the necessary arrangements to ensure the regulatory retention of their point-of-sale data. They must undertake to ensure this retention under their own responsibility.

Some data may nevertheless be retained where required by regulations.

9. Individuals' rights

In accordance with applicable regulations, in particular the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP), where these apply, data subjects have, among others, the following rights:

• Right of access to personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure of data, under the conditions provided for by the regulations.
• Right to restriction of processing.
• Right to data portability, where this right applies.
• Right to object to processing, under the conditions provided for by the regulations.

For data for which Hiboutik is the data controller, requests to exercise these rights must be sent directly by email to:

rgpd@hiboutik.com

For data processed on behalf of a merchant, requests should in principle be sent directly to the merchant concerned, who acts as data controller. Hiboutik assists the merchant in accordance with the provisions of its DPA.

Data subjects may also lodge a complaint with the competent supervisory authority, in particular the Swiss data protection authority or the supervisory authority of their country of residence, depending on the applicable regulations.

10. Cookies, changes and contact

The Hiboutik website may use cookies that are necessary for it to function and, depending on the features enabled, audience measurement cookies.

Users can choose to disable cookies through the cookie management tool, where one is offered, or directly in their browser settings. Disabling certain cookies may, however, affect how some features of the site work.

Hiboutik may amend this policy to reflect changes to its services or to the regulations. The updated version is published on this page.

For any question relating to the protection of personal data, or to contact our DPO:

Requests may also be submitted via the contact form available at www.hiboutik.com.