OOpsLab Client Portal
Legal & Privacy Log in Sign up

Legal & Privacy

Read this first. This page is a technical compliance overview, drafted by the team that built this system — it is not legal advice, and it does not by itself make your organization compliant with anything. It honestly describes what the OpsLab Kiosk Management System (Admin Panel, Client Portal, Instance Agent, and Kiosk App) actually does with data. Whether that adds up to full compliance for your organization also depends on things entirely outside this software — an appointed Information Officer or DPO, lawful-basis assessments, staff contracts, regulator registrations. Have this reviewed by qualified counsel in each jurisdiction you operate in before relying on it, editing it, or publishing any part of it as your own notice.

Privacy Notice — what this system collects

Covers the Admin Panel / Client Portal layer (this site). Each kiosk terminal's own Kiosk App has a separate, on-device Privacy Notice for kiosk staff — see South Africa / POPIA below for how the two connect.

What's collected, and why

Client Portal account

Your full name, email address, and a salted Argon2 password hash (never the password itself) — used to sign you in and to attribute the actions you take here.

Instance telemetry

Hostname, OS/version, Agent/App version, local IP, and a heartbeat sent roughly once a minute — used to show online/offline status and to run updates, backups, and diagnostics.

Synced inventory & local users

Items/tools/equipment and Local Kiosk User accounts (name, badge code, role — PINs stored only as Argon2 hashes on both sides) mirrored between the Kiosk App and this Admin Panel.

Backups

Database backups your organization schedules or requests, kept until you delete them — nothing is pruned automatically today.

Audit & command logs

Who did what and when — staff/config/update/command actions, kept indefinitely as an accountability record.

Security measures already in place

  • Passwords and PINs are never stored or logged in plain text — Argon2 hashing throughout.
  • Each instance authenticates with its own per-instance secret, not a shared credential.
  • This site is served over HTTPS.
  • A suspended or expired instance is cut off from every API call the moment that's set.
  • Every administrative action is attributed to a real user in the audit log.

Your rights

As a Client Portal user, you can ask an OpsLabs admin to show you what this system holds about your account, correct it, or delete it. For a kiosk's own local users (staff who log in at the physical terminal), the same applies through that instance's own administrators.

Scotland — UK GDPR & Data Protection Act 2018

Scotland is part of the United Kingdom, so this is what actually applies there — not the EU GDPR directly.

Data protection in Scotland is governed by the UK GDPR (the retained, UK-domestic version of the EU regulation, in force since 1 Jan 2021) together with the Data Protection Act 2018. In practice the substantive rights and obligations are very similar to the EU regime. If your organization also processes the data of people in the EU, EU GDPR may apply there separately — a scoping question for your own counsel, not something this system decides for you.

What this means for a kiosk deployment

  • this system provides
    The tools your administrators need to fulfil a data subject's rights of access, rectification, erasure, restriction, portability, and objection — view/edit/delete a local user or account, export records.
  • your responsibility
    Actually responding to a data subject's request within the statutory time limit; documenting your lawful basis for processing (typically legitimate interests or contractual necessity for staff custody/accountability records); deciding whether a Data Protection Impact Assessment is warranted for your deployment.
  • your responsibility
    Registering with the Information Commissioner's Office (ICO), the UK's supervisory authority, and paying the annual data protection fee if your organization is required to.
  • your responsibility
    If you engage OpsLabs as a processor acting on your instructions (rather than just using off-the-shelf software), UK GDPR Article 28 generally expects a written processing agreement — raise this with OpsLabs directly if you need one in place.

South Africa — Protection of Personal Information Act (POPIA)

Each Kiosk App instance already ships its own on-device Privacy Notice for kiosk staff/local users, written specifically against POPIA's conditions for lawful processing — reachable from that kiosk's own login screen without needing to log in first (the same "openness" principle POPIA itself requires). It covers what's collected, retention, and the technical safeguards Condition 7 (Security Safeguards) expects, and stays in sync with that instance's configured retention period and Information Officer contact (set from that instance's Settings tab, either here or in the Admin Panel).

What stays your organization's own responsibility

  • your responsibility
    Appointing and registering an Information Officer with the Information Regulator (this system records that person's contact details for display — it does not register them for you).
  • your responsibility
    A documented PAIA manual and internal POPIA compliance framework/policies.
  • your responsibility
    Confirming your lawful basis (Condition 1) and that collection is adequate, relevant, and not excessive (Condition 2) for how your site actually uses this system.
  • your responsibility
    Any cross-border transfer assessment (Condition 8) if data leaves South Africa — e.g. if this Admin Panel or its backups are hosted outside the country.
  • this system provides
    The tools to respond to data subject access/correction/deletion requests within POPIA's timelines — per-user edit/delete, configurable retention. The actual response is yours to make.

Scope of this page

This page deliberately covers data protection / privacy law only — UK GDPR/DPA 2018 for Scotland and POPIA for South Africa — since that's the area this software actually touches and can meaningfully speak to. It is not, and doesn't attempt to be, a complete audit of every law that could apply to a kiosk management system in either jurisdiction: consumer protection, electronic transactions/signatures, accessibility, sector-specific rules, tax/record-keeping, and employment law are all out of scope here and need their own separate legal review. If you need that broader review, this page is a reasonable starting point for the data-protection section of it, not a substitute for the rest.