Staff & Cashier Policy

1. Data Confidentiality

• Customer data (names, phone numbers, email addresses, points balances, transaction history) is confidential. You must not share, copy, screenshot, photograph, or transmit customer data outside the platform.
• You must not access customer profiles or transaction records unless required for a legitimate business purpose (e.g., awarding points for a purchase, resolving a customer query).
• You must not look up friends, family, or acquaintances in the system out of curiosity. All access is logged and audited.
• When your employment or engagement with the business ends, your access will be revoked. You must not retain any customer data after your access is removed.

2. Transaction Integrity

• Award points only for genuine purchases. Awarding points without a corresponding real transaction is fraud. This includes awarding points to yourself, friends, or family members without a qualifying purchase.
• Enter accurate transaction amounts. The amount entered into the system must match the actual purchase amount. Inflating or deflating amounts to manipulate points is prohibited.
• Do not redeem offers on behalf of customers without their presence. The customer must be present and consent to the redemption. Scanning a customer's code or entering their details without their knowledge is prohibited.
• Report discrepancies. If you notice incorrect points balances, duplicate transactions, or system errors, report them to your manager immediately rather than attempting to correct them yourself.

3. Account Security

• Do not share your login credentials. Your account is personal to you. Sharing your password with other staff members, even temporarily, is prohibited.
• Lock your device. When stepping away from a POS terminal, tablet, or phone logged into the platform, lock the device or log out.
• Use strong passwords. Passwords must be at least 8 characters with a mix of uppercase, lowercase, and numbers.
• Report suspicious activity. If you notice unusual transactions, unfamiliar logins, or suspect someone is using your account, report it to your manager and contact legal@turtlerewards.club immediately.

4. Customer Interactions

• Handle customer data requests professionally. If a customer asks to see their data, update their information, or delete their account, direct them to their profile settings in the app or escalate to your manager.
• Do not collect data outside the platform. Customer phone numbers, emails, and other personal data must only be entered into the Turtle Rewards platform. Writing down customer details on paper, storing them in personal phones, or collecting data in spreadsheets outside the platform is prohibited.
• Respect marketing preferences. If a customer asks to stop receiving messages, help them update their notification preferences in the app. Do not manually add customers to marketing campaigns without their consent.
• Handle complaints through proper channels. Customer complaints about points, rewards, or data should be logged as support tickets in the platform, not resolved informally.

5. Prohibited Conduct

The following are strictly prohibited and may result in immediate account suspension, termination, and legal action:

• Awarding points, stamps, or offers to yourself or personal contacts without a genuine transaction
• Colluding with customers to inflate points or game the loyalty system
• Accessing, copying, or exporting customer data for personal use or for sharing with third parties
• Using another staff member's account or sharing your own credentials
• Tampering with transaction records, point balances, or offer configurations
• Using the platform to harass, discriminate against, or treat customers unfairly
• Circumventing security controls, rate limits, or audit mechanisms

6. Monitoring and Audit

All actions performed on the platform are logged, including: who awarded points and to whom, transaction amounts and timestamps, which customer profiles were accessed, offer redemptions processed, and login times and IP addresses. These logs are retained for 3 years and may be reviewed by the Business Owner and Turtle Rewards Limited for fraud detection, dispute resolution, and compliance purposes. The platform includes automated fraud detection that flags unusual patterns such as repeated awards to the same customer, large transactions, or after-hours activity.

7. Consequences of Violation

• First offence (minor): Written warning from the Business Owner, documented in the platform audit log.
• Repeat offence or serious violation: Immediate suspension of platform access, investigation by the Business Owner.
• Fraud or data breach: Permanent ban from the platform, report to the Business Owner for employment action, and potential referral to law enforcement under the Kenya Computer Misuse and Cybercrimes Act, 2018 and the Kenya Data Protection Act, 2019.

8. Error Reporting Procedure

If you discover you have made an error in awarding Points or Stamps (e.g., entering an incorrect purchase amount, duplicating a transaction, or processing a transaction for the wrong Customer):

• Report the error immediately through the support system in the platform. Include the transaction ID, the incorrect value, and the correct value.
• Inform your supervisor or Business Owner about the error.
• A temporary hold may be placed on the affected Points while the error is investigated.
• The affected Customer will receive a notification explaining the adjustment.
• For significant errors involving large point values, mark the error as “Urgent” and contact your Business Owner immediately.
• Do not promise the Customer any specific resolution. Let the Business Owner handle communication about corrections.

9. Indemnification

You shall indemnify Turtle Rewards Limited in respect of any actions, claims, costs, losses, and proceedings arising from: (a) your failure to obtain necessary consent from customers whose personal data you process or share through the Service; (b) any non-compliance by you with the Kenya Data Protection Act, 2019 or applicable data protection regulations; (c) any fraudulent, dishonest, or negligent conduct in your use of the Service.

10. No Employment Relationship

Nothing in this Staff Policy creates an employment relationship between you and Turtle Rewards Limited. You acknowledge that you are an employee or contractor of the Business Owner, not of Turtle Rewards Limited. Your employment relationship and any disciplinary actions arising from violations of this policy are between you and the Business Owner.

11. Acknowledgement

By using the Turtle Rewards platform as a staff member, you acknowledge that you have read and understood this policy. Your Business Owner may require you to confirm acceptance as part of your onboarding process. If you have questions about this policy, contact your manager or legal@turtlerewards.club.