PIN & shift

A shared device sits on the counter and is used by everyone. Whoever acts identifies themselves with their own PIN for each action.

A personal device belongs to one staff member: sign in once, then stamp and redeem without a PIN each time. Neither route changes the role: management data only comes with the account login.

Areas with personal data (your own figures, your own history, the customer list) are locked on a shared device until a PIN has been entered.

That release only lasts while the area is open. Leave it and the lock applies again. Otherwise the next person at the counter would see their predecessor’s data without their own PIN. The PIN itself is never stored.

Two different messages, two different causes. “Wrong PIN” means: type it again. “Insufficient permission” means the PIN was right, but this role is not allowed to do it. Typing again will not help.

The customer list, balance corrections and blocking are reserved for owners and managers. A staff member cannot reach them even with a valid PIN.

In the account area you can change your PIN in three steps: current PIN, new PIN, confirm the new PIN. It has to be unique at the location and is never stored in plain text.

On a personal device, “Sign out” ends the shift: the link to the staff member is released, while the device stays paired with the business. The next person signs in with their own PIN.