Data processing terms

Last updated 13 October 2026

These terms form part of the terms of service. They apply to personal data your shop records in Kassa that reaches our cloud servers. Your shop is the controller and Open Systems Software is the processor, as UK GDPR Article 28 describes.

What we process

  • People: your customers, online shoppers, staff, and people refused an age-restricted sale.
  • Data: names, contact details, delivery addresses, order and sale history, loyalty and account balances, staff logins and permissions, refusal records, and anything else you choose to record.
  • Purpose: running Kassa for you, for as long as your account is open.

What we promise

  • We process the data only on your documented instructions, which are your use of Kassa and these terms.
  • Anyone who works on Kassa for us is bound to keep the data confidential.
  • We protect it with encryption in transit, access controls, and a database rule that keeps each shop's data separate from every other shop's.
  • We use other companies (sub-processors) only as listed below. We will tell you at least 30 days before adding one, and you can object.
  • We help you answer requests from people exercising their data rights.
  • We tell you without undue delay, and within 48 hours, after we find a breach affecting your data.
  • We help you with data protection impact assessments and with the ICO where you need us to.
  • When your account closes, we delete the data within 90 days, unless the law requires us to keep it. You can ask for a copy first.
  • We give you the information you need to check we keep these promises.

Sub-processors

Always used:

  • Our server and network providers, which host the cloud service.
  • Our email provider, which sends order confirmations and account emails.

Used only when your shop turns the feature on:

  • Stripe, for online card payments on your shop's website.
  • Your card terminal provider, for card payments at the till.
  • Yoti or OneID, for the digital age check.
  • Meta, Google and TikTok, when you publish adverts or product catalogues to them.
  • Deliveroo, Uber Eats and Just Eat, when you take their orders through Kassa.
  • The online AI service your shop chooses, and only that one: Groq, Inc. (United States), Google LLC for Gemini (United States), Mistral AI (France) or OpenAI (United States). Local AI keeps everything on your own computer.
  • Cloudflare, for a custom web address on your shop's website.

Where a sub-processor is outside the UK, the transfer is covered by the UK's adequacy regulations or the UK International Data Transfer Agreement.

Data on your own computers

Data held only on the tills and back office computer in your shop never reaches us, and these terms don't cover it. Keeping those computers secure and backed up is your responsibility.