Privacy notice

Who we are

Open Systems Software is the trading name of Open Systems Software, a sole trader in Scotland. Kassa is a product of Open Systems Software. We are the controller of the personal data in this notice. Contact us at opensystemssoftware@gmail.com about anything in it.

Two kinds of data

Data about you, the shop owner or member of staff who uses Kassa or contacts us. We decide what happens to it, and this notice covers it.

Data your shop records about its own customers and staff: loyalty and account customers, online orders, refusal logs, staff logins. The shop decides what happens to it and is the controller. We only process it on the shop's instructions, under our data processing terms. If you are a customer of a shop, contact the shop about your data.

What we collect about you, and why

• Your name, business name, email, phone number and business address, when you sign up or email us. We use them to provide your account, send invoices and answer you. Legal basis: performing our contract with you, or taking steps before one.
• Your login details (the password is stored as a one-way hash, never in readable form) and a record of when you sign in. We use them to keep your account secure. Legal basis: our legitimate interest in preventing misuse.
• Billing records. We keep them because tax law requires it. Legal basis: legal obligation.
• Server logs: IP address, browser type and the pages requested, when you visit this site or the dashboard. We use them to keep the service running and to spot attacks. Legal basis: legitimate interest. They are deleted after 30 days.

We don't use advertising trackers or analytics on this site, we don't sell personal data, and we don't use it to train AI models.

Who we share it with

Only the companies we need to run Kassa, each bound to protect it:

• Our server and network providers, which host the cloud service and the website.
• Our email provider, which carries our emails to you.
• Our accountant and HMRC, for our own tax records.

If any of these stores data outside the UK, we make sure UK law allows the transfer, using the UK's adequacy regulations or the UK International Data Transfer Agreement.

How long we keep it

Account data is kept while your account is open and deleted within 90 days of it closing. Invoices and payment records are kept for six years after the end of the financial year they belong to, because tax law requires it.

Messages you send through Contact Kassa, the files attached to them and the error reports your tills and back office send (which include an extract of the till's log) are sent to Kassa and kept for two years after the last message in the conversation, then deleted.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to object to how we use it, or to send it to another company. Email opensystemssoftware@gmail.com. We reply within one month and don't charge.

If you are unhappy with how we handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

Changes

We update this notice when what we do changes. The date at the top shows the last change.