This notice explains which personal data Kassenkit processes when you use it: when you create an account, sign in and run your shop's site. Each shop's site has its own privacy notice for its visitors.
Controller
The controller under the General Data Protection Regulation (GDPR) is:
[Firma mit Rechtsform][Straße und Hausnummer]
[PLZ] [Ort]
Email: [E-Mail-Adresse]
Visiting this site
When you open a page, the server processes your IP address, the address of the page (without search terms), the date and time, the response status, the page you came from if your browser sends it, and your browser's description of itself (browser and operating system). This is needed to deliver the site and to protect it against misuse and attacks (Art. 6(1)(f) GDPR; our legitimate interest is running the site safely). These logs are deleted after 7 days at the latest.
Cookies
Kassenkit only sets cookies it needs to work: a sign-in cookie keeps you signed in (at most 30 days; it ends earlier when you sign out or after 7 days without use), and “kk_lang” keeps the language you chose (one year). No consent is needed for them (§ 25(2) no. 2 TDDDG). There are no cookies or services for analytics, advertising or tracking.
Your account
When you create an account, we process your email address, your shop's name and the address of its site; when you sign in, your email address, to which we send the link. With each sign-in we store the IP address and your browser's description of itself, to recognise misuse. When you connect your till system, we store its access data encrypted and copy your products, stores and stock from it. The legal basis is Art. 6(1)(b) GDPR (the contract for using Kassenkit) and, for the IP address and browser, Art. 6(1)(f) GDPR (our legitimate interest is protecting accounts against misuse).
How long we keep it
A sign-in link works for 15 minutes, a sign-up link for 60 minutes; both are deleted within an hour after they are used or expire. A sign-in, with its IP address and browser, is deleted within an hour after it ends: when you sign out, after 7 days without use, or after 30 days at the latest. Your email address and your shop's details are kept while your account exists; write to us to have it deleted.
Your customers' data
The data visitors of your site give in a reservation request we process on your behalf, as your processor (Art. 28 GDPR). Your site's privacy notice, which Kassenkit writes with your details, tells them about it.
Recipients
We use hosting providers (for the servers and the encrypted backups) and an email service as processors (Art. 28 GDPR); the data are processed in the European Union. Apart from that, we pass on no data unless the law obliges us to.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation (Art. 21). Write to us at the address above. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the state where you live or where we are based.
There is no automated decision-making, including profiling.
As of Tue, 13 October 2026