NovaKasse

Point-of-sale system for hospitality and retail

Privacy policy

Last updated: 5 September 2026

NovaKasse is a business application for companies, not for private individuals. For the business’s own data (account, staff, subscription) we are the controller. For everything the business records in operation — in particular customer data, orders and staff hours — we act as processor and the business is the controller. We process that data only on the business’s instructions and never for our own purposes.

1. Data controller

We have not appointed a data protection officer or an EU representative because we do not reach the relevant thresholds. Please address all requests to the contact above.

2. What data we process

What we explicitly do not collect

• No card numbers and no CVC codes — the card is read exclusively by the Stripe module
• No location tracking: location is requested only as a technical prerequisite of NFC card payments
• No advertising, no advertising ID, no analytics SDK, no tracking
• No use of business data for our own purposes, no disclosure to other businesses

3. Permissions on your device

The app requests only the following permissions. Each of them can be revoked at any time in your device settings; the app remains usable afterwards, with reduced functionality.

• Location while using the app — A mandatory prerequisite imposed by Stripe and the card schemes for “Tap to Pay” (contactless acceptance on the device). Without on-device card payments the location is not needed.
• Bluetooth — Connecting to the receipt printer and the card reader.
• Camera — Scanning barcodes and photographing menus. Text recognition runs on the device.
• Photos (selected image only) — Selecting product images for the menu.
• Local network (iOS only) — Direct connection to the customer display on your own Wi-Fi, without going through the internet.
• Notifications — Alerting you to incoming online orders.

4. Legal bases

We process personal data under the Swiss Federal Act on Data Protection (revFADP). Where the GDPR applies, we rely on:

• Performance of a contract (Art. 6(1)(b) GDPR) — everything needed for the app to deliver the function you requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — secure and stable operation, abuse prevention, troubleshooting.
• Consent (Art. 6(1)(a) GDPR) — for anything you actively enable in this app: location as a prerequisite for Tap to Pay, Bluetooth for printer and card reader, the camera for barcodes and menus, picking product images, the local network for the customer display and notifications about online orders. Consent can be withdrawn at any time with effect for the future by revoking the permission in your system settings.
• Legal obligation (Art. 6(1)(c) GDPR) — in particular commercial and tax retention duties for payments.

A data processing agreement governs the data we process on behalf of the business; it forms part of the novakasse.ch terms and is issued separately on request. Data subjects (for example a business’s guests) should address access and deletion requests to that business; we support the business in handling them.

5. Recipients and third parties

We do not sell data and do not disclose it for advertising purposes. Data is disclosed only to the following parties, and only where required for operation:

Authorities and courts receive data only where we are legally obliged to provide it.

Transfers abroad

Some of the recipients listed above process data outside Switzerland and the EEA, in particular in the United States. We base such transfers on the European Commission’s Standard Contractual Clauses with the Swiss adaptations recognised by the FDPIC and, where applicable, on the EU-US Data Privacy Framework. We will provide information on the safeguards in place on request.

6. Retention and deletion

We retain a business’s data for the duration of the subscription and delete it on request after the subscription ends, at the latest 90 days after the final invoice — except for records that we or the business must keep for 10 years under Swiss accounting and retention rules (CO 958f, GeBüV). These include POS receipts, the fiscal journal and payroll records. Server logs expire after 14 days.

Step-by-step instructions are available at Delete data.

7. Children and young people

This app is not directed at children. We do not knowingly collect personal data from children under 16. If we learn that such data has been submitted without parental consent, we delete it without delay.

8. Data security

Wherever the app transmits data at all, connections are encrypted via HTTPS/TLS. On the server side we use access restrictions, tenant separation and regular backups. Nobody can, however, guarantee absolute security for data transmission over the internet.

Every business is a separate tenant: each database query is scoped to the business identifier, so no business can see another’s data. Access can be protected with two-factor authentication and idle timeout; POS transactions are recorded in a continuously chained journal.

9. Your rights

• Access to the personal data we process
• Rectification of inaccurate data
• Erasure or destruction of your data
• Restriction of and objection to processing
• Receiving or porting your data in a common format
• Withdrawal of consent with effect for the future

An informal message to info@babala.ch or a call to 076 222 45 99. We normally respond within 30 days. To verify your identity we may request suitable proof. You may also lodge a complaint with a supervisory authority (Switzerland: FDPIC; EU: your competent authority).

10. Changes to this policy

We may adapt this policy when the app or the legal framework changes. The version published on this page, with the date shown above, is the applicable one. We announce material changes inside the app.