This Data Processing Addendum sets the terms for processing information about staff, performers, and other people whose information a tenant enters into OshiPOS.
1. Parties and roles
This addendum applies between Office Hasegawa (processor) and the business or organization using OshiPOS (controller). The customer determines the purposes and means for tenant business-user information (administrators and staff), performers, settlement recipients, and other information it enters into the tenant. Office Hasegawa processes that information on the customer’s documented instructions to provide the service. Contact details collected for contracting or billing, and other information Office Hasegawa processes for its own account, billing, security, or operational purposes, are outside this processing scope. Where the same person appears in both categories, we process the information according to each purpose.
2. Processing details
- Purpose
- Event sales, closing and settlement, user and permission management, reports, support, and security.
- People
- Customer administrators and staff, performers and settlement recipients, and other people referenced in records.
- Data
- Names, email addresses, display names, roles and other account information for customer administrators and staff, groups, account identifiers, event and product records, cash sales, sales allocations, commissions, deductions, settlement amounts, device synchronization, closing, and audit records. OshiPOS does not upload or store file contents.
- Duration
- For the subscription term and the period needed to return or delete data after termination.
3. Instructions, security, and incidents
Office Hasegawa will process data only on documented instructions in the contract and service settings, bind authorized personnel to confidentiality, and use appropriate technical and organizational safeguards. If law requires other processing, we will notify the customer unless prohibited. If we become aware of a personal-data breach, we will notify the customer without undue delay and assist with investigation, containment, and any required notice.
4. Subprocessors and international processing
Cloudflare provides the application/API, D1 database, network and security services, and email delivery for email-address verification and password resets. Stripe processes payments and subscriptions for paid plans. Cloudflare and Stripe handle information under their respective roles and service terms. We will give 30 days’ advance notice of a new processing provider or replacement, and the customer may object on reasonable grounds. We will identify transfer regions and safeguards and implement required contracts, notices, or consent under applicable law.
5. Rights requests, end of service, and audit
On reasonable request, we will assist with individual rights, security and breach duties, impact assessments, regulator consultation, and audits to the extent needed. At termination, customers should retrieve needed records using the settlement reports and CSV export features available in the service. OshiPOS does not provide a complete account-wide data export. Account-closure and deletion requests are handled through support. Sales ledgers, finalized settlements, and audit records may not be deleted where needed for reproducibility or legal compliance. We delete other in-scope data when it is no longer needed, subject to legal retention duties and necessary service operations. We will provide reasonable information demonstrating compliance.