Bliss Kira

Data Processing Terms

Version 1.4 · Effective 12 October 2026 · Bliss Aura Trading (Malaysia), operator of Bliss Kira

What this is for. When you record your own customers, suppliers or employees in Bliss Kira, that data is yours. You are the data controller; we are your data processor. These terms set out what we may and may not do with it, how quickly we tell you if something goes wrong, and what happens when you leave. They form part of your agreement with us and apply automatically — there is nothing to sign.

1. Roles

Data	Controller	Processor
Your account: your name, email, business details, billing	Us	—
Your customers and suppliers: name, phone, email, address, TIN	You	Us
Your employees: IC number, date of birth, EPF/SOCSO numbers, salary, bank account	You	Us

The first row is covered by our Privacy Policy. Everything below concerns the second and third.

2. What we do with it, and what we do not

We process that data only:

to provide the service to you — storing it, calculating from it, and producing the documents and reports you ask for;
on your instructions, which are given through your use of the software; and
where the law requires us to do something else, in which case we will tell you first unless we are forbidden from doing so.

🔴 We do not use it for our own purposes. Not for marketing, not for analytics we sell, not to train models, not to build a picture of an industry. Your customer list is a competitive asset and it stays yours.

3. Duration and scope

Subject matter	Providing accounting and point-of-sale software
Duration	For as long as your account is open, plus the retention period in section 9
Nature and purpose	Storage, calculation, document production, and transmission where you instruct it (for example sending an invoice)
Types of data	Contact details, identification numbers (IC, TIN, SST, EPF, SOCSO), employment and pay data, bank account numbers, transaction records
Categories of person	Your customers, your suppliers, your employees, and your own staff users

4. Confidentiality

Everybody at Bliss Kira who can reach customer data is bound by a duty of confidence that survives their leaving. Access is granted only where a task requires it and is removed when it does not.

5. Security

We maintain, at minimum:

encryption of data in transit (HTTPS);
passwords stored as Argon2id hashes, never in readable form;
separate database roles, so that the application cannot alter or delete posted accounting entries even if it is compromised;
sessions that can be ended remotely by you;
encrypted backups held off the server, with restores tested on a schedule;
access logging sufficient to answer who reached what, and when.

We may change how these are achieved as technology moves, but not so as to reduce the level of protection.

6. Sub-processors

We use the following. Each is bound to use the data only to provide its service to us:

Who	What for	Where
Our server provider	Hosting the application and database	Malaysia
Billplz	Taking subscription payments	Malaysia
Cloudflare (R2)	Storing the receipts you upload, and our encrypted backups	Outside Malaysia
Anthropic (Claude)	Reading a receipt or an order photo you upload into figures. Only that file is sent — nothing else from your books — and only when it is read	United States
Our email relay	Sending documents and notices, only if you switch server-sent email on	See note below

🔴 An email relay may sit outside Malaysia. If it does, only the message being sent passes through it — the recipient's address, the document reference and the amount. Your database does not pass through it. Any such transfer is made only where it satisfies section 129 of the PDPA.

We will give you 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data-protection grounds, tell us within those 30 days; if we cannot resolve it, you may cancel and we will refund unused prepaid time.

7. If there is a breach

🔴 We will tell you without undue delay, and in any case within 24 hours of becoming aware.

That is deliberately shorter than the 72 hours you have to notify the Commissioner under the Personal Data Protection (Amendment) Act 2024. Your clock starts when you find out — so if we took 72 hours to tell you, you would already be late. You need most of that window to decide and to act.

We will not wait until we have finished investigating. The first message will say what we know, what we do not yet know, and when the next update comes.

We will give you, as it becomes known:

what happened and when;
which categories of data and roughly how many people are affected;
the likely consequences;
what we have done and what we are doing;
a contact who can answer questions.

Where the breach concerns data for which we are the controller, we notify the Commissioner within 72 hours and affected individuals within 7 days where significant harm is likely, as the Act requires.

8. Helping you meet your obligations

Requests from individuals. If one of your customers or employees contacts us directly, we will not answer for you — we will refer them to you and tell you it happened. Where the software cannot already give you what you need to answer them, we will help.
Access and correction. Most of it you can do yourself, because the records are in front of you.
Deletion. You can delete a customer or supplier record. You cannot delete a posted accounting entry — no one can, including us — because an accounting record that can be silently removed is not a record. Corrections are made by reversal, which leaves both the original and the correction visible. This is a legal requirement of double-entry bookkeeping, and it is worth knowing before you promise somebody erasure.

9. When you leave

Take a copy first. The paid plan exports it from inside the software; on any plan — including after you stop paying — ask us and we will send you one. That is the copy you control.
We then retain your accounting records for seven years from the end of the financial year they belong to, because section 82 of the Income Tax Act 1967 requires you to be able to produce them. During that period we use them for nothing but responding to you or to a lawful demand.
Data outside that requirement is deleted or irreversibly anonymised within 90 days of your account closing.
Backups are overwritten in rotation; deleted data disappears from backups as that rotation completes.

You may instruct us to delete earlier. We will comply to the extent the law permits, and will tell you plainly which records we must keep and why.

10. Audit

On reasonable written notice, and not more than once a year unless there has been a breach, we will give you the information you reasonably need to verify we are meeting these terms. Where an on-site inspection is genuinely necessary we will agree a scope and a date; you cover your own costs, and we cover ours.

11. Your side

You confirm that:

you have a lawful basis for the personal data you record;
you have given the people concerned the notice the PDPA requires;
your instructions to us will not put us in breach of the Act; and
you will not enter special or sensitive data into free-text fields that were not designed to hold it — a note box on an invoice is not the place for somebody's medical history, and we cannot protect what we do not know is there.

12. Contact

Our data protection contact: blissauratrading@gmail.com.
Anything in these terms, a breach, an audit request, or a question from one of your customers goes there and is answered by a person.

Bliss Kira is operated by Bliss Aura Trading, Malaysia.
Terms of Service · Privacy Policy · Data Processing Terms