Data protection under GDPR appointment booking

The GDPR regulates the handling of personal data in the EU. As soon as you store customer data for appointments, even just name and phone number, you are legally responsible. This applies regardless of business size.

Yes. Name, contact details and appointment history are personal data. If you also record health data (e.g., for beauty or wellness treatments), this counts as a special category under Art. 9 GDPR and is subject to stricter rules.

Yes. As soon as you use booking software that processes your customer data, you must sign a DPA with the provider under Art. 28 GDPR. Terminz provides a DPA by default. Without a DPA, use is not legally permitted.

Since the CJEU's Schrems II ruling, a transfer to the USA is only permitted on a sound legal basis. With Terminz the application, the database and the object storage run in Germany. Payment processing, email delivery and maps rely on providers that also process in the USA; this is based on the EU-US Data Privacy Framework or the Standard Contractual Clauses and is disclosed per provider in the DPA.

Your customers have, among others, the right to access (Art. 15), rectification (Art. 16), deletion (Art. 17) and data portability (Art. 20). Terminz supports you with data export and deletion.

Yes. Under the principle of storage limitation (Art. 5(1)(e) GDPR), data may be stored only as long as necessary. For hairdressing services this is usually a few years, although tax retention duties can require longer storage. Terminz offers deletion routines that help with this. If a customer deletes their own Terminz account, we lock your file on that person until the retention period ends and delete it afterwards; you can delete it yourself beforehand.