Privacy Policy

1. Controller

Unless stated otherwise below, the controller within the meaning of the GDPR for data processing on this website, in the web application at app.terminz.com and in the app “Terminz Terminal” for iPad and Android tablets is:
Bornwerk UG (haftungsbeschränkt)
Märkische Straße 193
44141 Dortmund
Deutschland
contact@terminz.com

2. Data Protection Officer

We are not legally required to appoint a data protection officer. For privacy enquiries, please use the contact details above.

3. Controller vs. Processor

We are the controller for the data of website visitors and of our business customers (studios and their account data). We are also the controller for the profile under which we keep a person’s contact details platform-wide and for their user account (see “User account and profile” under section 4). For the customer file a studio keeps about its end customers in Terminz — appointments, notes, revenue, visit history, industry profiles and the contact details the studio recorded itself or that were released to it — the studio is the controller; we act as processor under Art. 28 GDPR, and the studio is responsible for the privacy notice covering it. There is no joint controllership under Art. 26 GDPR: studios do not write into the profile, and we do not use the customer file for our own purposes.

4. Collection and Processing of Personal Data

We collect personal data when you visit our website, use the contact form, subscribe to the newsletter, or register as a business customer. This includes in particular your name, email address, phone number, company details, and technical access data such as IP address, date and time of access, and information about your browser and device.

Contact Form

When you contact us via the contact form, we process your name, email address, optionally phone number and company name, and your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (responding to enquiries). Delivery is handled by our service provider Resend.

Newsletter

For the newsletter we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). We use the double opt-in procedure: after signing up you receive a confirmation email and are only added to the list after clicking the confirmation link. You can withdraw your consent at any time via the unsubscribe link in every email.

Business Customer Registration

When you register as a business customer, we process the contact person’s data (name, email, optionally phone), the company name, and industry details in order to establish and perform the contractual relationship. The legal basis is Art. 6(1)(b) GDPR.

User account and profile

When you book an appointment through Terminz or create a user account, we keep a profile with your name, email address and phone number, on request with date of birth, address and profile photo, together with your account details (login credentials, sessions, security events). The purpose is that you do not have to register again at several businesses and see your appointments in one place. Your appointment overview shows only businesses where you actually had an appointment. The legal basis is the usage contract under Part A of our General Terms and Conditions (Art. 6(1)(b) GDPR). We keep the profile as long as your user account exists.

Release to businesses

A business sees from your profile only what you release to it. The release applies per company for all its locations. If you book or register with a business yourself, you release your name, email address and phone number to it; your date of birth and address only if you tick them explicitly. The legal basis is the usage contract (Art. 6(1)(b) GDPR); for date of birth and address, and for confirming a request by email, it is your consent (Art. 6(1)(a) GDPR). Until the release and after a revocation, the business sees your first name, the first letter of your last name and the details it recorded itself. With the release the details enter the business’s customer file; the business is responsible for it and we process it on its behalf. We record which business received or lost which release, when and in which wording, so that we can prove it (Art. 7(1), Art. 5(2) GDPR). You can revoke any release at any time under “Privacy” in your user account (Art. 7(3) GDPR); the revocation takes effect for the future, and what the business already holds in its customer file stays there.

Being findable

A business you are not yet a customer of can find you only by entering your complete email address or phone number, and only if you registered or booked yourself. It then sees only your shortened name. The legal basis is our legitimate interest in avoiding duplicate records and sparing you from registering at further businesses (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR) by switching off being findable under “Privacy” in your user account; businesses that already know you keep their customer file.

Release email

If a business attaches you to your existing profile, or someone books under your email address without being signed in, we send you an email on behalf of Terminz asking whether you release your profile to the business. You can confirm or decline with “That wasn’t me”; either happens only by clicking the respective button on the page, not by opening the link. The link is valid for 30 days. We send at most three such emails per person in 24 hours and, for the same business, not again for 30 days. The legal basis is the usage contract (Art. 6(1)(b) GDPR) if you have a user account, otherwise our legitimate interest in protecting you from an attachment you did not initiate (Art. 6(1)(f) GDPR). If you decline, the business detaches the link: its appointments with you remain as appointments without an account under the name it recorded, and you are no longer found by it until you book there yourself.

Deleting your user account

If you delete your user account, we delete your profile, login details, bonus points, reviews and consents immediately and end all sessions. Upcoming appointments are cancelled without an email to you. Past appointments remain at the business without an account, only with the name the business knew. We do not delete the customer file a business keeps about you at once but lock it (Art. 17(3)(b) and (e) GDPR): the name on appointments and notes remain until 31 December of the third year after the year of the last appointment, because claims arising from the appointment can be asserted until then (sections 195, 199 German Civil Code); for businesses in the health sector until 31 December of the tenth year (section 630f(3) German Civil Code). Only the owner of the business can read the locked file, and only to defend claims or to meet a documentation duty. It is deleted afterwards. Receipts and invoices remain unchanged as long as the law requires their retention (section 147 German Fiscal Code, section 257 German Commercial Code). If you also work in a team with the same access, we delete only your customer profile; your team access remains.

Sign-in with Google

A Google account may optionally be used to sign in. Google transmits to us the information required to create the account: Google identifier, email address, first and last name, and the profile picture where available. No password is transmitted. If an account with the same email address already exists, the Google sign-in is linked to that account instead of creating a second one. The legal basis is Art. 6(1)(b) GDPR. The link can be removed as long as another sign-in method is on file.

Payment Processing

Payments are processed via Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). Payment-related data is transmitted to Stripe; card data is not stored on our servers. The legal basis is Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or the Standard Contractual Clauses.

Technical Security Device (point-of-sale function)

If a business customer uses the point-of-sale function, till transactions are transmitted to fiskaly GmbH (Vienna, Austria), operator of the certified technical security device, for the legally required signature. As things stand, the data transmitted comprises amounts, tax rates, payment type and the identifier of the till, not names or contact details of end customers. The duty to sign under § 146a AO rests with the business customer, who is the controller; we act as processor and fiskaly as sub-processor under Art. 28(2) and (4) GDPR. Processing takes place within the European Union.

5. Legal Bases for Processing

• Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR (registration, contact requests)
• Consent pursuant to Art. 6(1)(a) GDPR (newsletter, analytics cookies)
• Legitimate interest pursuant to Art. 6(1)(f) GDPR (secure operation and optimisation of the website)
• Legal obligation pursuant to Art. 6(1)(c) GDPR (retention of consent records)

6. Cookies and Consent

We use strictly necessary cookies and - only with your consent (§ 25(1) TDDDG) - analytics cookies. You can grant or withdraw your consent at any time via our cookie banner. Google Analytics loads in Google Consent Mode with a default state of "denied" and sets no analytics cookies and evaluates no data without your consent; Sentry session recording is not loaded at all without your consent. Plain error detection stores no information on your device, reads no device properties without your consent and therefore requires no consent (§ 25 TDDDG); see the Sentry section for details.

7. Analytics and Error Logging

Google Analytics

This website uses Google Analytics by Google Ireland Ltd. / Google LLC, loaded via Google Tag Manager. IP anonymisation is enabled and Google Consent Mode defaults to "denied". Processing only takes place after your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Sentry

We use Sentry (Functional Software Inc.) to detect technical errors. On terminz.com and in the web application at app.terminz.com, a technical error transmits the name and error code of the failed operation, the page visited without identifiers or search terms, the names, durations and error codes of the server requests just before it, for a failed request the shape of the fields sent (field name, type and length, never the content), browser and operating system family with version, the application version, and whether the page was visible and how long it has been open. The web application adds a monthly changing pseudonym of the location, the account's role, the plan, whether the till is enabled and the interface language; only Bornwerk can derive the location from it, and we do not use these details to monitor employees. A technical identifier links the report to our server's error report for the same request. Sentry derives a coarse location on its servers (country and city); your IP address is not stored. Application content, input, contact details and server error messages are removed on your device and never transmitted; no cookies are set, no information is stored on your device, no device properties are read beyond the browser identifier every request sends anyway, and no sessions are recorded. The legal basis is our legitimate interest in secure and uninterrupted operation (Art. 6(1)(f) GDPR, recital 49). You may object to this processing at any time under Art. 21(1) GDPR — an informal message to datenschutz@terminz.com is enough. Only on this website (terminz.com) and only after you grant analytics consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time, we additionally record fully masked sessions on error (text, inputs and media) and read your device's online status, network class, data saver setting, window size class and time zone; neither happens on a business's pages. For the app “Terminz Terminal”, section 10 applies.

Reach Measurement and A/B Testing of Profile Pages

On the public profile pages we collect statistical access data (page accessed, referrer, and browser/device information) for reach measurement on the basis of our legitimate interest in analysing and improving reach (Art. 6(1)(f) GDPR). To optimise the presentation we also carry out A/B tests and store the test variant assigned to you locally on your device (key "terminz_ab_assignments"). This storage takes place only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can grant or withdraw at any time via our cookie banner.

8. Google Maps Platform (Address Search and Business Data)

We use the Google Maps Platform provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). When you enter an address in our forms, your input is transmitted to Google for address completion. During the onboarding of a business customer, publicly available business data (name, address, opening hours, telephone number) from the Google business listing may additionally be suggested in order to facilitate profile creation. This data is presented to the business customer for review and confirmation before it is stored and is only added to the profile after the customer confirms it. Only the Google Place ID is stored permanently as a unique identifier of the listing; otherwise, Google content is not cached beyond the limits permitted by the Google Terms of Service. Where we display Google content without a map view, we do so with the notice "Powered by Google". The legal basis is Art. 6(1)(b) GDPR (performance of the contract with the business customer) and Art. 6(1)(f) GDPR (legitimate interest in the accurate and efficient capture of location and business data). On public profile pages, an embedded Google map (Google Maps Embed) may additionally be displayed to show the location. When the map loads, data – in particular your IP address – is transmitted to Google and cookies may be set; the embedding of the map takes place on the basis of your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can grant or withdraw via our cookie banner. Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or the Standard Contractual Clauses.

9. Public Business Profile and Directory

Business customers (studios) can provide a publicly accessible profile via Terminz and be listed in a searchable business directory so that end customers can find them and book appointments. The publicly displayed information includes business data such as name, address, opening hours, services and prices, photos and reviews. This is predominantly company data; insofar as individual details have a personal reference (for example the name of a self-employed owner), the legal basis is Art. 6(1)(b) GDPR (performance of the contract with the business customer) and Art. 6(1)(f) GDPR (legitimate interest in the public discoverability of the studio and in promoting its services). The business customer determines the content and scope of the public profile and may edit the displayed information, remove individual content or deactivate the public profile at any time. Public profiles may be indexed by search engines. These functions are continuously developed further; the specific scope of the business data displayed may expand without changing the purpose and legal basis stated above. Via a contact form on the public profile, end customers can send enquiries (name, email address, telephone number, subject and message) to the studio; in this respect we process the data as a processor on behalf of the studio. If a studio shows reviews, they come from Google Maps and contain the reviewing person's name and profile picture as published on Google, together with their review text; we load them from Google on our servers, so your browser does not connect to Google for this. The respective business customer is responsible for the content of its profile and for any personal data of third parties contained therein.

10. App “Terminz Terminal” for iPad and Android Tablets

The app “Terminz Terminal”, available from Apple's App Store and from Google Play, is the till and appointment terminal for a business's front desk. It is operated only by our business customers and their staff; end customers do not create an account in the app. Customer, appointment and payment data that is displayed, entered or changed in the app, such as name, email address, phone number, date of birth, notes, booked services and payments, is processed by us as a processor on behalf of the respective business customer (Art. 28 GDPR). The business customer is the controller and informs its customers under Art. 13 GDPR. The same applies to the data of staff members who sign in to the app, including the record of who carried out which transaction at the till. We are the controller ourselves for pairing the device with the business customer's account and for the app's error reports. Apple and Google handle the download of the app under their own responsibility; Apple's or Google's privacy policy applies to it. Apple and Google provide us only with aggregated statistics, such as the number of downloads and crash and performance data, which do not allow conclusions about individual persons.

Pairing, sign-in and storage on the device

A tablet is paired once with the business customer's location using a pairing code that the business customer generates in its dashboard. In doing so, the app stores on the device a device identifier, an access key for the connection to our servers, the till settings and the business's name, address, phone number and logo. Staff members then sign in with their personal PIN. The sign-in is held in memory only and ends when the staff member signs out, after a set period without input, or when the app is closed. The app loads customer, appointment and payment data into memory only while it is being used; it is not stored permanently on the device. Storage on the device is strictly necessary for the app to provide the service requested by the business customer (§ 25(2) no. 2 TDDDG). The legal basis for pairing is the contract with the business customer (Art. 6(1)(b) GDPR), insofar as personal data is involved at all.

Permissions

The app requests operating-system permissions solely for card payments, and only at the first card transaction. On the iPad these are Bluetooth, to connect the Stripe Reader WisePad 3 card reader and to keep the connection while the app runs in the background, and location access while in use. On Android tablets they are approximate location and, from Android 12, the nearby devices permission to find and connect the WisePad 3; up to Android 11, Android requires precise location for this Bluetooth search instead. Stripe requires the location for card payments through the Stripe Terminal SDK. The app does not evaluate the location itself and does not transmit it to our servers; it is processed by Stripe alone (see Card payments via Stripe Terminal). The permissions can be revoked at any time in the device's settings, after which card payments are no longer possible. The app does not access the camera, microphone, photos or contacts, and it does not send push notifications.

Card payments via Stripe Terminal

For card payments at the front desk, the app uses the Stripe Terminal SDK together with a card reader belonging to the business customer: the Stripe Reader S700, which is connected to Stripe over the internet, or the Stripe Reader WisePad 3 via Bluetooth. The reader reads the card and transmits the card data to Stripe in encrypted form; the full card number never reaches the app or our servers. Stripe sends us the payment status, a transaction identifier, the card brand and the last four digits of the card, and we store these details with the till transaction on behalf of the business customer. The SDK also transmits device data, the approximate location of the device and information about the use of the SDK to Stripe. According to Stripe, this data is not linked to any person and is not used for tracking. Stripe uses it to operate and improve the payment service and to prevent fraud, and processes it under its own responsibility to that extent; Stripe's privacy policy applies (stripe.com/privacy). In all other respects, the information under Payment processing applies.

Receipt via QR code

After payment, the app can display a QR code. Anyone who scans it with their own smartphone opens the receipt as a web page on our servers (api.terminz.com/b/…) and can download it there as a PDF. The page contains the receipt details, i.e. the business, services, amounts, tax, payment method and the data of the technical security device, but not the customer's name. It loads no third-party content, is not indexed by search engines and remains available through a link that cannot be guessed for one year from the moment the code is created. Opening it generates the usual access data, including the IP address (see Retention Periods). Here, too, we act as the business customer's processor.

Error reports

If the app crashes or a technical error occurs, it sends an error report to Sentry (Functional Software, Inc.; storage in the EU region). The report contains the name of the screen and of the failed operation, an error code, the names, durations and error codes of the latest server requests, a monthly changing pseudonym of the location, the technical execution path and the device model, operating system version and app version. Details of the signed-in person, request contents, console output and tapped screen elements are removed by the app on the device; email addresses, phone numbers, bank details and identifiers in error messages are masked. Sentry does not store IP addresses. For a share of operations, the app also measures how long screens and server requests take to load. Until they are sent, the error module keeps reports on the device so that a crash can still be reported after a restart, and uses a randomly generated installation identifier for this that is not linked to any account or person. This storage is strictly necessary for the uninterrupted operation of the till that the business customer uses the app for (§ 25(2) no. 2 TDDDG). The legal basis is our legitimate interest in secure and uninterrupted operation (Art. 6(1)(f) GDPR); you may object to this processing at any time under Art. 21(1) GDPR, an informal message to datenschutz@terminz.com is enough. Error reports are deleted after 90 days.

Retention and no tracking

The data on the device remains stored until the business customer deactivates the device in its dashboard or the app is deleted; deactivation invalidates the access key. For the customer, appointment and till data processed on the business customer's behalf, the business customer's instructions and the periods under Retention Periods apply; the statutory retention obligations for till records lie with the business customer. Beyond Stripe and Sentry to the extent described, the app does not integrate any third-party services. It shows no advertising, does not read an advertising identifier and does not track anyone across other companies' apps or websites.

11. Recipients and Processors

We pass data to carefully selected processors: Hetzner (operation of the application servers and the database, Germany), AWS (object storage, secrets management and database backups, eu-central-1), Cloudflare (CDN and reverse proxy), Stripe (payments, including card payments on the card reader), Resend (email delivery), Sentry (error detection, EU region), fiskaly (technical security device for the till function, Austria) and Google services (Analytics incl. Google Tag Manager, Google Maps Platform incl. address lookup and enrichment of business data, sign-in). Contracts under Art. 28 GDPR are in place with all processors. The full list of sub-processors for processing on behalf of our business customers is set out in Annex 1 of the Data Processing Agreement.

12. Third-Country Transfers

Some recipients (Stripe, Resend, Google, Cloudflare) also process data in the USA; Sentry stores exclusively in the EU region. Transfers are based on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. The application, the database and the object storage are operated exclusively in Germany.

13. Retention Periods

We store personal data only as long as is necessary for the respective purpose or for statutory retention duties. IP addresses in access logs are removed after 30 days, in session data after 90 days, and login attempts are deleted after 30 days. Data exports are available for download for seven days and are then deleted. We keep records of consents given and withdrawn for as long as they are needed to meet the duty of proof under Art. 7(1) GDPR. We keep your profile and your releases as long as your user account exists; for locked files the section “Deleting your user account” applies. After a business customer’s contract ends, its data remains available for 90 days and is then deleted.

14. Your Rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

16. Contact

For questions about the processing of your personal data or to exercise your rights, contact us at datenschutz@terminz.com.