This agreement governs the processing of personal data by Bornwerk on behalf of the business customer under Art. 28 GDPR. It becomes part of the contract when the contract is concluded.
Last updated: 25 October 2026
Download as PDF (German)When you use Terminz for your business, Bornwerk processes personal data of your customers and staff on your behalf. You remain the controller and Bornwerk acts as processor. Art. 28 GDPR requires a contract setting out the processor's obligations.
This page is that contract. You do not need to request it or sign it separately: it is an annex to Part B of the General Terms and Conditions and is concluded in electronic form together with the contract under Art. 28(9) GDPR. For processing where Bornwerk is itself the controller, the privacy policy applies instead.
Data Processor
Bornwerk UG (haftungsbeschränkt)
Märkische Straße 193, 44141 Dortmund, Deutschland
datenschutz@terminz.com
Data Controller
The legal entity that is the contracting party of the respective Terminz contract and uses Terminz to process customer data. Each legal entity holds its own contract and its own DPA; several locations of the same legal entity are covered by the same agreement.
This agreement sets out the data protection obligations of the parties arising from the use of the software under Part B of the General Terms and Conditions. It applies to all processing of personal data that Bornwerk carries out for the business customer.
In the event of a conflict between this agreement and the remaining provisions of the contract, this agreement prevails insofar as the processing of personal data is concerned.
The business customer is the controller under Art. 4(7) GDPR for the personal data of its end customers and staff processed through the software. It alone must ensure that a legal basis exists for that processing and that data subjects are informed under Art. 13 and 14 GDPR.
Bornwerk acts as processor under Art. 4(8) GDPR in that respect. For Bornwerk's own processing — in particular the business customer's contract, billing and account data as well as visitor data on terminz.com — Bornwerk is the controller; the privacy policy applies there, not this agreement.
Each legal entity holds its own contract and therefore its own data processing agreement. Where the business customer operates several locations under the same legal entity, they are covered by the same agreement.
Where an end user creates their own user account with Bornwerk, Bornwerk is the controller for the account and login details that end user provides and for their cross-business appointment overview; the legal basis is the usage contract under Part A of the General Terms and Conditions (Art. 6(1)(b) GDPR). Bornwerk is likewise the controller for the platform-wide profile of a person’s contact details. From this profile the business customer receives only the details the person has released to it; before the release it receives the shortened name and the status of the release. It can find an existing person only by their complete email address or phone number, and only if they are findable. These processing activities are not covered by this agreement.
With the release, the released details enter the business customer’s customer file; from then on it is the controller for them and Bornwerk is the processor. The same applies to the details the business customer itself collects or adds about an end user, in particular the contact details it recorded (“own details”). They are not made accessible to other business customers. There is no joint controllership under Art. 26 GDPR.
This agreement is concluded together with the contract under B.3 of the General Terms and Conditions and runs for its duration. It ends when the contract ends, without separate notice being required.
This agreement cannot be terminated without terminating the contract. The obligations under § 12 survive the end of this agreement.
Bornwerk processes personal data solely for the purpose of providing and operating the contractually agreed software: appointment booking and management, customer and staff administration, time tracking, payment and point-of-sale functions, notifications, and the business customer's public profile page. On the business customer's instruction this includes transferring services, staff and appointments from an export of its previous system.
Processing comprises collection, recording, organisation, storage, adaptation, retrieval, consultation, use, transmission, restriction, erasure and destruction of personal data. It takes place in member states of the European Union unless § 14 provides otherwise.
The data subjects are the business customer's end customers, its staff and contributors, and the contact persons of its business partners. The following categories of data are processed:
The business customer alone is responsible for processing special categories of personal data. It must ensure that a condition under Art. 9(2) GDPR applies — as a rule the data subject's explicit consent under Art. 9(2)(a) GDPR — and that such details are not entered in fields not intended for them. The business customer obtains and documents the consent of persons recognisable in image data itself (Art. 6(1)(a), Art. 7(1) GDPR); the software only allows such a photo to be published once the business customer has confirmed this.
Bornwerk processes personal data only on documented instructions from the business customer, including with regard to transfers to third countries (Art. 28(3)(a) GDPR). The contract including this agreement, together with the settings the business customer makes in the software, constitute the initial instruction.
Individual instructions are issued in text form to datenschutz@terminz.com. The owner of the legal entity and the persons it designates are authorised to issue instructions.
If Bornwerk considers that an instruction infringes the GDPR or other data protection provisions, it informs the business customer without delay (Art. 28(3), second subparagraph, second sentence GDPR) and may suspend execution until the instruction is confirmed or amended.
With the conclusion of the contract the business customer instructs Bornwerk (a) to detach a person’s link to its business if the person declines it (“That wasn’t me”) and to provide the industry details arising from it in a handover file, (b) to lock the customer file of a person who deletes their user account in accordance with section 12(6) and to delete it when the period ends, and (c) to forward requests of data subjects that concern the customer file to it (section 10(2)).
Bornwerk engages only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). The obligation continues after the activity ends.
The persons engaged are familiarised with the data protection provisions relevant to them before taking up their activity.
Bornwerk implements the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk (Art. 28(3)(c) GDPR). The measures in place are described in Annex 2.
Bornwerk may adapt the measures to the state of the art as long as the agreed level of protection is not reduced. Material changes are reflected in Annex 2.
Bornwerk maintains administrative access to the data processed on the business customer's behalf for support and troubleshooting. It is limited to a small number of named persons bound to confidentiality under § 7 and is used only to perform the contract or on the business customer's instruction.
The business customer gives general authorisation for the engagement of other processors (Art. 28(2), second sentence GDPR). The sub-processors engaged at the time the contract is concluded are listed in Annex 1 and are thereby authorised.
Bornwerk informs the business customer at least 30 days before engaging a new sub-processor or replacing an existing one, in text form to the email address held in the account. The business customer may object to the change on data protection grounds within 14 days of receipt.
If the business customer objects, the parties seek an amicable solution. If Bornwerk cannot reasonably provide the service without the sub-processor concerned, the business customer may terminate the contract for cause with effect from the date the change takes effect.
Bornwerk imposes on every sub-processor, by contract, the same data protection obligations as are set out in this agreement (Art. 28(4) GDPR) and remains liable for its conduct as for its own.
Purely ancillary services such as telecommunications, cleaning or maintenance services do not constitute sub-processing within the meaning of this agreement.
Bornwerk assists the business customer by appropriate technical and organisational measures in responding to requests from data subjects under Art. 12 to 23 GDPR (Art. 28(3)(e) GDPR). Whatever the business customer cannot do itself in the software, in particular handing over a person's data in machine-readable form, Bornwerk carries out on its instruction in text form.
If a data subject approaches Bornwerk directly, Bornwerk forwards the request to the business customer without delay and does not answer it itself, insofar as it concerns processing carried out on the business customer's behalf.
Bornwerk further assists the business customer in complying with the obligations under Art. 32 to 36 GDPR, in particular with a data protection impact assessment and any prior consultation of the supervisory authority, taking into account the nature of processing and the information available to Bornwerk (Art. 28(3)(f) GDPR).
Bornwerk notifies the business customer of any personal data breach affecting the data processed on its behalf without undue delay after becoming aware of it, in text form to the email address held in the account (Art. 33(2) GDPR).
The notification describes, where available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken and proposed. Information not yet available is provided as it emerges.
Notification to the supervisory authority under Art. 33(1) GDPR and communication to the data subjects under Art. 34 GDPR are the responsibility of the business customer; Bornwerk assists.
After the contract ends, Bornwerk deletes all personal data processed on the business customer's behalf or returns it, at the business customer's choice (Art. 28(3)(g) GDPR); paragraph 3 applies to the archive copy. The business customer states its choice by the end of the contract; if it does not, the data is deleted.
The business customer receives its data under B.18 of the General Terms and Conditions: till and accounting data during the term of the contract and after it ends until deletion through the software's exports, everything else on request as an Excel file (XLSX), in each case in a structured, commonly used and machine-readable format. After the contract ends Bornwerk keeps the data for another 90 days, continues to provide the remaining data on request during that time and sends an email reminder before deletion.
If the business customer deletes a published photo, Bornwerk removes the image file including all preview sizes from storage and has cached copies in the delivery network deleted.
Retaining till, receipt and invoice data under § 147 AO, § 257 HGB and the German Cash Register Ordinance is the business customer's responsibility. It exports this data before the retrieval period ends; the data is then deleted together with everything else. Independently of this, the business customer instructs Bornwerk to retain the archive copy under B.18 of the General Terms and Conditions beyond the end of the contract, in tamper-locked storage in the European Union, until the period stated there expires, and to delete it afterwards (Art. 28(3)(a) and (g) GDPR). Bornwerk processes the archive copy only to retain it and to provide it to the business customer; if the business customer asks for its return and deletion after the contract ends, Bornwerk proceeds under B.18. This agreement continues to apply for as long as the archive copy is retained.
Billing documents retain the recipient details recorded when they were issued. An erasure request under Art. 17 GDPR does not cover them for as long as the retention obligation lasts (Art. 17(3)(b) GDPR).
Backups are overwritten as part of normal rotation; individual records are not selectively deleted from existing backups.
If a person deletes their user account, Bornwerk locks the business customer’s customer file on that person: notes, industry and health profiles stay locked until 31 December of the third year after the year of the last appointment, visit or receipt at that business, for a business in the health sector the tenth year. The names on individual appointments are anonymised per appointment on 31 December of the third year after the year of the appointment, in the health sector the tenth year. Locked data is read only by the owner of the business and only to defend claims or to meet a documentation duty (restriction of processing under Art. 18 GDPR). Bornwerk informs the business customer by email and in the dashboard and deletes the file when the period ends; the business customer can delete it earlier.
Bornwerk makes available to the business customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28(3)(h) GDPR). Evidence may be provided through current self-assessments, the documentation under Annex 2, or audit reports and certificates from independent bodies.
Where this evidence is not sufficient in an individual case, Bornwerk allows the business customer, or an auditor mandated by it who is bound to secrecy and is not a competitor of Bornwerk, to conduct an audit. It takes place after 30 days' notice, during normal business hours, without disrupting operations, and at most once per calendar year; more frequently where there is specific cause, in particular after a personal data breach or upon order of a supervisory authority.
The business customer bears the cost of an audit it initiates. Bornwerk may charge a reasonable fee for its own effort unless the audit reveals a breach for which Bornwerk is responsible.
Processing takes place in Germany as a rule. Where individual sub-processors process data outside the European Union, this is stated in Annex 1.
A transfer takes place only where the conditions of Chapter V GDPR are met: on the basis of an adequacy decision under Art. 45 GDPR, in particular the EU-US Data Privacy Framework, or on the basis of the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR together with supplementary measures.
B.17 of the General Terms and Conditions governs liability. Art. 82 GDPR remains unaffected.
Bornwerk is not required to appoint a data protection officer; the conditions of Art. 37 GDPR and § 38 BDSG are not met. The contact address stated below is the point of contact for data protection matters.
Bornwerk may amend this agreement where a change in the law, a requirement of a supervisory authority, or case law makes it necessary. The amendment is communicated in text form at least 30 days before it takes effect; if the business customer does not object within that period, it is deemed accepted. The communication points out the right to object and the consequences of silence.
All other amendments require text form. If a provision is invalid, the validity of the remaining provisions is unaffected. German law applies.
The following sub-processors are authorised under § 9 of this agreement. All are bound by a contract under Art. 28 GDPR; where processing takes place outside the EU, the safeguards under Chapter V GDPR are stated.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Operation of the application servers and the database; also redirection of the root domain of custom domains to www | Germany (Falkenstein) | Processing exclusively in Germany |
| Amazon Web Services EMEA SARL | Object storage for uploaded files, secrets management and encrypted database backups | Germany (eu-central-1 region, Frankfurt) | Storage exclusively in Germany; Standard Contractual Clauses for parent-group support access |
| Cloudflare Germany GmbH / Cloudflare, Inc. | Content delivery network, reverse proxy and media delivery; processes every inbound request including the IP address; also TLS termination and delivery of the website via business customers’ own domains | EU edge / worldwide | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing including card payments at the card reader | Ireland / USA | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
| fiskaly GmbH | Signing of till transactions by the certified technical security device under the German Cash Register Ordinance; amounts, tax rates, payment type and the identifier of the till are transmitted, not names or contact details of end customers | Austria (Vienna) | Processing within the EU |
| Resend (Plus Five Five, Inc.) | Delivery of transactional emails to end customers and staff, such as booking confirmations, reminders and receipts | USA | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Detection of technical application errors; the operation name, error code, page, the names and error codes of the preceding operations, the shape (field name, type, length) of fields sent and a monthly changing location pseudonym are transmitted, not the contents of the application | EU region (Frankfurt) | Stored in the EU; US support access based on the EU-US Data Privacy Framework or the Standard Contractual Clauses |
| Google Ireland Ltd. / Google LLC | Google Maps Platform: address autocompletion when an address is entered, and the map shown on the public profile page | Ireland / USA | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
| Google Ireland Ltd. / Google LLC | Google Identity Services: signing in with a Google account during booking and in the customer account | Ireland / USA | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
Audience measurement and analytics on terminz.com are not covered by this agreement: Bornwerk is the controller there. Those services do not run on your business's booking and profile pages.
Measures under Art. 32 GDPR as at the date of this agreement.
Instructions under § 6, requests from data subjects and any other question about this agreement should be addressed to:
datenschutz@terminz.comThe competent supervisory authority for Bornwerk is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. The German version of this agreement prevails.
