Security and data protection

Your data sits in Germany. And stays there.

Application, database and files run on servers in Germany. What we do to protect them is written out here in full, without the seal bingo.

What we don't do

We don't sell data, don't pass it to ad networks and don't mine it for anyone else's purposes. Your customer file is yours, not ours: everything you record, and everything your customers release to you.

Terminz earns from the software subscription, not from booking commission and not from data.

Privacy page with the data processing agreement and error monitoring
The DPA, the subprocessors and exactly what error monitoring sends — listed openly.

Nine points, in plain words

Where the data sits
Application, database and file uploads run exclusively in German data centres. No transfer to third countries without a legal basis.
Encryption
TLS throughout for transfer, passwords stored as hashes, bank details encrypted on top in the database.
Who can see what
Permissions follow the role and the location. A staff member sees the calendar, not the revenue.
Tenant separation
Each location sees only its own data. Every query checks the tenant, not just the role.
Logging
Sign-ins, permission changes and access to customer data are logged and visible in the dashboard.
Your customers' rights
You get access and export as a file on request. If someone deletes their own Terminz account, the person triggers that themselves in the system; we then lock and delete your file on them after fixed periods.
Monitoring and backups
Daily encrypted database backups, plus error and uptime monitoring from outside the system.
Sub-processors
Who we use is listed openly in the DPA. If someone is added, you hear about it beforehand.
If you leave
You export till and accounting data yourself, even after the contract ends until deletion. Everything else comes as a file on request. After the contract ends your data is kept for another 90 days; then it is deleted. The exception is the locked copy of your till and accounting records: it is kept for ten years, and on request we hand it over and delete it.

More questions about data protection?

Write to us with whatever your data protection officer wants to know. We answer in writing so you can pass it on.