Data Processing Agreement

Effective from: 22 October 2026
Last changed: 22 October 2026 (data protection review: special categories of data in 3.1 with all categories; processor obligations under Article 28(3) GDPR in section 4; notice of a breach to the controller within 48 hours in section 8; assistance with the impact assessment with a template in section 8; Annex A technical and organisational measures — application-level encryption, access log under Article 22 ZVOP-2, encrypted backups in the EU; Annex B sub-processors with location and transfer basis; customers' courses in section 3; cosmetic salons in sections 2, 3, 4, 6, 8 and 9)
Previous change: 19 October 2026 (health data — Article 9 GDPR — in sections 2, 3, 4, 6, 8 and 9)

This is a convenience translation of the Slovenian original, Pogodba o obdelavi osebnih podatkov. In case of any discrepancy, the Slovenian version prevails.

This agreement (the DPA) forms an integral part of the Terms of Business of the Termina platform and governs the processing of personal data under Article 28 of the General Data Protection Regulation (GDPR) between:

• the provider — the business entity that accepts bookings through the platform (as controller), and
• Termina, računalniško programiranje, Neya Borysova s.p., Goriška ulica 4, 2000 Maribor, tax number 16782062, info@termina-booking.com (as processor; Termina).

The provider accepts the DPA at registration, together with the Terms of Business, and with every new version. There is no separate signature; acceptance is recorded with the document version and the time of acceptance (the written form under Article 28(9) GDPR is electronic).

1. Roles and delimitation

For the personal data of the provider's customers arising from bookings, courses, gift cards, payments, messages and reviews and from the provider's entries on the customer card, the controller is the provider and Termina is the processor, processing that data on the provider's behalf.

For data Termina processes for its own purposes — the provider's account, subscription billing, platform security, legal obligations (including DAC7 reporting), moderation under the Digital Services Act, customers' accounts with Termina and their social features — Termina is an independent controller; that processing is governed by the Privacy Policy, not by this DPA.

2. Subject matter, duration, nature and purpose of processing

• Subject matter: personal data of the provider's customers and staff entered on the platform or arising from its use.
• Duration: for as long as the provider uses the platform, and after termination until the periods in section 9 expire.
• Nature and purpose: storing and displaying bookings, the calendar and customer data; sending confirmations, reminders, instructions and notifications; messages between provider and customer; sale and use of courses and gift cards; payments through the payment intermediary; displaying reviews; billing; export; backups; deletion after the retention periods.
• Health data: where the provider enables the pre-visit questionnaire or the cosmetics questionnaire, the allergy test before colouring (the sensitivity test in cosmetics), keeps a hair profile, skin profile or treatment protocols, or stores progress photos with the customer's consent, Termina also collects, stores, encrypts, displays to the provider and deletes customers' health data (3.1), for a single purpose: so that the provider performs the service safely. It processes it for no other purpose.

3. Types of data and categories of data subjects

• The provider's customers: name, email address, phone number, booking data (service, date, time, person, price, notes, attached images), messages, reviews, data on online payments, deposits, bank transfers and split payments (amount and status; no card numbers), courses (service, number and use of visits, price, validity, extension and refund), gift cards (value, validity, use), event registrations, waiting list.
• The provider's staff: name, title, email address, working hours, assigned appointments, calendar actions.

3.1 Special categories of data (Article 9 GDPR)

The platform does not accept health services and does not require a customer to disclose health information in order to book. The provider may, however, enable features in which customers' health data is processed:

• Pre-visit questionnaire (providers in the Beauty group): allergy to acrylates and methacrylates (e.g. HEMA), other allergies with description, pregnancy, diabetes or circulation problems, skin and nail condition with description, medication affecting skin or nails, a note. Data subjects: customers who complete the questionnaire at their first booking with the provider.
• Cosmetics questionnaire (cosmetic salons: cosmetics, facial care, lashes and brows, make-up, waxing): isotretinoin in the last six months, retinoids or acids in the last week, photosensitising medication, corticosteroids, anticoagulants, pregnancy or breastfeeding, sun or solarium in the last 14 days, allergies (cosmetics, latex, lash and brow dyes, wax or rosin) with description, skin diseases (eczema, psoriasis, herpes) with description, diabetes, a note. Answers older than 12 months are renewed at the next appointment. Data subjects: customers of cosmetic salons who complete the questionnaire.
• Skin profile and treatment protocol (cosmetic salons): skin conditions (acne, rosacea, pigmentation, dehydration, other) and the skin reaction in the treatment protocol (none, slight redness, strong reaction, note), recorded by the provider; skin type, phototype, products, concentration, pH and exposure time are service data. Data subjects: customers for whom the provider keeps a profile or protocol.
• Progress photos (cosmetic salons): photos of the skin of the face or body before and after a treatment, which may reveal a skin condition; only with the customer's separate explicit consent; no biometric processing. Data subjects: customers who consent.
• Record of customers' consents with the provider: consent to processing of questionnaire answers, separate consent to publishing nail photos and separate consent to progress photos — type, given or withdrawn, time and source; permission to publish an individual progress photo with its time.
• Allergy test before colouring and sensitivity test: result (passed or reaction), time of the test, note and reopening after a reaction, recorded by the provider. Data subjects: customers who take or book a test.
• Hair profile: scalp sensitivity and allergies recorded by the provider. Data subjects: customers of hair salons for whom the provider keeps a profile.
• Indirectly from the booking and free text: the name of a service (for example an allergy test or prenatal exercise) and a note written by the customer may reveal health information.

The provider as controller:

• enables only the features it needs for the safe performance of its services;
• for the questionnaire, instructs Termina to obtain on its behalf the customer's explicit consent (Article 9(2)(a) GDPR) with the wording displayed by the platform, and to record it;
• for progress photos, instructs Termina to store a photo only with the customer's explicit consent given on the platform and to delete it on withdrawal; publishes a photo only where the customer has permitted publication;
• for the result of the allergy or sensitivity test, the scalp and allergies in the hair profile and the skin conditions and reaction it records itself, provides its own appropriate legal basis under Article 9(2) GDPR (as a rule the customer's explicit consent given at the visit, which the provider documents) and informs the customer of the processing;
• shares the content of health data, which the platform displays only to its owner account, only with the person who performs the service and is bound by confidentiality;
• does not enter special categories of data in other free-text fields (customer notes, remarks, messages), only in the fields intended for them;
• is responsible for a data protection impact assessment (Article 35 GDPR) of its processing where one is required (section 8).

4. The controller's instructions and Termina's obligations (Article 28(3) GDPR)

Termina processes data only on the provider's documented instructions, including with regard to transfers to third countries. The instructions are the defined functions of the platform and the settings the provider manages on its dashboard; individual instructions outside the platform's functions are sent to info@termina-booking.com. If Termina considers that an instruction infringes data protection law, it informs the provider immediately. Where processing is required by EU or Slovenian law, Termina informs the provider of that requirement before processing, unless the law prohibits this.

Termina undertakes to:

• ensure that persons authorised to process the data are bound by confidentiality (section 5);
• implement the measures under Article 32 GDPR (section 6 and Annex A);
• respect the conditions for engaging sub-processors (section 7 and Annex B);
• assist the provider in responding to data subject requests and with the obligations under Articles 32 to 36 GDPR (section 8);
• delete or return the data at the end of the services (section 9);
• make available to the provider the information needed to demonstrate compliance and allow audits (section 10).

The retention periods in section 9 are uniform for all providers, published in advance and part of this service; the provider accepts them with this DPA.

Enabling the questionnaire (including the cosmetics questionnaire), setting up the allergy or sensitivity test, keeping hair profiles, skin profiles and treatment protocols and adding progress photos are the provider's instructions for processing health data to the extent in section 3.1. Termina does not use this data for its own purposes: not for advertising, recommendations or profiling, not for analytics or statistics, it does not send it to the assistant Ina or any other language model and does not use it for AI training.

5. Confidentiality

Only persons who need the data to operate the platform have access to it, and they are bound by confidentiality by contract or by law. Administrator access is protected by two-step sign-in, and administrator views of data are logged. The administration interface does not display health data.

6. Security of processing (Article 32 GDPR)

Termina implements the technical and organisational measures in Annex A, maintains them and updates them according to the state of the art and the risk; it may not lower them below the level in Annex A without notifying the provider 30 days in advance. For health data (3.1) the additional measures in Annex A, point A.2, apply.

7. Sub-processors

The provider gives general authorisation for engaging sub-processors. Their list is always published on the Sub-processors page and is derived from the platform's actual configuration, so it cannot lag behind reality; Annex B lists the sub-processors and recipients Termina uses or may use, with the location of processing and the transfer basis.

Termina notifies providers by email of every intended change to the list 30 days before it takes effect. The provider may object to a change on justified data protection grounds; if the objection cannot be resolved, the provider may terminate the subscription without notice and export its data. Termina has a contract with every sub-processor imposing data protection obligations equivalent to its own under this DPA; if a sub-processor fails to fulfil its obligations, Termina is liable to the provider for the sub-processor's conduct.

8. Assistance to the controller

• Data subject rights: the provider can export or erase an individual customer's data directly on its dashboard; the customer manages their own questionnaire, consents and progress photos. A request a customer sends to Termina that concerns the provider's data is forwarded to the provider without undue delay, within 5 working days at the latest, and Termina helps with the reply; it does not decide on it itself.
• Personal data breaches: Termina notifies the provider without undue delay and no later than 48 hours after becoming aware of a breach concerning its data, describing the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed and a contact point; information not yet available is provided in phases. It assists the provider with notification to the supervisory authority (Article 33) and to data subjects (Article 34); the notification to the supervisory authority is made by the provider as controller, while Termina itself notifies breaches for which it is the controller. The provider's deadline is 72 hours from becoming aware.
• Impact assessment and prior consultation (Articles 35 and 36 GDPR): Termina provides the Template DPIA for salons, which describes the processing of health data on the platform, the risks and the measures, and on request provides further information the provider needs for its own impact assessment and for any prior consultation with the supervisory authority. The provider completes the template with its own circumstances (types of services, team, own processing outside the platform) and keeps it as its documentation.
• Health data: the export of an individual customer on the dashboard also contains their questionnaire answers (including cosmetics), the consent record, allergy test results, hair profile, skin profile, treatment protocols and the list of progress photos; deleting the customer on the dashboard deletes this data too.
• Access log (Article 22 ZVOP-2): on request, Termina gives the provider an extract of accesses to its customers' health data (who, when, what), without content.

9. Deletion and return of data

• The provider can export its customers' data at any time on its dashboard (structured, machine-readable export).
• 24 months after the appointment date the customer's name, email address and phone number are irreversibly anonymised and the text of the booking note is deleted; the booking remains as a business event without a person. The note also goes when the customer is deleted or anonymised.
• Messages and communication are deleted no later than 24 months after they arise.
• Accounting records are kept for 10 years and then deleted entirely.
• Health data: questionnaire answers (including cosmetics), allergy test results, scalp and allergies in the hair profile, skin conditions in the skin profile, skin reaction in treatment protocols and progress photos are deleted 24 months after the customer's last appointment with the provider (or after completion, the test or the last change of the profile, if later); questionnaire answers also immediately on withdrawal of consent. The consent record is kept as evidence and loses the email address when the customer is deleted. Deleted data may remain in backups until they are replaced (the last 14 daily backups on the server); backups are encrypted.
• After the subscription ends, the data remains available for export for a further 12 months (the account is locked), after which it is deleted or anonymised under the same rules. If the provider needs the data for longer, it must export it before expiry and is then solely responsible for it. At the provider's express request Termina anonymises the data earlier, except data it must keep by law.

10. Demonstrating compliance and audits

On request Termina makes available to the provider the information needed to demonstrate compliance with Article 28 GDPR (including this DPA, Annexes A and B, the record of processing activities for its processor role and an access-log extract) and allows audits, including inspections conducted by the provider or an auditor mandated by it and bound by confidentiality. An audit is announced at least 30 days in advance, conducted during normal working hours, at most once a year (except after a breach or at the request of the supervisory authority), and must not interfere with other providers' data; the provider bears the cost of the audit unless it reveals a material breach of this DPA.

11. Transfers to third countries

Data is as a rule processed within the EEA. Where a sub-processor transfers data to a third country (as shown in Annex B and the sub-processor list), the transfer relies on an adequacy decision (for the USA the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's standard contractual clauses with supplementary measures. Health data is not transferred to third countries: it stays on the server and in backups in the EU, is not included in notifications and is not sent to language models.

12. Liability and validity

Article 82 GDPR governs the parties' liability. The limitation of liability in the Terms of Business does not apply to data subjects' claims under Article 82 GDPR or to fines imposed by the supervisory authority for a breach of this DPA.

The DPA remains in force for as long as the contractual relationship under the Terms of Business exists, and with regard to retention until the periods in section 9 expire. In case of conflict between the DPA and the Terms of Business on data protection, the DPA prevails. Termina announces changes to the DPA 15 days before they take effect, as for changes to the Terms of Business; changes in the provider's favour or required by law may take effect immediately.

Questions: info@termina-booking.com

Annex A: Technical and organisational measures

A.1 General measures

• Transit: encrypted transmission of all data (HTTPS with HSTS); the API only over encrypted connections.
• Sign-in and sessions: passwords stored only as hashes (modern salted hash function); sign-in sessions in HttpOnly, Secure, SameSite cookies; sign-in throttling; confirmation of a new browser with a code from the email; sign-in with Google or Apple under the OpenID Connect standard.
• Role-based access: the customer sees their own data, the provider its customers' data, staff their own calendar without the customer card; every query is bound to the provider from the sign-in session; the administrator with two-step sign-in (token and TOTP) and logged views.
• Application-level encryption: health data and tax data (DAC7) are encrypted in the database with a key that is neither in the database nor in backups; key rotation is possible without downtime.
• Logs: security events without personal data content, 90 days; the access log for health data (A.2) separately.
• Notifications: push notification content encrypted from the server to the device (RFC 8291); health data never in email, SMS, Viber or push notifications.
• Backups: a daily copy of the database with a restore test on every copy (integrity and row counts), encrypted and transferred to storage off the server in the EU; the last 14 copies; older ones deleted.
• Development and operation: separate development and production environments; production data is not used in development; automated tests that also verify role-based access limits; regular updates of software and operating system; disk and system health monitoring.
• Data minimisation: photos without location and device metadata; visit measurement without cookies and without identifiers; pages with personal links without analytics.
• Incidents: a security incident register with a procedure, deadlines (48 hours to the controller, 72 hours to the supervisory authority) and a notification template.
• People: persons working with data are bound by confidentiality; the smallest number of people have production access; access is revoked on departure.

A.2 Additional measures for health data (3.1)

• binding to the provider: every query is bound to the provider from the sign-in session; another provider has no access to the same customer's data;
• owner account only: questionnaire answers, scalp and allergies in the hair profile, skin profile and treatment protocols, the allergy or sensitivity test result and progress photos are available only to the provider's owner account. Staff with their own account do not open the customer card; at their own appointment they see only a neutral warning "Check the notes with the salon owner before the service", without content;
• application-level encryption for all categories in 3.1, with the key outside the database and backups;
• access log (Article 22 ZVOP-2): every view, entry, change, export and deletion of health data is recorded with the type of action, time, the account that performed it and the customer and appointment reference, without content; the log is kept for 2 years, used only for verifying lawfulness, security and error correction, and is available to the provider on request for its customers;
• consent before storage: the server does not store the questionnaire, not even part of the answers, without explicit consent; it does not accept progress photos without consent;
• consent record: every consent given and withdrawn is a new record with time and source; records are not overwritten;
• withdrawal means deletion: on withdrawal of consent the questionnaire answers are deleted immediately; on withdrawal of consent to progress photos all of the customer's progress photos with the provider and the publications made from them are deleted;
• progress photos: in a private folder next to the database, not in the public image space; without metadata (location, time, device); served without caching only to the provider's owner account and to the customer via the signed link of their appointment; no biometric processing;
• deletion on anonymisation: when the provider deletes or anonymises a customer, their answers, test results, hair profile, skin profile, protocols and progress photos are deleted and the consent record loses the email address;
• automatic deletion after the periods in section 9;
• no disclosure in notifications and logs: answers and results are not in email, SMS or push notifications; the system log (90 days) records only the event with the appointment and provider reference — submission or withdrawal of a questionnaire without answers, and the fact that an allergy test result was recorded, without the result and without the note;
• no tokens in analytics: pages opened by a signed link (questionnaire, appointment, invoice, gift card and the like) do not load the visit measurement tool; other pages report only the path, without query string or fragment;
• Termina's administration interface does not display this data;
• no transfer to third countries and nothing sent to language models;
• customer access: the customer reaches their questionnaire through the signed link of their appointment, where they see and correct the answers or withdraw consent.

Annex B: Sub-processors and recipients

The current list is derived from the configuration and published on the Sub-processors page; this annex lists the parties Termina uses or may use, with their role, location of processing and transfer basis. Where the list on the page and this annex differ, the list on the page prevails; providers are notified of every change 30 days in advance.