Privacy Policy

Effective from: 22 August 2026
Last changed: 22 August 2026

This is a convenience translation of the Slovenian original, Politika zasebnosti. In case of any discrepancy, the Slovenian version prevails.

1. Who we are

The controller of personal data collected through the Termina platform (termina-booking.com) is:

Termina, računalniško programiranje, Neya Borysova s.p. Goriška ulica 4, 2000 Maribor, Slovenia Tax number: 16782062 Registration number: 7558252000 Email: info@termina-booking.com

We are committed to protecting your personal data and process it in accordance with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

We have not appointed a data protection officer, as we do not meet the statutory conditions requiring one. For any privacy question, write to the email address above.

For customer data that arises from a booking with a provider, the controller is the provider and Termina is the processor; that relationship is governed by the Data Processing Agreement.

2. Which data we process

2.1 Provider data

• Company details: legal name, registered office, registration and tax numbers, legal form, country

• Contact details: name and surname of the contact person, email address, phone number

• Business details: description of services, prices, opening hours, locations, photographs, logo

• Subscription details: chosen plan, period, payment history, issued invoices

• Usage data: sign-ins, actions in the account, bookings

2.2 Data of providers' staff

Where a provider works in a team: name, email address, working hours and assigned appointments. This data is entered by the provider, who is its controller; a staff member with an account sees their own calendar.

2.3 Customer data

• Name and surname

• Email address and phone number

• Booking details: provider, service, date and time, notes

• Booking history, waiting list

• Messages with the provider and Help messages

• Provider reviews

• Saved providers and chosen categories (if you have an account)

• Push notification subscriptions (device address), if you enable them

2.4 Data of all visitors

• Technical data: IP address, device and browser type, language, time of visit

• Anonymised usage data (pages visited, traffic source, country, device type), collected without cookies and without tracking individuals

2.5 Payment data

We do not collect, process or store payment card data. Payments are executed entirely by the payment provider Stripe. We receive only the payment outcome, the last four digits of the card and the card type.

3. Why we process data, and on which legal basis

You can switch off non-essential notifications at any time; notifications about a cancelled or rescheduled appointment reach you even after opting out, because they are necessary for performing the contract.

4. Who receives the data

We do not sell personal data. We pass it on only to the extent necessary for the platform to operate:

To providers. When a customer books an appointment, the provider receives the details needed to perform the service. For any further processing of that data the provider is an independent controller and is responsible for it.

To processors that perform individual services for us (hosting, payments, sending email and SMS, delivering push notifications, the map, traffic measurement). Their list is always published on the Sub-processors page; it is derived from the platform's actual configuration, so it cannot lag behind reality. Providers are notified of changes to the list 30 days before they take effect. We have data processing agreements under Art. 28 GDPR with all processors.

To public authorities, where the law requires it.

5. Transfers outside the EU

We process data within the European Economic Area as a rule. If a processor transfers data to a third country (visible on the Sub-processors page), the transfer relies on a European Commission adequacy decision or on standard contractual clauses.

6. How long we keep the data

• Account data (providers): for the duration of the subscription and 12 months after account termination

• Account data (customers): as long as you use the account; after 2 years of inactivity we warn you and then delete the account

• Booking data: 24 months from the appointment date. After that we irreversibly anonymise the name, email address and phone number; the booking remains, without the person, as a business event (date, service, amount) for as long as it must be kept as an accounting record.

• Accounting records and invoices: 10 years (per tax legislation)

• Messages with the provider and Help communication: 24 months

• Sent notifications (email, SMS, push): content and recipient are deleted after 6 months; the cost and count remain for billing

• Push notification subscription: until you switch notifications off on the device

• Data collected on the basis of consent: until consent is withdrawn

• Technical and security logs: 90 days

After these periods expire, the data is deleted or irreversibly anonymised.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy of it;

• rectification of inaccurate data and completion of incomplete data;

• erasure ("right to be forgotten") where there is no longer a legal basis for processing;

• restriction of processing in the cases set out in the GDPR;

• data portability in a structured, commonly used format;

• objection to processing based on legitimate interest;

• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.

You can export and erase your data directly in the app, in your account settings — no waiting and no request needed. For everything else, send a request to info@termina-booking.com; we reply within one month of receipt at the latest. For security we may ask for additional confirmation of your identity.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia Dunajska cesta 22, 1000 Ljubljana gp.ip@ip-rs.si | www.ip-rs.si

8. Cookies

We use only essential cookies, needed for the site to work, for sign-in and for security. The law requires no consent for these, so you will not see a cookie banner on the platform. Exactly what is stored in your browser and for how long is described on the Cookies page.

We use no analytics cookies or trackers. For measuring traffic we use Umami, which sets no cookies, creates no visitor identifiers and cannot track individuals across visits or across websites. The collected data is aggregated and anonymised.

Stripe may set its own fraud-prevention cookies during payment; these are necessary for the secure execution of the payment.

9. Security

We implement appropriate technical and organisational measures: encrypted data transfer (HTTPS), passwords stored only as hashes, role-based access, security event logging, regular software updates and backups with restore testing. Push notification content is encrypted from the server to the device.

Nevertheless, no system is completely secure. In the event of a personal data breach posing a high risk to your rights, we will notify you in accordance with Art. 34 GDPR.

10. Children

The platform is not intended for persons under 16 years of age. We do not knowingly collect children's personal data.

11. Changes to this policy

We may update this policy. We will notify you of material changes by email or with a notice on the platform. The current version is always published on this page, together with the date of the last change.