Data processing agreement

Version for the Termvio pilot phase. As of 25 October 2026.

2026-10-25-pilot-v2

1. Parties and subject matter

This Data Processing Agreement (DPA) applies between the Business as controller and Reka Digital — Blendion Reka, Marktgasse 46, 4900 Langenthal, Switzerland, as processor ("Termvio"). It forms part of the Terms of Service and governs the processing of personal data on behalf of the Business under Art. 9 FADP and, where applicable, Art. 28 GDPR. It applies for the term of the contract for the use of Termvio.

2. Nature, purpose and scope

Termvio processes the data exclusively to provide the agreed features to the Business: online booking, calendar, customer management, notifications, payments and vouchers, data export, and backup and restore.

• Data subjects: customers and prospective customers of the Business, staff of the Business.
• Types of data: contact data (name, email address, phone number), appointment and booking data, notes, consents, attendance and cancellation history, payment and voucher references, messages sent, and working hours, profile details and photos of staff.

Sensitive personal data, for example health data, does not belong in note fields unless the Business ensures it is lawful.

3. Instructions

Termvio processes the data only on documented instructions from the Business. The instructions follow from the Terms, this DPA and the Business's settings and actions in the service. If Termvio considers an instruction unlawful, it informs the Business.

4. Confidentiality

Persons at Termvio with access to the data are bound by confidentiality. Termvio accesses customer data only where necessary for operation, support or security.

5. Technical and organisational measures

• Hosting in a data centre in Germany (EU)
• encrypted transmission (HTTPS with HSTS)
• strict separation of data per business through a tenant-bound data access layer
• role-based access rights and mandatory two-factor sign-in for owners and administrators
• logging of security-relevant actions
• daily backups encrypted with AES-256-GCM, with rotation
• restrictive firewall and administrative access only with keys or two-factor sign-in

Termvio may adapt these measures to the state of the art without lowering the level of protection.

6. Sub-processors

The Business approves the service providers listed below under "Sub-processors and recipients". Termvio contractually binds them to an equivalent level of data protection. Termvio announces new or replacement sub-processors by email at least 30 days in advance. The Business may object for an important data protection reason; if no solution is found, it may terminate the contract effective on the date of the change.

7. Assistance

Termvio assists the Business with requests from data subjects, in particular through the export and anonymisation features in the service, and within reason with data protection impact assessments and requests from authorities. Requests received directly by Termvio are forwarded to the Business.

8. Personal data breaches

Termvio notifies the Business of personal data breaches affecting its data without undue delay, where possible within 48 hours of becoming aware of them. The notification includes the available information on the nature, scope, likely consequences and measures taken.

9. Audit rights

On request, Termvio provides the Business with the information needed to demonstrate compliance with this DPA. On-site audits are possible with reasonable notice, during business hours and at the Business's expense.

10. Location of processing

The data is stored in Germany. Processing outside Switzerland and the EU/EEA only takes place where adequate data protection or appropriate safeguards such as standard contractual clauses are in place. This currently concerns Stripe for payments.

11. Return and deletion

The Business can export its data at any time during the term. After the contract ends, Termvio deletes the data once the 30-day export period has expired, unless a legal retention obligation applies. Encrypted backups are overwritten within at most 6 months.

12. Liability and precedence

Liability is governed by the Terms of Service. In the event of conflict between the Terms and this DPA, this DPA prevails on data protection matters.

Sub-processors and recipients

• Hetzner Online GmbH, Gunzenhausen, Germany: hosting, database, files and encrypted backups (data centre in Germany)
• Brevo (Sendinblue SAS), Paris, France: sending emails
• Stripe Payments Europe, Limited, Dublin, Ireland: payments, deposits and subscription billing; possible transfer to affiliates in the USA based on appropriate safeguards
• Migadu-Mail GmbH, Schachen, Switzerland: mailbox for requests to info@termvio.com
• Push services of browser vendors (for example Google, Apple, Mozilla, Microsoft): encrypted delivery of push notifications to staff who enable them

SMS, WhatsApp, Instagram and the AI reception are currently not active. This list will be updated before they are activated.

Operator: Reka Digital — Blendion Reka, sole proprietorship (Switzerland), Marktgasse 46, 4900 Langenthal, Switzerland. Email: info@termvio.com