Privacy notice

Version for the Termvio pilot phase. As of 25 October 2026.

2026-10-25-pilot-v2

1. Controller

The controller for the processing of personal data on termvio.com is Reka Digital — Blendion Reka, Marktgasse 46, 4900 Langenthal, Switzerland, email: info@termvio.com. This notice follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Roles: Termvio and the businesses

Termvio is software for online appointment booking. When you book an appointment with a business (for example a salon), that business is the controller of your booking and customer data. Termvio processes this data only on its behalf and according to its instructions. Questions about this data are best sent directly to the business; requests we receive are forwarded to it.

Reka Digital itself is the controller for the website termvio.com, for the accounts of businesses and their staff, for pilot requests and for the security of the service.

3. Data we process

• Visiting the website: IP address, date and time, requested address, browser information and technical identifiers. We need them for delivery, security and abuse prevention, for example to limit excessive requests.
• Business and staff accounts: name, email address, password (only as a secure hash), two-factor settings, roles, active sessions with IP address and browser information, and a log of security-relevant actions.
• Business details: business name, locations, opening hours, services, prices, logo and photos, and subscription and billing data.
• Bookings via a booking page: name, email address, optional phone number, language, booked service, appointment, staff member, notes, status (for example attended, cancelled, no-show), payment and deposit references, vouchers, packages and memberships, and consents given.
• Pilot requests: name, email address, business name and language.
• Emails to us: content and sender details.

You enter card details directly with Stripe. Termvio does not see or store full card numbers.

4. Purposes and legal bases

We process data to provide the service and perform contracts (Art. 6(1)(b) GDPR), to meet legal obligations such as retention duties (Art. 6(1)(c)) and on the basis of our legitimate interest in a secure, stable and abuse-free service (Art. 6(1)(f)). You only receive marketing and rebooking messages from a business with your consent (Art. 6(1)(a)). You confirm it by double opt-in and can withdraw it at any time using the unsubscribe link. Under Swiss law, we process personal data in line with the principles of Art. 6 FADP.

5. No-show protection

Businesses can enable no-show protection. Using transparent rules the business can configure, it assesses previous no-shows, late cancellations, whether you are new to the business, the booking lead time and confirmed contact details. The result may mean that a deposit is required for a booking. It is visible only to the business, does not use AI and never leads to an automatic rejection. A person at the business can review and correct the assessment.

6. Emails and notifications

We send booking confirmations, reminders and account messages via Brevo. We do not use tracking pixels in these emails and do not analyse opening or click behaviour. Brevo technically routes links in emails through its own addresses to secure delivery and detect abuse; in doing so, Brevo may record that a link was opened. Staff can enable browser push notifications; these are delivered encrypted through the push service of their browser vendor.

7. Cookies

We only use necessary cookies: for sign-in and security, and for your chosen language and appearance (light or dark). We do not use advertising or analytics trackers.

8. Recipients and international transfers

We only share personal data with service providers where this is necessary for the service. The current list is shown below under "Sub-processors and recipients". Our servers are located in Germany; Switzerland and the EU recognise each other as providing adequate data protection. Payments to a business run through its own Stripe account; Stripe is partly a controller in its own right and may transfer data to affiliates in the USA based on the Data Privacy Framework or standard contractual clauses. Details are available at stripe.com/privacy.

9. Retention

• Account and business data: for as long as the account exists, then as set out in the Terms.
• Booking and customer data: for as long as the business needs it. The business can export and anonymise customer data at any time.
• Billing records: 10 years where required by law.
• Sign-in sessions: until they expire, at the latest after 7 days without use. Request-limiting entries: a few minutes.
• Pilot requests: until resolved, at the latest 12 months.
• Encrypted backups: rotating, at most 6 months. Deleted data may remain in backups until they rotate.

10. Security

We protect data with measures including encrypted transmission (HTTPS), strict separation of data per business, role-based access rights, mandatory two-factor sign-in for owners and administrators, and encrypted backups.

11. Your rights

You can request access to your data and have it corrected, deleted, restricted or provided in a common format. You can object to processing based on legitimate interests and withdraw consent at any time with effect for the future. To do so, email info@termvio.com. If your request concerns a business's booking data, we forward it to that business. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence.

12. Changes

We update this notice when the service or the law changes. The version published on termvio.com applies.

Sub-processors and recipients

• Hetzner Online GmbH, Gunzenhausen, Germany: hosting, database, files and encrypted backups (data centre in Germany)
• Brevo (Sendinblue SAS), Paris, France: sending emails
• Stripe Payments Europe, Limited, Dublin, Ireland: payments, deposits and subscription billing; possible transfer to affiliates in the USA based on appropriate safeguards
• Migadu-Mail GmbH, Schachen, Switzerland: mailbox for requests to info@termvio.com
• Push services of browser vendors (for example Google, Apple, Mozilla, Microsoft): encrypted delivery of push notifications to staff who enable them

SMS, WhatsApp, Instagram and the AI reception are currently not active. This list will be updated before they are activated.

Operator: Reka Digital — Blendion Reka, sole proprietorship (Switzerland), Marktgasse 46, 4900 Langenthal, Switzerland. Email: info@termvio.com