Privacy Policy
Last updated: October 19, 2026
1. Data Controller and Scope
The controller of personal data is codevo s. r. o., Business ID (IČO): 57437807, Tax ID (DIČ): 2122728047, registered office Račianska 1527/81, 831 02 Bratislava, Slovak Republic, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 202955/B, email: [email protected] (the “Controller” or “we”). We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection. For any questions about data protection, contact us at [email protected]. This policy covers the personal data of Users of the Termio Service (owners of Businesses and Team Members), people who contact us and website visitors. Capitalised terms have the meaning given in the Terms of Service. If you are a client of a business that uses Termio (for example, you booked an appointment with it), that business is the controller of your data and we process it only as its processor under the Data Processing Agreement. Please direct questions about that data primarily to the business concerned.
2. Data We Process and Where It Comes From
We process the following categories of personal data: – Account data: name, email, hashed password, language and Account settings, time and version of acceptance of the Terms of Service; – Business and billing data: name, address, country, phone, Business ID, Tax ID, VAT ID and the result of its validation in the European Commission's VIES system; – Subscription and payment data: Plan, billing period, invoices, payment history, payment card type and its last four digits (we do not process the full card number, see Section 4); – when signing in with Google: name, email and Google account identifier; if you enable Google Calendar sync, also the calendar access tokens; – communication with us: the content of emails and support requests; – technical data: IP address, browser and device type, operating system, access time and application error records. We obtain the data directly from you when you register and use the Service. If the owner of a Business invites you as a Team Member, they provide us with your name and email. Providing Account data is a contractual requirement and without it we cannot provide the Service; billing data is also a statutory requirement for issuing an invoice.
3. Purposes and Legal Bases of Processing
We process personal data for the following purposes and on the following legal bases: – creating and managing the Account, providing the Service, Google sign-in, Google Calendar sync, Subscription management, payments and technical support – performance of a contract (Art. 6(1)(b) GDPR); – issuing and archiving invoices, bookkeeping, VAT ID validation and tax compliance – compliance with a legal obligation (Art. 6(1)(c) GDPR) under Slovak Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax; – securing the Service, preventing misuse and fraud, error monitoring and fixing, service notices about the Service and changes to terms, and establishing or defending legal claims – legitimate interest (Art. 6(1)(f) GDPR) in the secure and functional operation of the Service and in protecting our rights; – marketing communication (for example a newsletter), only if you give consent – consent (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing before withdrawal. We do not use analytics or advertising cookies. We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
4. Payments – Stripe
Payments are processed by Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., USA), a payment service provider certified to PCI DSS Level 1. You enter your card details (number, expiry date, CVC) directly on the Stripe payment page and we have no access to them; we only receive the card type, its last four digits and the payment result from Stripe. For fraud prevention and its own regulatory obligations, Stripe acts as an independent controller under its policy available at https://stripe.com/privacy.
5. Recipients and Processors
We do not sell, rent or trade your personal data, including data from your Google account. We share it only with the following processors that are necessary to operate the Service: – DigitalOcean, LLC (USA) – hosting of servers and databases; Service data is stored in a data centre in Frankfurt am Main (Germany, EU); – Stripe (Ireland and USA) – payment processing and subscription management (see Section 4); – Resend (USA) – sending emails, such as booking confirmations, reminders and service notices; – Cloudflare (USA) – content delivery network (CDN), website protection and custom domains; – Google (USA) – Google sign-in and Google Calendar sync; we access your calendar only if you enable the sync, and solely to write and update Termio bookings in your calendar; – Sentry (USA) – application error and performance monitoring; when an error occurs, it may record the session (Session Replay) with text and form content masked, solely to diagnose the error. We do not use any artificial intelligence (AI) models or third-party AI-based services to process your data, including data from your Google account. We have a data processing agreement under Art. 28 GDPR in place with each processor. We share data only to the extent necessary to provide the Service, and it is not used for advertising, profiling or any other purpose. We may also disclose data to public authorities where required by law and to persons providing us with accounting or legal services who are bound by confidentiality, to the extent necessary to fulfil our obligations.
6. Transfers Outside the EU
We store Service data on servers in the EU (DigitalOcean, Frankfurt am Main, Germany). However, some processors – DigitalOcean, Stripe, Resend, Cloudflare, Google and Sentry – are established in the USA or may process data in the USA (for example when managing infrastructure, delivering emails or processing errors). Personal data is transferred to the USA on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of standard contractual clauses approved by the European Commission under Art. 46(2)(c) GDPR. On request at [email protected], we will provide information about the safeguards used for a specific transfer and a copy of them.
7. Cookies and Local Storage
We do not use analytics, advertising or other tracking cookies or tools. We only use strictly necessary browser storage (cookies and localStorage) to sign you in and keep your session, and to remember your language, light or dark mode, the Plan selected at registration and which in-app hints you have already seen. This storage does not require consent under Slovak Act No. 452/2021 Coll. on Electronic Communications because it is necessary to provide the Service you requested. We send technical data about application errors to Sentry (see Section 5) on the basis of our legitimate interest in keeping the Service functional and do not use it for analytics or advertising. When you pay on the Stripe payment page, Stripe's policy applies.
8. Data Retention
– We keep Account and Business data for the duration of the Agreement. – The owner can delete a Business at any time in the Settings (Data and business deletion section) and can export all of the Business's data beforehand. Deleting a Business ends the Subscription immediately, and we permanently delete the Business's data, including data on clients, bookings, staff and uploaded files, after 30 days. If the user is not a member of any other Business, we anonymise their Account within the same period. – We keep invoices, Subscription records and the Business's billing details (name, address, Business ID, Tax ID, VAT ID) for 10 years from the end of the year to which they relate, under Section 35 of Slovak Act No. 431/2002 Coll. on Accounting and VAT rules, including after the Business is deleted. – We keep communication with support for as long as necessary to handle the request and to defend any legal claims, at most until the limitation period expires. – We keep technical logs and error records for no longer than 90 days. – We keep data processed on the basis of consent until consent is withdrawn.
9. Your Rights
Under the GDPR, you have the right of access to your personal data (Art. 15), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw consent at any time. Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21 GDPR). You may object to processing for direct marketing purposes at any time, without giving reasons. To exercise your rights, contact [email protected]. We will respond without undue delay and within one month at the latest; where necessary (given the complexity or number of requests), we may extend this period by two further months and will inform you in good time. If we have doubts about your identity, we may ask you for additional information. The owner of a Business can download its data at any time in a machine-readable format (JSON) via Data export in the Settings. If you believe that our processing of your data infringes the law, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk, or with the supervisory authority in the EU Member State where you live or work.
10. Security Measures
We implement appropriate technical and organisational measures under Art. 32 GDPR to protect data, in particular: encryption of data in transit (TLS), secure password storage (hashing), logical separation of each Business's data, role-based access control, data storage in a data centre in the EU, regular security updates and monitoring of errors and security incidents. In the event of a personal data breach, we proceed in accordance with Art. 33 and 34 GDPR.
11. Changes to the Privacy Policy
We may update this policy, in particular when the Service, our processors or the law change. We will inform you of material changes by email in advance. The current version with the date of the last update is always available at gettermio.com/privacy.
12. Contact
If you have any questions about data protection, please contact us: codevo s. r. o., Račianska 1527/81, 831 02 Bratislava, Slovakia, email: [email protected]. Supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk.