Privacy Policy

3.1 Website Delivery and Infrastructure (Bunny.net)

For the delivery of our website and the underlying infrastructure, we use services from BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. Specifically, we use:

• CDN (Content Delivery Network): Delivery of static website files (HTML, JavaScript, CSS) via a globally distributed server network
• Edge Scripting: Server-side logic executed at Bunny.net nodes
• Storage: Storage of static files and assets

With each page request, Bunny.net processes technical connection data, in particular IP address, timestamp, requested URL, and browser and device information. This data is technically required for website delivery. Under the data processing agreement, Bunny.net is contractually obligated to hold all raw log data including personal information exclusively in working memory (RAM) and to automatically delete it after 20–30 seconds. No permanent storage of IP addresses or connection data takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website).

Third country transfer: For the delivery of the website via Bunny.net's global CDN network, technical connection data (in particular IP addresses) may also be temporarily processed on servers outside the European Economic Area (EEA). This data is held exclusively in the working memory (RAM) of the respective CDN nodes and is automatically deleted after 20–30 seconds; no permanent storage takes place. The transfer is safeguarded by a data processing agreement pursuant to Art. 28 GDPR. Bunny.net contractually guarantees that all sub-processors employed implement appropriate technical and organizational safeguards in accordance with GDPR requirements. A Transfer Impact Assessment (TIA) has been conducted in accordance with the requirements of the CJEU's Schrems II ruling and the EDPB recommendations, confirming the adequacy of the protective measures in place.

Further information: bunny.net/privacy and bunny.net/gdpr

3.2 Application Data (Hetzner)

All user data – in particular account data, appointments, and booking information – is processed and stored exclusively on servers of Hetzner Online GmbH in Germany. No transfer of this data to third countries takes place.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) for the processing of user data such as account data, appointments, and booking information; Art. 6(1)(f) GDPR (legitimate interest) for the technical operation and ensuring the security and integrity of the application infrastructure.

4.1 Public Website (Landing Page)

When visiting our public website, only the technical connection data described in Section 3.1 is processed by Bunny.net. No personal data is collected beyond this.

4.2 Registration and User Account

To use Terminaro, registration is required. We process the following data:

• Name
• Email address
• Password (stored encrypted)
• Account-related settings and configurations

Legal basis: Art. 6(1)(b) GDPR (performance of contract). The information is required to use the service.

Retention period: Data is stored for the duration of account usage. After termination, data is deleted within 30 days, unless statutory retention obligations apply (in particular Sections 257 HGB and 147 AO, which may require retention of commercial and tax-relevant records for up to 10 years).

4.3 Session Management

After login, a session token is stored in the browser's local storage (localStorage). This token is used exclusively for authentication and allows users to remain logged in without having to enter a password on each page visit.

The token is stored exclusively locally in the browser and is not used for tracking or advertising purposes. It is deleted upon logout.

Legal basis: Section 25(2) No. 2 TDDDG (technically necessary for the provision of the service). Consent is not required.

4.4 Booking Form

Persons who book an appointment through a publicly shared booking form submit the following data:

• Name (required)
• Email address (required)
• Company (optional)
• Phone number (optional)
• Reason for booking (optional)

This data is stored to manage the appointment and process the booking. The account holder who provides the booking form is the sole data controller for the personal data of the persons booking through it. Terminaro processes this data exclusively as a data processor on behalf of the account holder pursuant to Art. 28 GDPR and acts solely in accordance with the account holder's instructions. Persons who book an appointment may exercise their data subject rights (e.g., access, rectification, erasure) with the respective account holder.

A data processing agreement pursuant to Art. 28 GDPR is concluded with account holders who use Terminaro for the processing of booking data. This agreement can be viewed at terminaro.eu/en/dpa.

Legal basis: Art. 6(1)(b) GDPR (implementation of pre-contractual measures at the request of the data subject).

Retention period: Booking data is stored until 90 days after the appointment date and then automatically deleted, unless statutory retention obligations require longer storage.

A reference to this privacy policy is displayed on the booking form.

4.5 Waitlist

Our website offers the option to sign up for early access to Terminaro via a waitlist. We collect only the email address of the person signing up.

Purpose: Notification about the launch of Terminaro.

Legal basis: Art. 6(1)(a) GDPR (consent). Registration is voluntary.

Retention period: The email address is stored until the launch of Terminaro, but no later than January 1, 2027, or until consent is withdrawn — whichever occurs first. Withdrawal is possible at any time by contacting: privacy@terminaro.eu