Timeveo is software you use to run your business. Under data protection law that has one clear consequence: you are the controller for your clients’ data, not Timeveo. Timeveo processes that data on your behalf. This page explains what that means in practice.
It is guidance, not legal advice. The binding documents are the Terms of Service and the Data Processing Agreement.
1. Short version
| Data | Controller (Art. 4(7) GDPR) | Timeveo’s role |
|---|---|---|
| Your clients’ data (appointments, contact details, notes, consents) | You, your business | Processor under the DPA |
| Your staff’s data in the app (accounts, working hours, roles) | You, your business | Processor under the DPA |
| Your contract and billing relationship with Timeveo (account, plan, invoices) | Timeveo | Independent controller, see the Privacy Policy |
| Payments made by your clients through your own Stripe or PayPal account | You and the payment provider | Intermediating platform, see section 4 |
2. What that means for you
As the controller you decide on the purposes and means of processing. Duties follow that Timeveo cannot take off your hands:
- Your own privacy notice. Your booking page needs a privacy notice that names your business as the controller, describes the purposes, and mentions Timeveo as the processor you use. You can store that text in the app’s settings; it is shown to your clients during booking.
- Legal bases. A booking normally rests on performance of a contract (Art. 6(1)(b) GDPR). Marketing by email or SMS, by contrast, needs consent or the narrow conditions of section 7(3) UWG (German unfair competition act). Timeveo provides consent management; the decision to send is yours.
- Special categories of data. If you record treatment notes or health information, that is data under Art. 9 GDPR. You are responsible for its legal basis and for appropriate safeguards.
- Retention and deletion. Tax and commercial retention periods apply to your business. If you use the point-of-sale functions, the duties under KassenSichV, AO and GoBD apply as well, including registering the till with the tax office.
- Data subject rights. Access, rectification and erasure requests from your clients are addressed to you. Timeveo supports you with the tooling in section 3; answering within the statutory deadlines remains your responsibility.
3. What Timeveo does
- Secure operation of the platform. Technical and organisational measures under Art. 32 GDPR, documented in Annex 1 of the DPA and summarised on the Security page.
- Processing only on your instructions. Your configuration in the app counts as an instruction. Timeveo does not use your clients’ data for its own purposes.
- Subprocessors. Selecting them, binding them contractually, and publishing them in the subprocessor list, including advance notice of changes.
- Tooling for data subject rights. Access exports, erasure functions and consent records are built into the app.
- Breach notification. If Timeveo becomes aware of a personal data breach, we inform you without undue delay so you can meet your notification duty under Art. 33 GDPR.
4. Payments
For card payments by your clients you use your own account with the payment provider (Stripe Connect, PayPal, SumUp). The contract for processing those payments is between you and that provider, which processes payment data as an independent controller, in particular for fraud prevention and regulatory duties. Full card details are never stored in Timeveo.
That is separate from billing your Timeveo plan: there Timeveo is your contracting party and Stripe is our processor.
5. Templates in the app
So you do not start from a blank page, Timeveo provides template texts for the client-facing documents. The template for your booking page’s privacy policy is available under Privacy Policy for Booking Pages; it describes every feature a booking page can use. Automatic adoption on your booking page, with your details and only the sections for the features you use, and a template for cancellation and no-show terms are in preparation. The templates are a draft that you must review and adapt where needed; legal responsibility for the published text stays with you.
6. Documents
- Terms of Service
- Data Processing Agreement, including measures and subprocessor list
- Timeveo’s Privacy Policy
- Privacy Policy for Booking Pages (template)
- Cookie Policy
- Subprocessors
- Security
Version 1.1, effective 26 September 2026.