Retail, hospitality & leisure
Backup for retail and webshops that keeps orders and tills recoverable
Mindtime copies your shop's servers, order databases, laptops and Microsoft 365 or Google Workspace to its own Tier III data centres in the Netherlands and Germany, with an immutable copy and an air-gapped copy that ransomware cannot rewrite.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Retailers and webshops need an off-site backup because order history, till journals and invoices must stay available to the Belastingdienst for seven years, and one failed server or ransomware attack can wipe them out. Mindtime keeps immutable, air-gapped copies of your servers, databases and mailboxes in its own Dutch and German data centres.
What's at stake
The data retail and webshops can't afford to lose
Order and invoice history
Every online order, refund and invoice belongs to your tax administration. Lose the webshop database and you lose the trail that links payments to deliveries and returns.
Till journals and stock levels
Your point-of-sale system records each sale with a time and a user. That detail has to stay intact, not summarised, for as long as the tax rules require.
Customer accounts and the product catalogue
Customer logins, delivery addresses and years of product texts, photos and prices take months to rebuild by hand when the only copy sat on the server that failed.
Rules and obligations
What the rules ask of retail and webshops
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Seven years, ten for OSS VAT records
The Belastingdienst requires businesses to keep their basic records for seven years. Records for the EU One Stop Shop (OSS) VAT scheme, which webshops selling to consumers in other EU countries can use, must be kept for ten years. [1]
Till data in full detail, stored off-site
The Belastingdienst's guidance on reliable till systems says transaction data must be kept for seven years without being condensed, with corrections made by reversal rather than deletion. Because of possible calamities, the guidance says this data must be stored off-site. [2]
PCI DSS when card data touches your systems
The PCI Data Security Standard applies to every organisation that stores, processes or transmits cardholder data. Ask your payment provider which requirements fall on your shop and which on them. [3]
Report a breach of customer data within 72 hours
Under the GDPR (AVG), a breach affecting customer data must be reported to the Autoriteit Persoonsgegevens within 72 hours of discovery. A breach includes loss of availability, so ransomware that locks your customer database can count. [4]
NIS2: retail is not a listed sector
The Cyberbeveiligingswet, the Dutch implementation of NIS2, took effect on 15 August 2026. Retail is not among the sectors it lists; Annex II does include digital providers such as online marketplaces, and size thresholds apply, starting at 50 employees or more than €10 million in turnover and balance sheet total. [5]
When it goes wrong
When the shop server will not start
Illustrative example: a shop with two branches and a webshop on its own server finds on a Monday morning that the server will not boot after a storage failure. The webshop, the stock database and the till back office all ran on that one machine. With an off-site, immutable backup, the team restores the server and its database from the last checked backup onto replacement hardware, then matches the most recent orders against the payment provider's overview. Without it, they would be rebuilding the catalogue from supplier files and emailing customers for order details.
How Mindtime protects it
Backup for retail and webshops, workload by workload
- Database backupOrder and stock databases on MySQL, MariaDB, PostgreSQL or SQL Server are backed up in a consistent state, not as loose files.
- Linux server backupSelf-hosted webshops usually run on Linux, and the whole server, configuration included, is protected.
- Microsoft 365 backupSupplier mail, invoices in OneDrive and price lists in SharePoint get a separate copy outside Microsoft's environment.
- Laptop and endpoint backupLaptops in the shop and at home hold exports, product photos and spreadsheets that often exist nowhere else.
- Disaster RecoveryWhen the webshop or till back office is down, standby infrastructure lets you trade again while the original is repaired.
The software you use, and what we protect around it
| Shopify | Shopify runs your store as a service. Check what its export covers and the supplier's retention terms; Mindtime protects the Microsoft 365 or Google Workspace mail, files and laptops your team works from around it. |
|---|---|
| WooCommerce (WordPress) | If WooCommerce runs on your own or a rented Linux server, Mindtime backs up that server and its MySQL or MariaDB database. |
| Lightspeed | For Lightspeed's retail POS and ecommerce, check the supplier's export and retention terms. Mindtime protects the back-office laptops, spreadsheets and mailboxes around it. |
| Marketplace seller accounts (e.g. bol) | Orders received through a marketplace live in the marketplace's systems. Keep regular exports of orders and invoices in SharePoint, OneDrive or on a NAS that Mindtime backs up. |
Before you switch
What retail and webshops ask us first
Our platform or hosting company already makes backups. Why add another?
Their backups protect their platform, and their terms decide what you can get back and for how long, so read those terms. Mindtime keeps an independent copy of the servers, databases, mail and laptops you control, immutable and with an air-gapped second copy, in its own data centres in the Netherlands and Germany.
We are a small shop. Is this worth the effort?
A small shop carries the same seven-year record duty as a chain, with fewer people to rebuild lost data. Start with what you cannot replace: the till back office, the webshop database and the owner's mailbox. A free 15-minute demo shows what that looks like for your setup.
Does our customer data leave the EU?
No. Your shop's backups go only to Mindtime's own Tier III data centres in the Netherlands and Germany. Data is encrypted with AES-256 in transit, and every contract includes a data processing agreement.
FAQ
Questions about backup for retail and webshops
How long do retailers have to keep order and till data?
Seven years for most records, according to the Belastingdienst, and ten years for records under the EU One Stop Shop VAT scheme. The period starts when the data loses its current value, so this year's invoices may need to stay readable well into the next decade. A backup with long retention, stored away from the shop, is the practical way to keep them.
Is a USB drive or NAS in the shop enough?
It helps when a disk breaks, but not against fire, burglary or ransomware that reaches every drive on the network. That risk is why the Belastingdienst's till guidance asks for off-site storage of till data. Mindtime adds an immutable copy, which cannot be changed or deleted during its retention period, and an air-gapped copy, both outside your premises.
What happens if ransomware hits our webshop server?
Disconnect the server and assess whether customer data is affected; if it is, the Autoriteit Persoonsgegevens expects a report within 72 hours. Recovery starts from a backup the attacker could not change. Mindtime scans backups for malware and restores into an isolated environment first, so the infection does not come back. Admin actions require MFA, which makes deleting backups with stolen credentials harder.
Can you back up a retailer with several branches?
Yes. Back-office PCs, laptops and a local NAS in each branch can sit in the same account as your central servers and Microsoft 365 or Google Workspace. Every backup job is checked and monitored around the clock, so a branch whose backup has stopped is noticed straight away rather than during a restore.
Does a backup cover our PCI DSS obligations?
No single product does. PCI DSS covers how you handle cardholder data across your systems, and your payment provider can tell you which parts apply to you. A backup covers one piece: making sure the systems and records you depend on can be restored. Mindtime is audited for ISO 27001, which helps when an auditor asks how your backup supplier works.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.