Last updated: 21 October 2026.
1. What this statement is about #
Bookable is an online platform with which businesses in Belgium and the Netherlands let customers book appointments, stays, classes and tickets online. This statement gives the information that articles 13 and 14 of the GDPR require, for anyone who visits the website bookable.be, uses the app app.bookable.be or contacts us. Bookable processes personal data in two roles:
- As controller for the data of visitors to bookable.be and app.bookable.be, of people who contact us or make a request, and of the businesses that use Bookable (owners and their staff). This statement is mainly about that (part 3).
- As processor for the data of the customers of those businesses. The business is responsible for that, not Bookable (part 4).
2. Who we are #
De Maeyer Silvio, sole proprietorship, trading as Bookable Polderstraat 4, 9190 Stekene, Belgium Company number and VAT: BE0742.507.284 Email for privacy questions: info@bookable.be
Bookable has not appointed a data protection officer. For any question about your data you can contact info@bookable.be.
Bookable keeps an overview of its processing. This statement and Annex 1 of the data processing agreement form the basis of it.
3. Bookable as controller #
3.1 About whom #
- Visitors to the website bookable.be, and people who make a request through the website.
- Owners who create an account, and staff of a business who get access to the management area.
- Visitors to app.bookable.be and to the pages of businesses (technical data only).
- People who join the waiting list for a family of trades that is not open yet.
- People who email us or send a question or wish in the app.
3.2 Purposes, data, legal basis and retention period #
| Purpose | Data | Legal basis (article 6(1) GDPR) | Retention period |
|---|---|---|---|
| Answering your request through the website (a new account with a call to set up together, custom work or a website, a question by email) | name, email address or mobile number, name of the business, trade, desired services, desired moment for a call, your explanation, language, the form and the page | performance of the contract or steps at your request before entering into it (b) | if you become a customer: as long as you are a customer, then as below; if you do not become a customer: at most two years after our last contact |
| Knowing which pages and campaigns produce requests (origin of the request) | the utm data and click ids of the link or advertisement you came through, the referring site, the first page and the time of your first visit | legitimate interest (f: understanding which pages and campaigns work) | like the request they belong to |
| Statistics of the website and of the sign up (Google Analytics) | random ids in cookies, pages viewed, clicks on buttons, language, trade, device and browser data, estimated region; never name or email address | consent (a), through the cookie banner | cookies at most 2 years; the data in Google Analytics according to the retention setting that Bookable chooses there |
| Seeing where visitors get stuck on the website and during sign up (Microsoft Clarity) | random ids in cookies, clicks, scrolling and mouse movement, pages viewed, device and browser data; filled in fields are masked and not recorded | consent (a), through the cookie banner | cookies at most 1 year; recordings in Clarity 30 days, summaries at most 13 months |
| Measuring advertisements (marketing) | the click on an advertisement (click id) and whether a request or account followed | consent (a), through the cookie banner | according to the duration of the cookie, see the overview of cookies |
| Remembering your cookie choice | your choice, in cookies of the banner and in the cookie bk_toestemming; no other data | legitimate interest (f: respecting your choice) | 1 year |
| Keeping the website running and secure | IP address, time, page and browser in the technical logs of the hosting; a non reversible code of your IP address in a 10 minute counter against misuse of the forms | legitimate interest (f: protecting the website and the data) | counter 10 minutes; logs according to the settings of our hosting partner |
| Creating an account and signing in | name, email address, language, session; with Google also the name and id of your Google account (no access keys from Google) | performance of the contract (b) | as long as the account exists, then 90 days |
| Request when signing up | email address, name of the business, trade, country, page and button through which you came | performance of the contract and pre contractual steps (b) | not finished: 7 days after it expires (a request is valid for 24 hours); finished: 13 months |
| Evidence of acceptance of the terms | document, version, language, time, user, a non reversible code (HMAC) of the IP address, a short description of the browser | legitimate interest (f: evidence of the contract) | as long as the contract runs and then until possible claims are time barred; when a business is deleted, the user, code and browser are cleared |
| Setting up the business | name of the business, legal name, address, phone, VAT number, sector and trade, settings | performance of the contract (b) | as long as the account exists, then as in article 13 of the terms and conditions |
| Subscription, payment and invoices | plan, period, amounts, invoices, id of customer and mandate at Mollie, type of payment method (no full account number or card number in Bookable) | performance of the contract (b) and legal obligation (c) | invoices and accounting records 7 years; other payment data as long as needed for the bookkeeping |
| Emails about starting and the trial (welcome, help with the first steps, end of the trial, payment) | email address, name, state of the onboarding | performance of the contract (b) and legitimate interest (f: helping you start). You can switch off the follow up emails with the link in every email | as long as the account exists |
| Tips and news from Bookable | email address, name, the page and button through which you came in, time and version of your consent | consent (a), with a box when signing up that is not ticked in advance | until you withdraw the consent |
| Understanding how businesses sign up (funnel) | a random id of the start, the page and button through which you came, the steps you saw; no IP address | legitimate interest (f: improving the sign up). Bookable sees only counts | 12 months, then only counts per month |
| Help and support | your question, email traffic, linked business | performance of the contract (b) and legitimate interest (f) | 2 years after the last question |
| Wishes for the app | your wish and the business | legitimate interest (f: improving the app) | 2 years after the last activity of the business |
| Looking along in a business for support | which administrator looked along, when, for what reason | legitimate interest (f: accountability) | as long as the audit log of the business exists |
| Security and preventing misuse in the app | IP address and email address in counters against misuse, technical logs, audit log | legitimate interest (f: protecting the service and the data) | counters 1 day; logs according to the settings of our hosting partner; audit log as long as the account exists |
| Waiting list for a family of trades that is not open yet | email address, family, trade, language | consent (a) | 30 days after the email about the opening, and in any case after 24 months |
| Legal obligations (bookkeeping, requests from authorities) | what the law requires | legal obligation (c) | as long as the law requires |
| Defending our rights | what is needed for a dispute | legitimate interest (f) | until the dispute is over |
You are not obliged to give us data, but without the data for a request, the account and the subscription we cannot help you and cannot provide the service. If you refuse cookies, the website simply works.
Bookable takes no decisions based solely on automated processing that significantly affect you (article 22 GDPR). A business is however paused automatically if the trial has ended without a subscription, or if a payment has still not succeeded after 10 days; that follows from the contract and you can lift it straight away by paying.
Bookable does not sell personal data. Statistics and the measuring of advertisements by Google take place only after your consent. The website and the app are meant for entrepreneurs; we do not knowingly collect data of children.
4. Bookable as processor for the customers of businesses #
4.1. If you book as a customer with a business that uses Bookable, that business is responsible for your data. Bookable stores and processes them only on behalf of the business, under a data processing agreement.
4.2. Read the business's privacy text. For questions about your data, access or deletion, contact the business. If Bookable receives such a question, we forward it to the business.
4.3. With healthcare businesses, the business may ask for health data in an intake or documents. Bookable only keeps sensitive answers if you tick the separate box for that. They are in the European Union; intake answers are encrypted by Bookable, documents by the storage service.
4.4. If you pay a business through Bookable, you pay directly to the business through Mollie. Bookable does not pass your name or email address to Mollie and does not see your card number or account number.
5. Recipients and subprocessors #
Bookable shares personal data only with suppliers that are needed to provide the website and the service, under an agreement that obliges them to confidentiality and security.
| Supplier | What | Location of the data | Transfer outside the EEA and safeguard |
|---|---|---|---|
| Render Services, Inc. | hosting of the app, the worker and the database | Frankfurt, Germany | company in the United States; possible access from outside the EEA; safeguard: EU US Data Privacy Framework or standard contractual clauses |
| Postmark (ActiveCampaign, LLC) | sending of emails by the app | United States | standard contractual clauses or EU US Data Privacy Framework |
| Cloudflare, Inc. | storage of logos, photos and documents (R2, EU jurisdiction) | European Union | company in the United States; safeguard: EU US Data Privacy Framework or standard contractual clauses |
| Bhosted | hosting of the website bookable.be, including the requests through the forms, and the mailbox info@bookable.be | Netherlands | no transfer expected |
| Strato AG | domain name (DNS) | Germany | no transfer expected |
| Mollie B.V. | collection of the subscription of businesses (Bookable passes only an internal number of the business) | Netherlands (EEA) | no transfer expected. For payments, Mollie is itself a controller |
| Google Ireland Limited or Google LLC | signing in with Google; after your consent Google Tag Manager, Google Analytics and Google Maps on the website and Google Analytics under /start in the app | determined by Google itself, possibly also in the United States | EU US Data Privacy Framework or standard contractual clauses. For signing in, Google is itself the controller for your Google account; for Analytics, Google processes data on our behalf |
| Microsoft Ireland Operations Limited | after your consent Microsoft Clarity on the website and under /start in the app | determined by Microsoft itself, possibly also in the United States | EU US Data Privacy Framework or standard contractual clauses; Microsoft processes the data on our behalf |
For the data of customers of businesses, the list of subprocessors is in Annex 3 of the data processing agreement.
Planned, not yet in use: error tracking with Sentry (Functional Software, Inc.), messages through WhatsApp (Meta Platforms Ireland Limited), an sms service (still to be chosen), and calendar links with Google and Microsoft. We will only add those after a notice as set out in the data processing agreement. If we add an advertising service, such as a Meta pixel, we will first ask for your consent and adapt this statement and the overview of cookies.
Furthermore, data may go to our accountant, a lawyer or an authority if the law requires it or if it is needed to defend our rights.
6. Transfer outside the European Economic Area #
The database and the files of the app are in the European Union, the website in the Netherlands. Some suppliers are companies from the United States or process data there. Bookable does so only with a safeguard from chapter V of the GDPR: an adequacy decision, such as the EU US Data Privacy Framework for certified companies, or standard contractual clauses. You can ask us for a copy of the safeguard.
7. Security #
Bookable takes technical and organisational measures (article 32 GDPR), including: encrypted connections, a database that is not open to the internet, strict separation between businesses at database level, extra encryption of sensitive fields in the app, signing in without a password, a management area for Bookable itself with a mandatory second factor and without access to customer data, and an audit log. The full list is in Annex 2 of the data processing agreement.
8. Your rights #
You have the right of access, rectification, erasure, restriction of processing, portability of your data, and objection to processing based on legitimate interest (articles 15 to 21 GDPR). If processing is based on consent, you can always withdraw it, without this changing anything about what happened before. You withdraw your consent to cookies with the Cookies button at the bottom of every page of bookable.be (see part 10).
Send your request to info@bookable.be. We may ask you to confirm your identity. We answer within one month; for a complex request that can be extended by two months, and we then let you know within the month (article 12(3) GDPR).
If you are a customer of a business, please contact the business (part 4).
9. Complaint #
If you are not satisfied with how we handle your data, please let us know first. You can also file a complaint with the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be. If you live or work in the Netherlands, you can also contact the Autoriteit Persoonsgegevens.
10. Cookies and storage in your browser #
Without your consent Bookable only uses the cookies and storage that are needed to make the website and the app work: signing in, the chosen business, the language, the steps of the sign up and the booking form, your cookie choice, and a cookie that records through which page a business signs up. We only place cookies for statistics and for measuring advertisements after you gave consent in the cookie banner on bookable.be. That choice also applies to the sign up pages of the app.
You can change or withdraw your choice at any time with the Cookies button at the bottom of every page of bookable.be. An overview of every cookie, with purpose and duration, is on the Cookies and data page.
If you pay through Mollie, sign in with Google or view a Google Maps map, you go to their pages or services, where their own cookies and privacy statement apply.
11. Changes #
We may adapt this statement. The date at the top shows the version. For material changes we notify businesses by email.