Data processing agreement

Last updated: 13 October 2026.

Parties #

• The Business that has an account with Bookable, hereinafter "the controller", "the Business" or "you".
• De Maeyer Silvio, sole proprietorship, trading as Bookable, Polderstraat 4, 9190 Stekene, Belgium, company number and VAT BE0742.507.284, info@bookable.be, hereinafter "Bookable" or "the processor".

Acceptance and form #

A.1. This agreement is concluded on the basis of article 28 of the General Data Protection Regulation (GDPR). It forms part of Bookable's terms and conditions.

A.2. The Business accepts this agreement electronically: when signing up, with the box for the terms and conditions, of which this agreement forms part, and in addition with a separate box before it switches on the intake, documents or treatment record functions. Bookable keeps per Business the version, the time and the User who accepted (when signing up also the language, a non reversible code of the IP address and a short description of the browser). A new version of this agreement requires a new acceptance.

A.3. Article 28(9) GDPR allows this agreement to exist in electronic form. The parties accept the electronic acceptance and its recording in the app as evidence.

A.4. Anyone who accepts on behalf of the Business declares that they may represent the Business.

1. Definitions #

The terms of article 4 GDPR (such as personal data, processing, controller, processor, data subject, personal data breach, data concerning health) have the same meaning in this agreement. "Customer" is a customer of the Business. "User" is a person with access to the management area of the Business. "Subprocessor" is another processor that Bookable engages. "Annex A" is the description of the service and of the data flows in the terms and conditions.

2. Subject matter, duration and description #

2.1. Bookable processes personal data on behalf of the Business in order to provide the Bookable service. Annex 1 describes the subject matter, the duration, the nature and purpose of the processing, the types of personal data and the categories of data subjects, as article 28(3) GDPR requires. Annex A of the terms and conditions describes each data flow step by step.

2.2. This agreement runs for as long as Bookable processes personal data for the Business, also after the end of the subscription until the data are deleted or returned under article 13 and Annex 4.

2.3. For the data that Bookable processes for its own operations (account and Users of the Business, subscription, invoices, support, security, the count of sign ups, and visitors and requests of the website bookable.be with their cookies and statistics) Bookable is itself the controller. Those fall under the privacy statement, not under this agreement.

3. Instructions #

3.1. Bookable processes the personal data only on the basis of the documented instructions of the Business. Those instructions are: this agreement, the terms and conditions, and the settings and actions of the Business and its Users in the app (for example switching on a function, choosing a retention period, deleting a Customer or making an export).

3.2. If the law of the Union or of a Member State requires Bookable to carry out a processing that is not in the instructions, Bookable notifies the Business of this beforehand, unless that law prohibits such notification.

3.3. If Bookable considers that an instruction infringes the GDPR or another data protection rule, it notifies the Business immediately.

3.4. Bookable does not use the personal data of Customers for its own purposes, does not sell them and does not use them for advertising. Counts without data of Customers (such as the number of bookings per Business in Bookable's overview) are not personal data of Customers.

4. Responsibility of the Business #

4.1. The Business is responsible for compliance with the GDPR for its processing. It provides a legal basis for each processing (article 6 GDPR) and an exception for health data (article 9 GDPR, see article 16), informs its Customers (articles 13 and 14 GDPR) with its own privacy text on its booking page, and chooses the retention periods that apply to it.

4.2. The Business only asks for the data it needs (data minimisation, article 5(1)(c) GDPR) and keeps health data and other sensitive data only in the fields meant for that (article 16).

4.3. The Business manages the access of its Users and their roles itself, and keeps track of who has access to health data where the law requires it.

4.4. Minors. If a parent or guardian books for a child, the Business is responsible for the question whether that person may act for this, and for the consent that is needed for the child. For a child the app keeps as little as possible (first name, date of birth, possibly a second parent).

5. Confidentiality #

5.1. Bookable ensures that everyone who has access to the personal data is bound by confidentiality. Today that is only Silvio De Maeyer. If employees or external helpers are added, they sign a confidentiality statement before they get access.

5.1/1. For health data, Bookable as processor designates the categories of persons who have access, with their capacity, and keeps that list available to the Data Protection Authority, as article 9 of the law of 30 July 2018 requires. Today that list contains one category: the administrator of Bookable (Silvio De Maeyer), for managing the hosting and fixing errors.

5.2. Access by Bookable to the data of a Business only takes place under article 12 (looking along), or where strictly necessary to fix an error or a security incident. Every such access is logged.

6. Security #

6.1. Bookable takes appropriate technical and organisational measures as referred to in article 32 GDPR. Annex 2 describes them as they are today in the code and the configuration.

6.2. Bookable may adapt the measures to the state of the art, as long as the level of security does not fall.

7. Subprocessors #

7.1. The Business gives Bookable a general written authorisation to engage subprocessors. The subprocessors at the start of this agreement are in Annex 3.

7.2. Notice of a change. Bookable announces a new or replacement subprocessor at least 30 days in advance by email to the owners of the Business and in Annex 3 of this agreement at app.bookable.be/verwerkersovereenkomst, with the name, the service, the data and the location. In case of an urgent replacement to secure the service or security, the period may be shorter; Bookable then explains why.

7.3. Objection. The Business may object within that period, with reasons, by email to info@bookable.be. If we do not find a solution together, the Business may stop the subscription before the change takes effect, at no cost and with a refund of the part paid in advance after that date.

7.4. Bookable imposes on each subprocessor, in an agreement, the same data protection obligations as in this agreement, in particular appropriate security. Bookable remains fully liable to the Business for its subprocessors.

8. Transfer outside the European Economic Area #

8.1. The database is in Frankfurt (Germany) and the documents are in the EU jurisdiction of Cloudflare R2. Bookable only transfers personal data outside the EEA, or allows access from outside the EEA, with a safeguard from chapter V of the GDPR: an adequacy decision (such as the decision on the EU US Data Privacy Framework for certified companies) or standard contractual clauses.

8.2. Annex 3 states for each subprocessor the location and the safeguard.

9. Assistance with the rights of data subjects #

9.1. The app itself gives the Business the means to comply with most requests (articles 15 to 22 GDPR): look up and correct a Customer, make an export per Customer (a zip with the data, the decrypted intake and the documents), delete a Customer (sensitive data removed, the rest anonymised, except what the Business must keep for its bookkeeping) and withdraw a consent for health data.

9.2. If Bookable receives a request directly from a Customer, Bookable forwards it to the Business within 5 working days and does not answer it on the merits itself, unless the Business asks it to.

9.3. If a request cannot be dealt with using the means in the app, Bookable helps within reasonable limits and within the period the Business needs to answer within one month (article 12(3) GDPR).

10. Assistance with other obligations #

Bookable helps the Business, taking into account the nature of the processing and the information available to it, with its obligations under articles 32 to 36 GDPR: security, notifying a breach, a data protection impact assessment and a prior consultation of the supervisory authority. For that Bookable provides on request this agreement, Annex A and Annex 2.

11. Personal data breaches (data leaks) #

11.1. Bookable notifies a breach affecting the data of the Business without undue delay, and at the latest within 48 hours after Bookable became aware of it, by email to the owners of the Business. The Business itself has 72 hours to notify the supervisory authority, if necessary (article 33(1) GDPR).

11.2. The notification contains, as far as known: what happened and when, which categories and approximately how many data subjects and data are affected, the likely consequences, the measures taken and proposed, and a contact person. What is not yet known follows as soon as it is known (article 33(3) and (4) GDPR).

11.3. The Business decides whether it notifies the breach to the supervisory authority and to the data subjects (article 34 GDPR). Bookable does not itself notify the Business's Customers, unless the Business asks it to or the law requires it. Bookable helps with the notification and provides the necessary information.

11.4. Bookable keeps a register of all breaches, with the facts, the effects and the measures, including breaches that did not have to be notified (article 33(5) GDPR).

11.5. Annex 5 describes Bookable's procedure in case of a breach.

12. Looking along by Bookable #

12.1. For support, security or fixing an error, an administrator of Bookable can open the management area of the Business. That only happens as follows:

• read only: every action that changes, sends or deletes something is refused;
• with a mandatory reason of at least 10 characters;
• through a one time link that is valid for 2 minutes, and then a session of at most 60 minutes;
• not for a Business that has stopped;
• with these data always hidden: addresses, intake, documents, help requests, certificates, exports, payments per Customer, treatment record, guest register and pass numbers;
• logged at Bookable and in the audit log of the Business, with the reason, so that the Business sees in its activity when Bookable looked along and why.

12.2. Looking along takes place at the request of the Business, or, without a request, only in case of a security incident or an error affecting several Businesses. In that last case Bookable notifies the Business afterwards.

13. End: return and deletion #

13.1. The Business can export its data at any time with the exports in Annex A, also during a pause.

13.2. After the end of the agreement Bookable returns the data by keeping them available for export for 90 days (the period that the app's emails about the pause already mention), and then deletes the personal data of the Business and its Customers, also in the document storage, under Annex 4.

13.3. Bookable only keeps what it must itself keep by law, such as its invoices to the Business. Data with a legal retention duty for the Business (such as payments, certificates or the guest register) Bookable does not keep longer than the period in 13.2, unless the parties agree otherwise separately; the Business exports them itself.

13.4. On request Bookable confirms in writing that the data have been deleted.

14. Information and audits #

14.1. Bookable makes available the information needed to show that it complies with this agreement, first of all with this agreement, Annex A, Annex 2 and written answers to a reasonable questionnaire.

14.2. If that is not enough, the Business may have an audit carried out by an independent auditor bound by confidentiality, at most once a year (except after a breach or at the request of a supervisory authority), with 30 days' prior notice, at the Business's expense, during office hours, and without access to data of other Businesses or to secrets of the security.

15. Liability #

The liability of the parties towards each other is governed by the terms and conditions, without prejudice to the liability that article 82 GDPR imposes directly towards data subjects.

16. Health data (the Healthcare family and sensitive questions) #

16.1. Application. This article applies if the Business switches on the intake or documents functions or uses sensitive questions. That happens mainly in the Healthcare family (physiotherapy, osteopathy, speech therapy, dietetics and podiatry), but may also happen in other families if the Business switches on sensitive questions. Those functions can only be switched on after the Business has accepted this agreement and chosen a retention period.

16.2. Special category. Data concerning health are a special category of personal data (article 9(1) GDPR). The Business must have an exception from article 9(2) GDPR, for example the explicit consent of the Customer (paragraph 2(a)), or processing for health care by or under the responsibility of a professional subject to professional secrecy (paragraph 2(h), together with paragraph 3). For Businesses in the Netherlands, article 30(3)(a) of the Uitvoeringswet AVG refers to care providers who process health data for proper treatment or care, or for the management of their professional practice.

16.3. Consent in the app. The intake contains a separate, unticked box for the consent to keep health data, with a reference to the Business's privacy text. Bookable keeps the time and the version of the consent text. Without a tick Bookable does not keep the sensitive answers. A prescription, vaccination proof or report can only be uploaded with that consent. The Business is responsible for the content of its consent text and privacy text.

16.4. Withdrawal. If a Customer withdraws consent, the Business does so in the app. Bookable then deletes the sensitive answers and documents of that Customer; the appointment itself remains.

16.5. Retention period. The Business chooses the retention period for intake and documents itself: 6, 12, 24, 60 or 120 months. There is no default: without a choice the function cannot be switched on. Every night the app deletes what has expired. For medical files, profession related periods may apply that are longer than what the app offers. In the Netherlands a care provider in principle keeps the file for twenty years after the last change (article 7:454(3) of the Dutch Civil Code); in Belgium the law on patients' rights and the law on quality of practice in healthcare apply; the Business then keeps a copy itself in its file.

16.6. Additional measures. For health data the following apply in addition to Annex 2:

• intake answers, notes in the treatment record and help requests are encrypted in the app with AES-256-GCM, bound to the Business and the row (envelope v2 with additional authenticated data): copied to another row or Business they are unreadable;
• documents are in a separate, private storage (Cloudflare R2), are encrypted at rest by the storage service, and can only be downloaded through Bookable's server by whoever is entitled to. Today they are not additionally encrypted by the app itself;
• only the owner and the staff member of the appointment concerned see intake and documents; the read only role and an administrator of Bookable looking along do not see them;
• every view of an intake or document goes into the audit log (who, when, which appointment);
• emails, the calendar and iCal never contain the content of an intake; the Business can set a neutral name for the treatment;
• the name of a course of treatment and the content of a note never appear in an email or the audit log;
• certificates are not separately encrypted, because they contain the ordinary details of a certificate (name, date, service, amount).

16.7. Belgian and Dutch rules. Besides the GDPR, the following may apply: in Belgium the law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, the law of 22 August 2002 on patients' rights, the law of 22 April 2019 on quality of practice in healthcare, and professional secrecy and the ethics of the profession; in the Netherlands the Uitvoeringswet AVG and the rules on the medical treatment agreement in Book 7 of the Civil Code.

16.8. Impact assessment. The processing of health data may require a data protection impact assessment from the Business (article 35 GDPR). For that Bookable provides on request Annex A, Annex 1 and Annex 2.

16.9. Other sensitive data. The number of a driving licence, the address for a home appointment, a pass number and the encrypted fields of the guest register (date of birth, place of birth, number of the identity document, accompanied minors) are not a special category, but are encrypted in the same way and never included in emails, calendars, logs or iCal.

17. Final provisions #

17.1. In case of contradiction between this agreement and the terms and conditions, this agreement prevails as far as personal data are concerned.

17.2. The law and competent court of the terms and conditions apply to this agreement.

17.3. Bookable may change this agreement as the terms and conditions (chapter 10). A change that reduces the protection of the data does not take effect without a new acceptance.

Annex 1. Description of the processing #

Subject matter: providing the Bookable service to the Business, as described in Annex A of the terms and conditions.

Nature of the processing: hosting, storing, organising, displaying, searching, encrypting, sending messages, creating payment links through the Business's Mollie link, exchanging calendars (iCal), exporting, anonymising, deleting and making backups.

Purpose: letting the Business work with online booking, calendar, customer management, payments of deposits and full amounts, intake, documents, treatment record, certificates, packages and credit, gift vouchers, waiting lists, classes, stays and guest register, tickets and messages to Customers.

Categories of data subjects:

• Customers of the Business, including parents or guardians of minor Customers, and children in a profile;
• recipients of a gift voucher;
• owners of animals (grooming salon);
• guests of accommodation and the minors they accompany (Rooms family);
• buyers of tickets (Tickets family);
• students of a driving school;
• Users of the Business (owner, staff), to the extent that their data are in the data of the Business (for example as staff member of an appointment or in the audit log).

Categories of personal data:

• identity and contact: name, email address, phone number, language;
• appointments and stays: service, moment, staff member, room, status, source of the booking, answers to the Business's questions, accepted terms, no show counter, address for a home appointment;
• payments: amounts, status, id and payment method at Mollie, refunds. No card numbers or account numbers;
• messages: content and sending status of emails to Customers;
• intake: answers to the Business's questions, possibly health data, with the time and version of the consent;
• documents: prescriptions, vaccination proofs, reports, inspiration photos and other files;
• treatment record and notes, courses of treatment;
• certificates;
• profiles: child, second parent, animal;
• driving licence: country, type, category, valid until, number;
• guest register: name, nationality, arrival and departure, date of birth, place of birth, number of the identity document, accompanied minors;
• tickets, pass number, gift vouchers (data of the recipient), packages, session cards, payment plans and credit;
• waiting lists and help requests;
• audit log: who did what in the management area.

Special categories: health data, only if the Business uses intake with sensitive questions, documents or the treatment record for such data (article 16).

Duration: as long as the agreement runs and then as in article 13 and Annex 4. Within the agreement the retention periods that the Business sets (intake, documents, treatment record, guest register) and the fixed periods of Annex 4 apply. For Customers, bookings, payments, orders, credits, certificates and the audit log there is today no automatic period: they remain until the Business deletes the Customer or until the end of the agreement.

Location: European Union (database in Frankfurt; files in the EU jurisdiction of Cloudflare R2). See Annex 3 for access from outside the EEA.

Annex 2. Technical and organisational measures #

This list describes the measures that are in the code and the configuration on 13 October 2026. What does not yet exist is listed separately at the bottom.

Separation between Businesses

• Every table with data of a Business has a column with the Business and row level security in Postgres: per request the app can only read and write the rows of the active Business.
• The app runs with its own database role without owner rights and without the right to bypass that security. Migrations use a separate role, which the running app does not know.
• References between tables contain the Business (composite keys), so that a row can never point to a row of another Business.
• For every table with data of a Business there is an automated test that checks that a Business cannot read the data of another Business.

Encryption

• All connections use TLS; in production HSTS is on (2 years, also for subdomains).
• The database is encrypted at rest by the hosting partner.
• Sensitive fields are encrypted in the app with AES-256-GCM. Envelope v2 binds each value, with additional authenticated data, to the Business and the row (and where needed the table and the field). This applies to intake answers, notes and treatment record, the address for a home appointment, the reason for refusal, help requests, driving licence numbers, the encrypted fields of the guest register, pass numbers, the link of a platform calendar, codes of gift vouchers and tickets in the queue, and the secret for the second factor of Bookable's administrators. Keys are in the hosting environment, not in the code, and can be rotated (an old key stays readable temporarily).
• The access keys of the Business's Mollie link are encrypted (envelope v1, without binding; move to v2 planned).
• Bookable keeps no access keys from Google: after signing in they are not stored.
• Management links, calendar links, links of platform calendars, codes of gift vouchers, QR codes of tickets and offers from the waiting list are random codes that are kept only as a hash (SHA-256).

Files

• Logos and photos are in a public bucket at Cloudflare R2. Customers' documents are in a separate, private bucket with its own access key that only works on that bucket.
• Uploading goes through Bookable's server, with a check of the type on the first bytes (pdf, jpg, png, heic), at most 10 MB per file, at most 5 per appointment and 3 at a time. The Customer's file name is not kept.
• Downloading only goes through Bookable's server, after a check of the role, with headers that prevent caching and executing of content. There is no public or lasting link to a document.
• Documents are encrypted at rest by R2, not additionally by the app.

Access in the management area of a Business

• Signing in with a link by email (valid for 15 minutes) or with Google; no passwords. A session lasts at most 30 days.
• Roles owner, staff member and read only. The check is in the domain functions and the queries, not only in the screens. Only the owner can export and delete Customers. A staff member sees sensitive data only for their own appointments.
• Counters against misuse on, among others: sign in links (3 per email address and 10 per IP address per 15 minutes), signing in with Google, email codes for Customers, signing up, booking, paying, intake, documents, waiting lists, vouchers, tickets, stays, calendar feeds, export per Customer (10 per hour) and deleting Customers (10 per hour).
• Pages of the management area cannot be shown in a frame of another site; only the booking form for a business's own website may.

Access by Bookable (platform)

• Bookable's management area uses its own database role that cannot read any tables of Businesses. It works only through predefined functions that first check that the user is an active administrator, and that give only overviews and counts without data of Customers.
• Signing in only for administrators on a list, with a link by email and then a mandatory second factor (TOTP or passkey), with recovery codes. A separate session of at most 8 hours, signed out after 30 minutes without activity. A complete content security policy (CSP) on that environment.
• Looking along in a Business: see article 12.
• Every action of an administrator (extending the trial, pausing, stopping, switching on functions, looking along, viewing a record) goes with a reason into the platform's audit log, which cannot be changed or deleted, and where it affects a Business also into its audit log.

Audit log and logs

• Write actions in the management area go into an audit log with who, when, what and the source (management, platform, system). Viewing of intake and documents is logged. The app can only read and add to the audit log.
• The queue logs on an error only the name and the code, no content.

Data minimisation

• Deleting a Customer removes sensitive data and anonymises the rest, also in old lines of the audit log, except what the Business must keep for its bookkeeping.
• The booking form keeps no personal data in the browser; what the Customer fills in stays in the memory of the page.
• Bookable passes no name or email address of the Customer to Mollie.
• A nightly task at 3 o'clock deletes expired intakes, documents and notes, and temporary data under Annex 4.

Organisation

• No keys in the code; secrets only in the hosting environment. Only Silvio De Maeyer has access to the hosting dashboard and the suppliers.
• Two step verification on the accounts with suppliers.
• Checking for vulnerabilities in the libraries used.
• The database is not open to the internet (internal traffic only).

Planned or still open

• A strict content security policy (CSP) on the pages of Businesses and the Business's management area; today only protection against being shown in a frame and a strict CSP on downloads.
• Error tracking (Sentry) without personal data, and an alert in case of an outage.
• A fixed procedure for backups and recovery, tested once, and a monthly encrypted export outside Render.
• Automatic deletion of the data of a Business that has stopped (article 13). Until then Bookable deletes them itself after the period in article 13.2.
• A retention period for the audit log.
• A procedure and log book for access to the database outside the app.

Annex 3. Subprocessors #

Not a subprocessor of Bookable for the Business:

• Mollie B.V. for payments of Customers: the Business has its own agreement with Mollie; Bookable passes no name or email address of the Customer to Mollie. For those payments Mollie is a partner of the Business.
• Google for the signing in of Users: that is a processing by Bookable as controller (privacy statement).

Planned, only after notice under article 7.2: Functional Software, Inc. (Sentry) for error tracking; Meta Platforms Ireland Limited (WhatsApp) and an sms service for messages; Google and Microsoft for calendar links.

Annex 4. Retention, return and deletion #

Annex 5. Procedure in case of a breach #

1. Establish. Whoever notices a possible breach (Silvio, a report from a Business, Customer or supplier) reports it to info@bookable.be. Bookable immediately notes the time of becoming aware.
2. Contain. Bookable immediately takes measures to stop the breach: rotating keys, withdrawing access, switching off a function, pausing the affected Business if needed.
3. Investigate. Bookable determines which Businesses, which data and how many data subjects are affected, using the audit log and the logs of the hosting and the suppliers.
4. Notify the Business. Within 48 hours after becoming aware, by email to the owners of each affected Business, with the content of article 11.2. Additions follow as soon as they are known.
5. Notify the supervisory authority for its own data. If the breach affects data for which Bookable is itself the controller (for example Users' accounts), Bookable notifies the Data Protection Authority within 72 hours, unless the breach is unlikely to result in a risk.
6. Assistance. Bookable helps the Business with its notification to the supervisory authority and the data subjects.
7. Record and learn. Bookable records the breach in the register (article 11.4) and takes measures to prevent it from happening again.