1. What is this page about?
This privacy notice explains which personal data we collect through our public website taxibuddy.be (including onboarding forms), why we use it, who we share it with, how long we keep it and which rights you have.
This notice does not apply to:
- The use of the TaxiBuddy mobile app by signed-in drivers and administrators — see the App Privacy Notice.
- Cookies in detail. For those, please see our Cookie Notice.
- The processing we carry out on behalf of a taxi company customer. There, the taxi company itself is the controller and we process under a Data Processing Agreement (DPA).
2. Who are we?
| Item | Value |
|---|---|
| Controller | Cools IT Solutions BV |
| Product trade name | TaxiBuddy |
| Address | Dorp 4E bus 021, 2820 Bonheiden, Belgium |
| Company number (KBO + VAT) | BE 0803.017.171 |
| Managing director + privacy contact | Jarno Cools |
| Contact (all privacy questions) | privacy@taxibuddy.be |
| Competent court | Antwerp, Mechelen division |
We have not appointed a Data Protection Officer (DPO) because our organisation is not legally required to do so (fewer than 250 employees and no large-scale processing of special categories of personal data).
Our internal privacy contact is managing director Jarno Cools. You can send all privacy-related questions, requests and reports to privacy@taxibuddy.be.
3. Which data do we collect?
a. Technical information on form submission. When you submit a form on our website, we automatically collect limited technical information: UTM parameters (to understand which marketing source you came from), referring page (HTTP Referer), the page path where you signed up, user agent (browser/device info), and a hashed version of your IP address for abuse prevention (we never see your IP itself, only an irreversibly encrypted version).
b. Onboarding request form (taxi companies). When you submit an onboarding request as a taxi company (before there is a contract), we process:
- Company name
- VAT number
- Company address
- Name, e-mail and phone number of the contact person
- Language preference
- Status information about your request (under review, approved, etc.)
c. Bot detection on forms. On the onboarding form we use Google reCAPTCHA v3 to distinguish automated requests (bots) from real visitors. In doing so, reCAPTCHA collects limited technical information, even without you clicking anything, such as your IP address, browser fingerprint and mouse or typing behaviour on the page.
d. Cookies and analytics. For the detailed list of cookies we set, see our Cookie Notice. In short: essential cookies (cookie choice, session management) without consent; Google Analytics 4 only after your explicit consent through the cookie banner.
4. Why do we use your data?
| Purpose | Which data | Legal basis |
|---|---|---|
| Processing and evaluating your onboarding request | Onboarding form | Performance of pre-contractual measures at your request, Art. 6(1)(b) GDPR |
| Preventing abuse and spam on our forms | Hashed IP, reCAPTCHA data | Legitimate interest, Art. 6(1)(f) GDPR |
| Understanding how visitors use our website in order to improve it | Google Analytics 4 (anonymised) | Consent, Art. 6(1)(a) GDPR (via the cookie banner) |
| Complying with legal obligations when requested by a competent authority | All of the above where relevant | Legal obligation, Art. 6(1)(c) GDPR |
We do not use your data for:
- Profiling or automated decisions with legal effects
- Resale to third parties
- External marketing campaigns outside TaxiBuddy itself
5. Who do we share your data with?
We only pass your data on to carefully selected service providers that help us run the website. We have a data processing agreement with each of them.
| Service provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting of taxibuddy.be (frontend + form endpoints) | United States, with EU region Frankfurt active | EU-US Data Privacy Framework |
| Microsoft Ireland Operations Ltd. (Azure) | Database storage of onboarding requests | EU (West Europe, Amsterdam) | No transfer outside the EEA |
| Resend, Inc. | Sending transactional confirmation e-mails | EU (on AWS EU infrastructure) | EU-only processing |
| Google LLC (Analytics 4) | Web analytics (only after cookie consent) | United States | EU-US Data Privacy Framework + SCCs |
| Google LLC (reCAPTCHA v3) | Bot detection on the onboarding form | United States | EU-US Data Privacy Framework + SCCs |
For a complete list of all external parties TaxiBuddy uses (including within our SaaS platform), see our Sub-processor list.
We do not share your data with:
- Marketing platforms or advertising networks
- Other taxi companies or platforms
- Third parties for commercial purposes
We may be required to share your data with competent authorities upon a lawful request (police, court, tax authorities).
6. How long do we keep your data?
We do not keep your data longer than necessary for the purpose for which we collected it.
| Type of data | Retention period |
|---|---|
| Onboarding requests that were rejected or lapsed | 6 months after rejection |
| Onboarding requests that led to a contract | For the duration of the contract + 7 years (accounting obligation) |
Cookie choice (tb_consent) | 1 year |
| Google Analytics data | 14 months (the default setting we apply) |
| reCAPTCHA data | According to Google's own retention policy |
A summary of our full retention policy for the SaaS platform is available on request via privacy@taxibuddy.be.
7. How do we secure your data?
We take appropriate technical and organisational measures:
- Encryption in transit: all communication with taxibuddy.be runs over HTTPS (TLS 1.2 or higher)
- Encryption at rest: databases at Microsoft Azure use transparent data encryption (TDE)
- Access restriction: only people who need it for their work have access to your data
- Pseudonymisation: IP addresses are irreversibly hashed
- Logging and monitoring: suspicious behaviour is detected and investigated
- Periodic review: our security measures are reviewed at least annually
No system is completely watertight. If a data breach involving your data were ever to occur, we will report it to the Belgian Data Protection Authority within 72 hours and, if there is a high risk to you, also directly to you.
8. Which rights do you have?
Under the GDPR you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Right of access (Art. 15) | You can request which data we hold about you and what we do with it |
| Right to rectification (Art. 16) | You can have inaccurate data corrected |
| Right to erasure (Art. 17, "right to be forgotten") | You can ask us to delete your data, except where we are legally required to keep it (e.g. invoices) |
| Right to restriction (Art. 18) | You can ask us to temporarily stop further processing of your data |
| Right to data portability (Art. 20) | You can receive a copy of your data in a machine-readable format |
| Right to object (Art. 21) | You can object to processing based on legitimate interest |
| Right to withdraw consent | For processing based on consent (e.g. analytics cookies) you can withdraw your consent at any time |
| Right to lodge a complaint | You can always lodge a complaint with the Belgian Data Protection Authority (see section 9) |
9. How do you exercise your rights?
Send us an e-mail at privacy@taxibuddy.be stating:
- Which right you want to exercise
- Which data your request concerns
- A way for us to verify your identity (e.g. replying from the e-mail address you used with us)
We handle your request within one month of receipt. For complex requests we may extend this period by a maximum of two months. We will inform you of this within the first month.
Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
10. Lodging a complaint with the supervisory authority
You have the right to lodge a complaint with the Belgian Data Protection Authority:
- Data Protection Authority (GBA/APD)
- Drukpersstraat 35, 1000 Brussels
- Tel: +32 2 274 48 00
- contact@apd-gba.be
- dataprotectionauthority.be
We recommend contacting us first (privacy@taxibuddy.be) so we can address any concerns directly, but you are of course not obliged to do so.
11. Applicable law and competent court
This privacy notice and all processing we describe in it are governed by Belgian law, supplemented by the directly applicable European General Data Protection Regulation (GDPR).
For disputes that cannot be resolved by mutual agreement or through the Data Protection Authority, the courts of the judicial district of Antwerp, Mechelen division have exclusive jurisdiction.
12. Changes to this notice
When we change this privacy notice, we update the version number and the date at the top of this page. For significant changes (such as new processing purposes or new categories of recipients) we will inform you directly if we have your contact details.