1. What is this page about?
This privacy notice explains which personal data we collect through our public website taxibuddy.be (including onboarding forms), why we use it, who we share it with, how long we keep it and which rights you have.
This notice does not apply to:
- The use of the TaxiBuddy mobile app by signed-in drivers and administrators — see the App Privacy Notice.
- Cookies in detail. For those, please see our Cookie Notice.
- The processing we carry out on behalf of a taxi company customer (driver, ride and passenger data in the platform). There the taxi company itself is the controller, and we process on the basis of a data processing agreement (DPA).
The data we process about our customers as controller — the onboarding request as well as the customer relationship and invoicing after the contract — does fall under this notice (see section 3).
2. Who are we?
| Item | Value |
|---|---|
| Controller | Cools IT Solutions BV |
| Product trade name | TaxiBuddy |
| Address | Dorp 4E bus 021, 2820 Bonheiden, Belgium |
| Company number (KBO + VAT) | BE 0803.017.171 |
| Managing director + privacy contact | Jarno Cools |
| Contact (all privacy questions) | privacy@taxibuddy.be |
| Competent court | Antwerp, Mechelen division |
We have not appointed a Data Protection Officer (DPO) because our organisation is not legally required to: our core activities involve neither large-scale, systematic monitoring of data subjects nor large-scale processing of special categories of personal data (Art. 37 GDPR).
Our internal privacy contact is managing director Jarno Cools. You can send all privacy-related questions, requests and reports to privacy@taxibuddy.be.
3. Which data do we collect?
a. Technical information when you visit. To prevent abuse of our website and forms, our servers briefly process your IP address for rate limiting (restricting the number of requests per visitor). This happens only in the server's working memory; the IP address is not stored anywhere else and is not linked to your request. (One exception: when you accept the agreement we do record the IP address, as part of the evidence — see point e below.) In addition, our hosting providers keep standard, short-lived access logs (see section 5).
b. Onboarding request form (taxi companies). When you submit an onboarding request as a taxi company (before there is a contract), we process:
- Company name
- VAT or company (KBO) number
- Company address
- Name, e-mail and phone number of the contact person
- Language preference
- IBAN of your taxi company's bank account (not the account you pay us from): it appears with your company details in the app, with the details of every ride and on your monthly transaction report
- The municipality that issues your IBP licence, and whether you drive yourself
- Optionally, the details of a vehicle (licence plate, chassis number, make, model and the vehicle ID on your licence). If you are starting a new taxi company, they appear on your test documents for the municipality; if you fill in the licence plate, chassis number, make and model, we also use them to create your first vehicle in the app when your subscription is activated
- Your login identity once you create an account to continue the request (via Auth0, our identity provider — see section 5)
- Status information about your request (under review, approved, etc.)
- Internal follow-up by our staff: notes and labels on your request, and the reason when we park a request because we no longer expect it to lead to an activation
While you fill in the form we check the company number you entered with VIES, the European Commission's public VAT validation service, to pre-fill your company details correctly. Only the number is passed to VIES.
c. Bot detection on forms. On the onboarding form we use Google reCAPTCHA v3 to distinguish automated requests (bots) from real visitors. In doing so, reCAPTCHA collects limited technical information, even without you clicking anything, such as your IP address, browser fingerprint and mouse or typing behaviour on the page.
d. Cookies and analytics. For the detailed list of cookies we set, see our Cookie Notice. In short: essential cookies (cookie choice, session management) without consent; Google Analytics 4 only after your explicit consent via the cookie banner — without consent the Google script is not even loaded. With that consent, Google Analytics also receives the ID of your request when you submit it successfully, and, when your subscription is activated, the invoiced amount and a transaction reference.
e. Customer relationship and invoicing (after your subscription is activated). If your request becomes a contract, we process, as controller, the data needed to manage the customer relationship and to invoice:
- Company and contact details (company name, address, company number, contact person with email and phone)
- Subscription and invoice data: invoices, amounts, payment status, structured payment references (OGM), payment reminders, formal notices and legal notifications
- Bank transaction data of incoming payments on our account — payer name, IBAN, payment reference, amount and date — which we retrieve through our bank connection to match payments to invoices automatically
- Status changes and audit logs of your customer account (who did what, when)
- Internal notes by our staff on your customer file
- Proof of acceptance of the contract: when you accept the Terms & Conditions and the data processing agreement, we record the signatory's name, the signature placed (as an image), the time, the IP address the acceptance came from and the document versions accepted; this data also goes into the signed agreement (PDF) and into the audit log of your customer account
- A full copy of the important emails we send you about your contract: the confirmation of your signature, notices of changes to our terms, payment reminders, formal notices, the suspension and reactivation of your subscription and the confirmation of a cancellation or termination. We keep the address the email was sent to, the subject, the content and the attachments as they were sent, and the time your mail server accepted the email
This data is personal data when the customer is a natural person (sole trader), and insofar as it identifies a natural person (such as the contact person or a payer).
f. Contact via WhatsApp. In several places on the website and in the onboarding you can reach us via WhatsApp: to ask questions, to send the proof of payment of your first invoice, or to let us know you want to hear when TaxiBuddy becomes available in your region. We then process your phone number, your name as shown in WhatsApp, the content of the conversation and any attachments you send. We use a proof of payment only to match your payment to the invoice. WhatsApp is a service of Meta Platforms Ireland Limited, which processes your phone number and usage data as a separate controller under its own privacy policy (see section 5).
g. Reviews on our homepage. On the homepage we show a few public reviews of the TaxiBuddy app from the App Store and Google Play: the text, the number of stars, the date and the name under which the author published the review in the store. We copied that data from the store, together with the reference of the review there, and fixed it in the code of our website; nothing is requested from Apple or Google for this when you visit. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR): showing visitors what users say about the app. If you are the author and no longer want to appear on our website, send an email to privacy@taxibuddy.be; we will then remove your review.
4. Why do we use your data?
| Purpose | Which data | Legal basis |
|---|---|---|
| Processing and evaluating your onboarding request | Data from your onboarding request (§3b) | Performance of pre-contractual measures at your request, Art. 6(1)(b) GDPR |
| Invoicing and collecting your subscription, including reminders and formal notices | Customer relationship and invoice data (§3e) | Performance of a contract, Art. 6(1)(b) + legal obligation (VAT/accounting), Art. 6(1)(c) GDPR |
| Automatically matching incoming payments to invoices | Bank transaction data (§3e) | Legitimate interest (correct accounting), Art. 6(1)(f) GDPR |
| Proving that, when and by whom the agreement was accepted | Signatory's name, signature, IP address, time, document versions (§3e) | Performance of a contract, Art. 6(1)(b) + legitimate interest (evidence in disputes), Art. 6(1)(f) GDPR |
| Proving that and when we sent you a notice, reminder or formal notice about your contract, and what it said | Copies of the important emails (§3e) | Performance of a contract, Art. 6(1)(b) + legitimate interest (evidence in disputes), Art. 6(1)(f) GDPR |
| Preventing abuse and spam on our forms | IP address (briefly, in working memory), reCAPTCHA data | Legitimate interest, Art. 6(1)(f) GDPR |
| Understanding how visitors use our website and measuring whether the onboarding leads to activations (conversion measurement, including the ID of a successful request, the invoiced amount and the transaction reference — see the Cookie Notice) | Google Analytics 4 | Consent, Art. 6(1)(a) GDPR (via the cookie banner) |
| Complying with legal obligations when requested by a competent authority | All of the above where relevant | Legal obligation, Art. 6(1)(c) GDPR |
We do not use your data for:
- Profiling
- Resale to third parties
- External marketing campaigns outside TaxiBuddy itself
The platform does take one decision automatically: if an invoice remains unpaid after our formal notice, it suspends your subscription (article 10.7 of the Terms & Conditions). You can always ask a member of our staff to review that suspension, and you can give your point of view or contest it via info@taxibuddy.be.
5. Who do we share your data with?
We only pass your data on to carefully selected service providers that help us run the website and our services. We have a data processing agreement with each of them.
| Service provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Auth0 (Okta) | Login and account management for the signed-in pages of the website: the onboarding, invitations and My documents (identity provider; the website keeps your login in the __session cookie, see the Cookie Notice) | EU tenant (Frankfurt) | No transfer outside the EEA |
| Vercel Inc. | Hosting of taxibuddy.be (frontend + form endpoints), of our internal back office, in which our staff follow up requests and customer files, and of our internal cost allocation on cost.della7.com, which receives the company name, invoice number, amount and payment date of every paid subscription invoice | EU region Frankfurt | EU-US Data Privacy Framework |
| Microsoft Ireland Operations Ltd. (Azure) | Our backend: the database with your request and customer file, the API through which the website, the app and the back office work, the background tasks (Azure Functions), such as sending emails and push notifications, and the monitoring (Application Insights) | EU (West Europe, Amsterdam) | No transfer outside the EEA |
| Resend, Inc. | Sending our transactional emails: confirmations, payment reminders and formal notices, notifications (the invoice itself is sent by OnFact). Those emails have info@taxibuddy.be as their reply-to address | Sent from an EU region; platform and support in the United States | EU-US Data Privacy Framework + SCCs — see sub-processor list SP-4 |
| Google LLC (Analytics 4) | Web analytics (only after cookie consent) | United States | EU-US Data Privacy Framework + SCCs |
| Google LLC (reCAPTCHA v3) | Bot detection on the onboarding form | United States | EU-US Data Privacy Framework + SCCs |
| Google LLC (Firebase Cloud Messaging) | Push notifications: to our staff in the back office for every new onboarding request (company name and email address of the applicant) and when the first payment of a request becomes due (company name and amount); to the administrators of your company in the TaxiBuddy app about your invoices (invoice number and amount) | United States | EU-US Data Privacy Framework + SCCs |
| Apple Inc. (Push Notification service) | Delivery of those push notifications on iPhones | United States | SCCs |
| OnFact (Infinwebs BV) | Drawing up and sending subscription invoices, including via Peppol | Belgium (AWS Dublin) | No transfer outside the EEA |
| Enable Banking Oy | Bank connection: retrieving bank transactions to reconcile payments | Finland (EEA) | No transfer outside the EEA |
| Zoho Corporation B.V. (Zoho Mail) | Our mailboxes: all email you send us, including your reply to an automatic message from the platform, and the email we send you outside those automatic messages | EU data centres (Netherlands, Ireland) | Support access from outside the EEA under SCCs (Zoho DPA) |
The company number you enter is checked with VIES (European Commission) during onboarding — a public validation service, not one of our processors.
If your taxi company has a Flemish licence, during the onboarding we test your connection with Chiron, the Flemish government system for the registration of taxi rides. We use the Chiron credentials you enter for this. If you are starting a new taxi company, we also send a few test rides to the Chiron test environment, with fictitious vehicle and driver details but with your company number and company name. Chiron is not one of our processors but a separate controller (public authority) with its own legal regime.
On the Chiron instruction pages in the onboarding we also show an instruction video from the Flemish government that loads directly from assets.vlaanderen.be; when you view that page or video, that service receives — as any web server does — your IP address and browser data. We do not send it any data ourselves.
If you contact us via WhatsApp, Meta Platforms Ireland Limited (WhatsApp) processes your phone number, device and usage data as a separate controller under the WhatsApp privacy policy; the content of messages is end-to-end encrypted. For the transfer to the United States, Meta relies on the EU-US Data Privacy Framework and on standard contractual clauses. We do not use WhatsApp for marketing.
If an invoice remains unpaid after our formal notice, we may hand over its collection to the debt collection agency TCM Belgium NV (Industriepark 6, 3300 Tienen, Belgium). TCM then receives what it needs to collect the unpaid invoices: the name, address, VAT number, email address and phone number of your company, the unpaid invoices, our formal notices, an overview of the service provided, the documents that support the claim (such as emails about the invoice or a cancellation) and the proof that you accepted the Terms & Conditions (the signatory's name, the signature, the date and time and the IP address). TCM only claims the amount of the invoices and processes this data as a separate controller, under its own privacy policy at tcm.be. Should a file still have to go to court, a lawyer or a bailiff will also receive this data.
For a complete list of all external parties TaxiBuddy uses (including in our SaaS platform), see our Sub-processor list.
We do not share your data with:
- Marketing platforms or advertising networks
- Other taxi companies or platforms
- Third parties for commercial purposes
We may be required to share your data with competent authorities upon a lawful request (police, court, tax authorities).
6. How long do we keep your data?
We do not keep your data longer than necessary for the purpose for which we collected it.
| Type of data | Retention period |
|---|---|
| Onboarding requests that were rejected | 6 months after rejection |
| Onboarding requests you do not complete | At the latest 6 months after your last step. If you drop out after your request was approved but before you chose a subscription, and our automatic clean-up is switched on, we delete the request sooner, once it has been inactive for seven days after our last reminder (about ten days after your last step). Whatever is not deleted automatically, we delete manually. In both cases we only keep an anonymous statistic (stage of drop-out, number of reminders, dates) |
| Conversations via WhatsApp (questions, proofs of payment, interest by region) | Proofs of payment: deleted as soon as the payment is matched to the invoice; other conversations: at the latest 6 months after the last message, or earlier at your request |
| Onboarding requests that led to a contract | For the duration of the contract + 10 years (contract file: tax retention obligation and limitation period, together with the proof of acceptance) |
| Invoices, payment and bank transaction data | 10 years — VAT and accounting legislation |
| Proof of acceptance of the contract (signature, IP address, document versions) | Duration of the contract + 10 years — limitation period |
| Collection file for an unpaid invoice (contact attempts and notes, supporting documents, copies of formal notices and what was sent to the collection agency) | Together with the contract file: duration of the contract + 10 years — limitation period |
| Copies of the important emails about your contract (§3e) | Together with the contract file: duration of the contract + 10 years — limitation period |
| Vehicle details from the onboarding, internal notes and labels by our staff and the reason why a request was parked | Together with the request or customer file they belong to (see the periods above) |
Cookie choice (tb_consent) | 1 year |
| Google Analytics data | Up to 14 months |
| reCAPTCHA data | According to Google's own retention policy |
A summary of our full retention policy for the SaaS platform is available on request via privacy@taxibuddy.be.
7. How do we secure your data?
We take appropriate technical and organisational measures:
- Encryption in transit: all communication with taxibuddy.be runs over HTTPS (TLS 1.2 or higher)
- Encryption at rest: databases at Microsoft Azure use transparent data encryption (TDE)
- Access restriction: only people who need it for their work have access to your data
- Data minimisation: the IP address used for abuse prevention stays in working memory and is not stored; only when you accept the agreement do we record the IP address as evidence (see sections 3e and 6)
- Logging and monitoring: suspicious behaviour is detected and investigated
- Periodic review: our security measures are reviewed at least annually
No system is completely watertight. If a data breach involving your data were ever to occur, we will report it to the Belgian Data Protection Authority within 72 hours and, if there is a high risk to you, also directly to you.
8. Which rights do you have?
Under the GDPR you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Right of access (Art. 15) | You can request which data we hold about you and what we do with it |
| Right to rectification (Art. 16) | You can have inaccurate data corrected |
| Right to erasure (Art. 17, "right to be forgotten") | You can ask us to delete your data, except where we are legally required to keep it (e.g. invoices) |
| Right to restriction (Art. 18) | You can ask us to temporarily stop further processing of your data |
| Right to data portability (Art. 20) | You can receive a copy of your data in a machine-readable format |
| Right to object (Art. 21) | You can object to processing based on legitimate interest |
| Right to withdraw consent | For processing based on consent (e.g. analytics cookies) you can withdraw your consent at any time |
| Right to lodge a complaint | You can always lodge a complaint with the Belgian Data Protection Authority (see section 10) |
9. How do you exercise your rights?
Send us an e-mail at privacy@taxibuddy.be stating:
- Which right you want to exercise
- Which data your request concerns
- A way for us to verify your identity (e.g. replying from the e-mail address you used with us)
We handle your request within one month of receipt. For complex requests we may extend this period by a maximum of two months. We will inform you of this within the first month.
Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
10. Lodging a complaint with the supervisory authority
You have the right to lodge a complaint with the Belgian Data Protection Authority:
- Data Protection Authority (GBA/APD)
- Drukpersstraat 35, 1000 Brussels
- Tel: +32 2 274 48 00
- contact@apd-gba.be
- dataprotectionauthority.be
We recommend contacting us first (privacy@taxibuddy.be) so we can address any concerns directly, but you are of course not obliged to do so.
11. Applicable law and competent court
This privacy notice and all processing we describe in it are governed by Belgian law, supplemented by the directly applicable European General Data Protection Regulation (GDPR).
For disputes that cannot be resolved by mutual agreement or through the Data Protection Authority, the courts of the judicial district of Antwerp, Mechelen division have jurisdiction. This does not affect your right as a data subject to bring proceedings before the courts of the Member State where you habitually reside (Art. 79(2) GDPR).
12. Changes to this notice
When we change this privacy notice, we update the version number and the date at the top of this page; the current version is always on this page. If you are a TaxiBuddy customer, we inform the contact person registered with us by email about significant changes that affect the customer relationship (section 3e), such as new processing purposes or new categories of recipients.