Privacy Policy

Last updated: 21 August 2026

This Privacy Policy explains how personal data is processed when ZekaBooking is used.

1. Controller

2. Roles in an appointment booking

ZekaBooking provides businesses with a technical platform for managing and booking appointments online. The business identified on the booking page is generally the controller for processing data in connection with a specific service and its performance.

Where ZekaBooking processes appointment and customer data on that business's instructions, it acts as processor on the basis of a Data Processing Agreement. We ourselves are controller for our own platform accounts, security, billing, support and operation of ZekaBooking.

3. Accessing the website and server logs

When our pages are accessed, technically necessary data is processed, in particular IP address, date and time, requested URL, referrer, browser and device information and HTTP status. This is necessary to deliver the website, detect errors and defend against attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and traceable operation of the platform. Log data is stored only for as long as required for operation, error analysis and security, unless longer retention is necessary because of a specific security incident.

4. Contact and support

When you submit a contact or support request, we process the contact details provided, the content of the message and technical information required to handle the request.

Depending on the reason, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual requests, or Article 6(1)(f) GDPR for general communication and support. Requests are deleted after processing is complete unless statutory retention obligations or legitimate evidentiary interests require otherwise.

5. User accounts, login and verification

For user accounts we process in particular email address, password hash, names, verification status, roles, login and security information and, where applicable, telephone number and profile data. Passwords are not stored in plain text.

Processing is necessary for registration, login, account security and provision of the booked functions. The legal basis is Article 6(1)(b) GDPR; security logs may additionally be based on Article 6(1)(f) GDPR.

6. Optional Google login for end customers

If Google login is enabled and selected by you, we receive from Google the account data released for login, in particular a unique provider identifier, email address and, where applicable, name or profile image. Google receives information about the login process.

The provider is Google Ireland Limited, Dublin, Ireland. Processing is carried out to perform the login chosen by you on the basis of Article 6(1)(b) GDPR. Further information can be found in Google's Privacy Policy.

7. Business-customer registration and contract administration

When a business is registered, we process in particular email address, first and last name, company name, public name, industry, booking link, telephone number, business address, selected package, consent and contract evidence, and information for invoices and contract administration.

Processing serves to initiate, set up and perform the ZekaBooking agreement, including trial period, billing, invoices, support and termination. The legal basis is Article 6(1)(b) GDPR. Documents relevant under commercial and tax law are stored for the statutory retention periods.

Where both the stored monthly price and stored setup fee are 0.00, we do not require or process bank or card details as a payment method for settling the ZekaBooking usage fee. Invoice and business information may nevertheless be required for contract evidence, invoicing and statutory retention obligations. If paid use is expressly agreed in the future, we process payment data only to the extent required for the selected payment method.

8. Public booking pages and appointments

When an appointment is booked, data including name, email address, telephone number, selected service, employee, appointment time, booking status and an optional note may be processed. Booking and security identifiers are also used for administration, changes or cancellation.

Depending on the settings of the respective business, booking can take place through a registered end-customer account or as a guest without a customer account. No user account is created for a guest booking. The personal management link serves as a security identifier for access to the individual appointment and is sent to the email address provided.

The respective business decides on the purpose and scope of processing in connection with its service. ZekaBooking processes these data on behalf of the business for the technical provision of the booking. Questions about treatment, service or the business's retention practices should therefore primarily be directed to the business named on the booking page.

9. Email delivery

ZekaBooking sends verification, security, appointment, reminder, cancellation, contract and invoice emails, among others. In doing so, the recipient address, message type, sending time and technical delivery status are processed. Content and recipients depend on the respective process.

The legal basis is Article 6(1)(b) GDPR insofar as sending is necessary for an account, appointment or contract, and Article 6(1)(f) GDPR for security and delivery evidence. Voluntary email advertising is sent only on a separate legal basis.

10. Cookies and consent management

Necessary cookies and comparable storage are used in particular for sessions, login, CSRF protection, security and storing your cookie selection. Optional services are loaded only if you have consented to the relevant category in the cookie dialog.

The legal basis for access to information on the end device is governed by Section 25 TDDDG. Where personal data is processed in the process, the legal bases under the GDPR also apply. Details are set out in the Cookie Information.

11. Google Analytics 4

Google Analytics 4 may be used on selected public pages. The provider is Google Ireland Limited, Dublin, Ireland. Google Analytics helps us understand how these pages are used.

The service is loaded only if you have consented to the “Analytics & statistics” category. This may involve processing page views, approximate location information, browser and device information, session data and interactions. We do not transmit names, email addresses, telephone numbers, booking numbers or appointment notes as analytics event parameters.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings. Further information can be found in Google's Privacy Policy.

12. Meta Pixel

The Meta Pixel may be used on the home page, pricing page and business-customer registration. The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Dublin, Ireland.

The Meta Pixel is loaded only if you have consented to the “Marketing” category. It is used to measure advertising campaigns and may in particular record a page view and a business-customer registration completed after successful server-side processing.

Data processed may in particular include URL, time, browser and device information, IP address, pixel ID, campaign identifiers and Meta cookies such as _fbp or _fbc. We do not transmit the contents of registration fields, email address, telephone number or business address as pixel event parameters.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw consent at any time via the cookie settings. Further information can be found in Meta's Privacy Policy and Meta's Cookie Policy.

13. Recipients and processors

Data is received only by parties that require it for the stated purposes. These may include hosting and infrastructure providers, email service providers, IT support, tax and legal advisers and legally authorised public authorities. Where required, service providers are contractually engaged as processors.

For Google or Meta, processing outside the European Union or European Economic Area cannot be completely ruled out. It is carried out in accordance with the data-protection safeguards provided by the respective provider. The services are activated on ZekaBooking only after your consent.

14. Storage duration

We store personal data only for as long as required for the respective purpose. Relevant factors include the duration of an account or agreement, handling of a request, the lifecycle of an appointment, security and evidentiary interests and statutory retention obligations. Afterwards, data is deleted or, where possible, anonymised.

15. Your rights

Subject to the statutory requirements, you have in particular the right to:

• access your personal data,
• rectification of inaccurate data,
• erasure or restriction of processing,
• data portability,
• object to processing based on legitimate interests,
• withdraw consent with effect for the future.

To exercise your rights, you can contact info@zekabooking.com. For data for which the respective business is controller, we may refer your request to that business or assist it within the scope of processing on behalf.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. The authority generally responsible for our registered office is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

17. Changes to this Privacy Policy

We update this Privacy Policy when functions, data processing or legal requirements change. The current version is available at /datenschutz.