Effective date: 2026-02-20
When the Waitlistize booking system (the Service) is used, Waitlistize acts as a data processor for the personal data of your customers (bookers). The business or organisation using the Service acts as the data controller in every case.
Data processor:
The company operating the Service
Klick Team Kft.
1045 Budapest, Széchenyi tér 10.
01 09 423745
27059021241
hello@waitlistize.com
Waitlistize processes personal data only on the documented instructions of the controller, including settings and actions made through the Service interface. Waitlistize does not determine the purposes or essential means of processing, does not make substantive decisions about your customers' data, and does not use such data for its own marketing purposes. Processing supports in particular:
https://www.googleapis.com/auth/calendar.events
scope to create, update, and delete booking-related calendar
events, and to keep availability synchronized between our system
and Google Calendar. OAuth is not used for “Sign in with
Google”; it is used exclusively for calendar integration and
scheduling sync.
Processing covers user account data and the booking, waitlist,
consent and related technical data detailed below. User account
data stored in the users table:
| Field | Content | Purpose of processing |
|---|---|---|
| id | Technical identifier | User identification |
| name | Full name (optional) | User and admin identification; supporting billing and communication processes |
| Email address | Login, booking notifications | |
| email_verified_at | Verification timestamp | Security and authentication |
| password | Encrypted password | Account login |
| phone | Phone number (optional) | Contact, booking notifications |
| is_admin_global | Admin privilege flag | Managing admin permissions |
| remember_token | Token enabling automatic sign-in | Convenience feature, login session |
| created_at / updated_at | Creation and modification timestamps | Technical logging, security audit |
Booking and related data
| Data category | Content | Purpose of processing |
|---|---|---|
| Booker contact details |
customer_name, customer_email,
customer_phone: name, email address and phone number. The
controller’s account settings determine which fields are required.
|
Identifying and contacting the booker and managing the booking; these
data are also stored in the bookings table, including
bookings made without creating a user account.
|
| Appointment and service data | Booking, account, service and resource identifiers; occurrence identifier for group events; start and end in UTC, status, booking management token, language setting, creation and modification timestamps. | Linking the selected service and time to the booker, capacity management, booking management and notifications. |
| Waitlist |
For fully booked group events, the waitlist_entries table
stores name, email address (email), phone number
(phone), account, service, occurrence and resource
identifiers, desired start and end, status, public management token and
timestamps.
|
Recording waitlist registrations and managing related notifications. |
| Mandatory GDPR acceptance |
Acceptance of the privacy policy and terms of service
(gdpr). When a booking is created,
bookings.consent_at stores the acceptance timestamp and
consent_hash stores the SHA-256 hash of the marker
privacy:v1.
|
Recording acceptance. The hash is generated from the fixed marker, rather than the full policy text; section 4 addresses the legal basis of processing. |
| Optional ListaMester consent |
When a booking is created, if the integration allows consent collection
and separate subscription consent (listamester_consent)
given, booking_consents stores booking, account and service
identifiers, provider and purpose, consent text and its hash, timestamp,
language setting, IP address and up to 512 bytes of User-Agent data,
plus source and service type metadata.
|
Documenting the requested newsletter or marketing subscription and the associated consent. This acceptance is separate from mandatory GDPR acceptance. |
| Technical and security data | IP address, User-Agent, form load timestamp and hidden anti-bot fields. Anti-bot events log the IP address, a combined hash of the User-Agent and IP address, the route and event context; rate limiting also uses an email/IP-based hash. Self-service booking management audit records also contain the IP address and up to 255 bytes of User-Agent data. | Detecting and limiting automated abuse and excessive submissions; enabling review of booking management actions. |
| Notification data |
Notification data in notifications_outbox include name,
email address, booking or waitlist identifier, service and appointment
data and, where applicable, a management link; the system also stores
delivery status and timestamps.
|
Preparing and sending booking, waitlist and administrator notifications according to settings; generating calendar attachments when enabled. |
For ListaMester subscriptions, the system sends the name and email address, a phone number if the relevant field is configured and the data are available, and an available subscription page link to the selected ListaMester group. The related delivery log also stores delivery identifiers, status, a hash of the sent data, attempt details and a response excerpt.
WordPress integration: booking and consent data submitted through the WordPress plugin are forwarded to Waitlistize. The WordPress server also passes the visitor’s IP address and User-Agent data. The Waitlistize WordPress endpoint uses the same backend booking processes as its own public booking interface: bookings or waitlist registrations, consents and notifications are processed as described above. The business or organisation using the Service remains the controller and Waitlistize remains the processor.
The Service does not process special categories of personal data.
The legal basis for processing is determined and communicated to data subjects by the business or organisation acting as controller. Waitlistize, as processor, does not determine the legal basis under Article 6 GDPR; it provides the technical operation of the Service and carries out the controller's instructions.
Third parties engaged by Waitlistize for the technical operation of the Service
(e.g. hosting, email).
These sub-processors act only under documented agreements, in compliance
with GDPR, and only to the extent necessary to perform controller instructions.
Access to personal data is restricted to:
Access is role- and account-based within the Service.
Waitlistize, as processor, protects personal data through multiple layers:
According to information published by DiMa.hu, the servers are located in the modern and secure Dataplex data centre (DiMa.hu – Our servers). Dataplex is a reinforced, protected facility designed to safeguard security-sensitive equipment. Its multi-layer security system is supported by 24/7 security personnel, closed-circuit television inside and outside the building, vibration, door-opening and motion sensors, and alarm systems.
Based on DiMa.hu's published information, the service levels (SLA) for the infrastructure meet the strictest industry standards: power supply and climate control are provided with 99.999% annual availability. Continuous service is supported by uninterruptible power supply, and diesel generators can be started within 3 minutes when needed. The temperature is maintained at 22 °C (+/- 2 °C), and relative humidity at 50% (+/- 10%). Fire detection and nitrogen-based gas fire suppression are available throughout the building, avoiding damage to both the environment and the servers located there.
The data subject has the right to:
Data subject requests should primarily be submitted to the business or organisation acting as controller. Waitlistize assists the controller, as processor, in fulfilling such requests.
In case of complaints, the data subject may contact:
Nemzeti Adatvédelmi és Információszabadság Hatóság
(NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Web: www.naih.hu
Waitlistize reserves the right to modify this Privacy Policy.
Changes take effect upon publication within the Service.