General terms and conditions of subscription.

1What we provide

Convivos is software accessible online, sold in modules. Depending on the module or modules subscribed to, it comprises:

1. a public booking module, embedded in your website, where your guests or your travellers book in a few moments, without creating an account;
2. a private booking book — day view, overnight-stay schedule, manual entry, statuses, guest search, closures and exceptional capacity;
3. the automatic sending of confirmations, of reminders and of the notification of each new booking;
4. the export of your bookings and your guest records, at any time, in CSV format. The book export covers the last ninety days and everything still to come; the guest records are exported in full.

The Table module works in covers and service slots; the Stay module works in units and overnight stays, and handles the municipal tourist tax. The service is provided in French, Dutch, English and German on every public-facing surface.

What the service does not do, and what must not be expected of it:

• no drag-and-drop floor plan editor and no automatic table allocation: the floor plan exists, you seat your guests on it by hand, and it never decides availability — availability remains counted in covers;
• no waiting list and no automatic call-back on cancellations;
• no payment collection, no deposit and no card pre-authorisation from the guest or the traveller: payment is made on your premises;
• for the table, no synchronisation with the platforms (TheFork and the like): there, Convivos manages your direct booking and knows nothing of bookings taken elsewhere. For the overnight stay, your calendars synchronise over iCal, in both directions, with the platforms that publish it (Booking, Airbnb, Vrbo) — with no booking interface and no rates pushed;
• no point-of-sale integration and no integration with third-party management software.

1.1The substantive undertaking

We undertake one thing, and we undertake it firmly: the service never confirms a booking that would exceed the capacity you have set. The availability calculation is serialised at database level; it does not rest on a mere application-side check.

2Formation of the contract

The contract is formed when you submit the registration form by ticking the box accepting these terms. That acceptance is time-stamped and retained, together with the version number of the terms accepted.

You declare that you are acting in the course of your professional activity and that you have the authority to bind the business you designate.

3Trial period

The subscription begins with a free trial of fourteen days of actual use. You first have seven days to set up your establishment — opening hours, capacity, the link placed on your site — without using up your trial: the fourteen days run from your first recorded booking. If nothing has been recorded within that window, the trial ends at the latest twenty-one days after the module concerned was opened.

No means of payment is required to open the trial. No automatic roll-over into a paid subscription takes place at its end: if you do not subscribe, access to the book is suspended and your data remains available for export for the period provided for in § 12.

4Your obligations

You are responsible for:

• the accuracy of the settings of your establishment — opening hours, capacity, maximum party size, occupancy duration, units and rates. The service applies what you have set; it does not guess your closing days;
• the confidentiality of the access credentials of your team, and the withdrawal of the credentials of anyone who leaves the establishment;
• the performance of your obligations towards your guests and your travellers: information on the processing of their data, honouring accepted bookings, cancellation conditions, obligations as to allergens, price display and tourist tax;
• the lawfulness of the content you entrust to us — trade name, logo, link to your privacy policy.

You undertake not to attempt to circumvent the technical limits of the service, not to extract its data on a mass scale by automated means, and not to resell it under your own brand without written agreement.

5Prices

The prices in force are those displayed on the pricing page on the day of subscription. They are stated excluding VAT, in euros.

5.1Price changes

We may change our prices. In that case:

1. you are notified in writing at least two months before the effective date;
2. the new price list applies only to periods after that date;
3. you may terminate free of charge and without notice up to the effective date, and the subscription then ends on that date.

6Invoicing and payment

Invoices are issued monthly in arrears, in the form of a structured electronic invoice transmitted over the Peppol network, in accordance with the obligation applicable since 1 January 2026 to transactions between taxable persons established in Belgium. You provide us for that purpose with the data required to identify you on that network.

Payment is made within thirty days of the invoice date.

In the event of late payment, and after a formal notice to pay has remained without effect for fifteen days, interest is due as of right at the rate provided for by the Act of 2 August 2002 on combating late payment in commercial transactions, together with fixed recovery compensation of €40. The service may be suspended only after that formal notice, and never on a Friday, a Saturday, or the eve of a public holiday — we do not switch off a book just as a service is about to begin.

7Term and termination

The contract is entered into for an indefinite term. There is neither any minimum commitment, nor any tacit renewal for a fixed period.

• You may terminate at any time, without reason and without compensation, from your account area or by simple e-mail. Termination takes effect at the end of the current calendar month. Sums already due for elapsed periods remain payable; no exit charge is due.
• We may terminate on three months’ written notice, save in the event of serious breach on your part.
• Termination for breach: in the event of a serious breach persisting more than fifteen days after a written formal notice, either party may terminate as of right.

8Availability, maintenance and backups

We aim for availability of 99.5% per month, excluding scheduled maintenance.

Scheduled maintenance is announced at least 48 hours in advance and carried out, save in the event of a security emergency, between 3 a.m. and 6 a.m.

The databases are backed up every fifteen minutes, encrypted, and replicated away from the main server, within the European Union. The maximum data-loss window targeted is fifteen minutes.

If monthly availability falls below 99.5%, you may request, within thirty days, a credit note proportionate to the duration of the unavailability, capped at one month’s subscription.

9Liability

We are bound by a reinforced best-efforts obligation as regards the operation of the service.

Our contractual and extra-contractual liability, on all grounds combined and per twelve-month period, is capped at the amount excluding VAT actually invoiced during the twelve months preceding the triggering event.

This cap does not apply in the event of wilful misconduct, of gross negligence, of harm to physical integrity, nor in the cases where the law prohibits it.

The limitations and exemptions provided for in this article also benefit our auxiliaries, managers and subcontractors, within the same limits — a clause stipulated having regard to Book 6 of the Civil Code, which entered into force on 1 January 2025.

We are not liable for:

• the consequences of an incorrect setting of your opening hours, your capacity, your units or your rates;
• bookings taken on a third-party platform and not carried over into your schedule;
• the unavailability of your own website or of your Internet access;
• failures of a third-party e-mail or telecommunications provider;
• the use you make of your guests’ and your travellers’ data;
• the bookings you choose to accept or to refuse.

10Data protection — data processing agreement

This article constitutes a data processing agreement within the meaning of Article 28 of the GDPR. There is no appendix: everything is here, and you accept it at the same time as the remainder of these terms.

For the data of your guests and of your travellers, you are the controller and we are the processor. For the data of your own account — sign-in, billing, technical logs — it is we who are the controller; the detail is set out in the legal notice.

If you submit your own data processing agreement to us and we sign it, that agreement applies and prevails over this article.

10.1What we process for you

Your obligations and your rights. You determine the purposes and the means of the processing. You inform the data subjects at the time you collect their data, you hold a legal basis, and you answer their requests — we assist you in doing so (§ 10.6). You may at any time give us written instructions and verify that they are carried out (§ 10.9).

10.2We act only on your instructions

We process that data only on your documented instructions, and never on our own account. These terms and the configuration you choose within the service constitute documented instructions.

No data is transferred outside the European Union. Should that change, we would inform you in advance and would proceed only under a valid transfer framework.

If a legal obligation required of us a processing operation that you have not requested, we would inform you before carrying it out, unless that same law prohibits it on important grounds of public interest.

If one of your instructions appears to us to infringe the GDPR or another data protection rule, we inform you of it immediately.

10.3The retention period, which is your instruction

You set, from your Settings, the retention period for inactive records; it is applied automatically. You may set it between one and one hundred and twenty months. It is for you to set it in accordance with the storage limitation principle.

Failing any choice on your part, it is thirty-six months of inactivity. If you clear that field, the automatic purge is disabled and the records are retained until manual anonymisation or the end of the contract: that is then your instruction, and you assume responsibility for its compliance.

10.4Confidentiality, and who on our side has access to your data

Only those persons on our side who need it in order to operate the service and to provide you with assistance have access to your data. They are bound to confidentiality in writing, and that undertaking survives the end of their duties.

Any assistance operation on your book is reserved to explicitly authorised operators, requires a written reason recorded before it is opened, is limited to twenty minutes, is traced in a log — including where an action is refused — and allows neither your password nor your sign-in address to be known or changed.

10.5Security

We implement the technical and organisational measures required by Article 32 of the GDPR, at least:

1. traffic between the persons using the service and our servers is encrypted (TLS); internal exchanges between our components and the databases do not leave the private network of the server, which is not exposed to the Internet;
2. partitioning by establishment: every read and every write is filtered by establishment within the application, the identifier coming from the session and never from the requested address; integrity constraints in the database further prevent a record from being attached to the wrong establishment;
3. passwords are never stored in the clear: only a scrypt hash is recorded, together with a random salt drawn on each recording, and therefore distinct for each user; verification is carried out by constant-time comparison;
4. sessions expire automatically — at the latest thirty days after they are opened, and after eight hours without activity; anyone may end their session at any time, and all the sessions of an account are destroyed upon a password reset or the deletion of the account;
5. the backups are encrypted to a key whose private part is not kept permanently on the server, and deposited every fifteen minutes with a provider distinct from the host, within the European Union;
6. hardened server: firewall, key-based access, unprivileged containers, rotated and capped logs, which contain neither request bodies, nor headers, nor cancellation links.

A documented restore procedure is in place, and we test it at least once per quarter, on each of the databases, from a decrypted off-site archive. § 8 describes the availability of the service; it does not replace this point, which concerns data protection. We may develop these measures, provided that the level of protection remains at least equivalent.

10.6Assistance with the rights of data subjects

We assist you, by appropriate technical and organisational measures, in responding to requests for access, rectification, erasure, restriction, objection and portability.

In practice: you export your data at any time from your book, and you anonymise a person directly from your book. Anonymisation erases the identifying data — surname, first name, telephone, e-mail address, free-text notes — without deleting the record, including in the message sending queue; the booking or the stay subsists in anonymous form, which preserves the consistency of your book and of your statistics. It therefore satisfies an erasure request immediately.

For what the service does not do on its own, we reply to you within five working days. A request that reaches us in error is forwarded to you without our answering it ourselves: the point of contact for the data subject is you.

10.7Data breaches, impact assessments

We assist you in complying with Articles 32 to 36 of the GDPR:

1. we notify you of any breach of data concerning your processing without undue delay after becoming aware of it, and at the latest within forty-eight hours, with the information available to us: the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences, the measures taken. It is you who notify the Data Protection Authority and, where applicable, the data subjects;
2. we provide you, on request, with the elements necessary for a data protection impact assessment (Article 35) and for a prior consultation of the authority (Article 36), within the limits of the information available to us;
3. we keep the record of categories of processing carried out on your behalf (Article 30(2)) and provide it to you on request.

10.8Sub-processors

You give us general authorisation to engage sub-processors. The up-to-date list, with their role and their location, is set out in the legal notice; they are all established in the European Union and process your data only within the Union.

We inform you of any addition or replacement at least thirty days in advance. You may object to it on legitimate and reasonable grounds within that period. Failing agreement, you may terminate without compensation with effect from the date of the change, and § 12 applies.

We impose on each sub-processor, by contract, obligations equivalent to those of this article, and we remain fully liable to you for their performance.

10.9Proof of compliance with this article, and audits

We make available to you, on written request, the information necessary to demonstrate compliance with the obligations of this article.

You may have an audit carried out, by yourself or by an auditor you appoint who is not one of our competitors: once a year at most, with written notice of thirty days, on documents first — questionnaire, register, log of the restores tested — and by on-site inspection only if the documents do not suffice. The audit takes place during business hours, without disrupting the service, and subject to confidentiality. The costs are borne by you, unless it reveals a failure on our part. An additional audit is possible following a data breach or at the request of a supervisory authority.

10.10End of the contract

The fate of your data at the end of the contract is governed by § 12. This article remains applicable for as long as we hold data on your behalf.

11Portability and change of provider

In accordance with Regulation (EU) 2023/2854 (the ‘Data Act’), applicable to data processing services since 12 September 2025:

• you may change provider or retrieve your data at any time, without contractual or technical obstacle;
• your bookings and your guest records are exportable at any time for the duration of the contract, in CSV format, from the book, without any intervention on our part and without prior request. Once the contract or the trial has ended, the book is closed and retrieval is made on written request, under the conditions of § 12;
• we assist you during a transition period of up to thirty days, extendable at your request within the limits of the Regulation;
• no exit, migration or retrieval charge is invoiced.

12The fate of the data at the end of the contract

Export your data before terminating: exports are available from your book, self-service, for as long as your subscription is active.

At the end of the contract, you tell us what you want: that we hand over to you a complete copy of your data, or that we delete it. Failing any indication on your part within thirty days, we delete it. During that period, a copy is provided to you on simple written request, free of charge.

The deletion is permanent: it covers our active systems, and then the encrypted backups at the end of their rotation cycle, which does not exceed thirty days.

Beyond that, we retain only our own accounting and contractual documents — subscription invoices, proof of the acceptance of these terms. They concern you as a client and contain no data of your guests or of your travellers. Their retention period is the one imposed by Belgian accounting and tax law.

13Amendment of these terms

Any substantial amendment is notified to you in writing at least two months before it enters into force. You may terminate free of charge up to that date. Failing termination, the new terms apply to subsequent periods.

Successive versions are retained and provided on request.

14Miscellaneous

Force majeure

Neither party is liable for a failure caused by an event beyond its reasonable control. If the impediment lasts more than thirty days, either party may terminate without compensation.

Use of service providers, and assignment

We may entrust the hosting and the delivery of messages to service providers; we remain responsible for them towards you. The engagement of sub-processors within the meaning of Article 28 of the GDPR is governed by § 10.8. The contract may not be assigned without the written agreement of the other party, save in the event of a universal transfer of assets and liabilities.

Commercial reference

We cite your name as a reference only with your prior written agreement, which is revocable at any time.

Partial invalidity

If a clause is held void, in particular pursuant to Articles VI.91/4 or VI.91/5 of the Code of Economic Law, it is deemed unwritten and the remaining clauses continue to apply.

Entire agreement

These terms and the price list in force constitute the entire agreement between the parties. If the parties have signed a separate data processing agreement, it forms part of that agreement and prevails over § 10.

15Governing law and jurisdiction

The contract is governed by Belgian law.

The parties shall endeavour to settle any dispute amicably. Failing agreement within thirty days of a written complaint, the courts and tribunals of the judicial district in which the publisher’s registered office is situated — stated at the head of these terms and in the legal notice — shall have exclusive jurisdiction.