Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
GBooking is an online appointment and reservation platform that embeds a booking widget on websites. It sets cookies to run bookings and can add analytics, and because it is operated from Russia it raises significant international data transfer concerns under the GDPR alongside the usual consent duties.
GBooking is an online booking and appointment scheduling platform used by service businesses such as salons, clinics, and studios to let customers reserve a slot directly from a website. The embedded widget shows availability, captures the booking, and stores the customer details needed to manage the appointment.
GBooking sets functional cookies to keep the booking session and may add analytics cookies that measure how the widget is used. It processes the personal data a customer enters to make a reservation, such as name, contact details, and the service requested, which is personal data under the GDPR.
The functional booking cookies can be exempt under Article 5(3) ePrivacy, while analytics cookies require consent. The more serious issue is location: GBooking is operated from Russia, which has no EU adequacy decision, so personal data is transferred to a higher risk third country and needs Standard Contractual Clauses, a thorough transfer impact assessment, and careful justification.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Load only the strictly necessary booking cookies by default and gate analytics behind consent. Because the transfer to Russia is sensitive, inform customers clearly before they book that their data will be processed there, and consider whether the booking can rely on contractual necessity or needs explicit consent for the transfer.
Map the data sent to GBooking, put Standard Contractual Clauses in place, and complete a documented transfer impact assessment that weighs the Russian legal context. Disclose the transfer prominently, minimise the data shared, set short retention, and evaluate EU based booking alternatives where the transfer risk is unacceptable.
Websites using GBooking must obtain user consent under GDPR regulations.
DPIA considerations
Because GBooking transfers personal data to Russia, a country without an adequacy decision and with elevated government access risk, a transfer impact assessment is essential and a DPIA is strongly recommended. Document the necessity, the data minimised, and the safeguards, and reconsider the tool if residual risk stays high.
Sample consent text
We use GBooking to manage your online bookings. Your booking data is processed by GBooking, including in Russia, and analytics cookies are only used if you accept them.
Third-party domains contacted
gbooking.ruwidget.gbooking.ruCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gb_session | Functional | Session | Maintains the booking session while an appointment is reserved |
| gb_widget | Functional | 30 days | Remembers booking widget preferences such as the selected location |
| gb_analytics | Analytics | 1 year | Measures how visitors use the booking widget |
GBooking uses cookies for user preferences — inform visitors with a consent banner.
GBooking sets functional cookies to keep the booking session and remember widget preferences, and may add analytics cookies. Only the booking cookies are strictly necessary; the analytics cookies need consent.
The functional booking cookies can rely on the ePrivacy exemption, but analytics cookies require prior consent. Given the transfer to Russia, you should also inform customers clearly before they submit booking data.
The booking itself relies on performance of a contract under Article 6(1)(b), while non essential cookies rely on consent under Article 6(1)(a) and Article 5(3) ePrivacy. The international transfer needs its own safeguard.
Yes. GBooking is operated from Russia, which has no EU adequacy decision and is treated as higher risk. You need Standard Contractual Clauses, a transfer impact assessment, and clear disclosure, and should minimise the data sent.
Yes, it is strongly recommended. The transfer to Russia raises elevated risk, so document a transfer impact assessment and a DPIA, and reconsider the tool if the residual risk cannot be reduced.
Block analytics cookies until consent, put Standard Contractual Clauses in place, complete a transfer impact assessment, disclose the Russia transfer prominently, minimise data, and set short retention. Evaluate EU alternatives if the risk is too high.
EU based booking and scheduling platforms keep data within the EEA and avoid the high risk transfer entirely, which is the cleanest way to reduce exposure for appointment data.
List the GBooking functional and analytics cookies with their purpose and duration, state that booking data is transferred to Russia, and name the safeguard relied upon. Keep the entry current and review the transfer regularly.