Every booking means a passport or ID scan — snapped on a phone, uploaded to Airbnb or Booking, forwarded to cleaners and owners over WhatsApp, and kept forever. It feels routine. Under GDPR, guest ID documents are high-risk data, and that workflow is a breach waiting to happen.
The reality
None of this is malicious — it's just how a booking flows. But each one is a real GDPR gap a guest, a competitor or a former cleaner can report.
Guest passport and ID photos sit in the camera roll of your personal phone — in cloud photo backups, with no encryption, no access control and no deletion when the stay ends.
Full guest details and ID scans are forwarded to cleaners, co-hosts and owners on WhatsApp — far more than each one needs, copied onto every device, uncontrolled.
Airbnb and Booking guest lists get exported into Excel or Google Sheets — names, emails, phone numbers and stays sitting in an open file shared across the team.
Previous guests are added to newsletters and "come back" promotions with no valid consent and no opt-out — a classic complaint trigger, especially across borders.
Tourist/police-registration records and passport copies are held indefinitely, long past the legal retention period — data you must keep briefly, not forever.
Guest data flows to channel managers (Airbnb, Booking), your PMS and cleaning companies with no data-processing agreement and no idea where it's stored.
It only takes one. A lost phone full of guest passports, or a guest who asks "what data do you hold on me and why?" — either can turn into a complaint to the data protection authority. The fix is far cheaper than the incident.
The fix
We don't hand you a policy and leave. We change how guest data actually flows — from check-in to clean-up — with tools your team and guests will actually use.
A simple, encrypted check-in flow for guests to submit IDs — replacing phone photos and WhatsApp — capturing only what registration law actually requires.
Guest data encrypted and organised with proper access levels and audit logs: no more passports in a camera roll or open spreadsheets for everyone.
Defined rules for what cleaners, co-hosts and owners actually need — check-out time and access, not the passport — shared through a controlled channel.
A retention schedule matched to your local tourist/police-registration duty, with automated deletion of IDs and guest data once that period ends.
A clean, documented consent and opt-out for newsletters and "book again" offers — so you can market to past guests without triggering complaints.
Data-processing agreements and storage checks for your channel manager, PMS, cloud tools and cleaning company — so your whole supply chain is covered.
How we work
We follow a real booking end-to-end: where the passport, the guest list and the check-in details go, and on which device or tool.
We flag the non-compliant flows and the concrete risks — prioritised, in plain language, not a 90-page report.
We set up secure check-in, encryption, sharing rules, retention and the DPAs — and migrate you off phone photos and WhatsApp.
A short briefing for staff and cleaners, a breach plan and the records of processing — so it stays compliant day to day.
FAQ
The questions hosts and managers ask us most.
Tell us how you take in guest IDs and share them today. We'll show you the gaps and the fix — response within 4 working hours, no commitment.
EN
IT
ES