Every guest hands you registration and ID data, and your booking flows through Booking, Airbnb, the PMS, the front desk and the CCTV. Most properties spread that guest data and those marketing lists across booking channels and staff with no access controls — convenient, and a textbook GDPR problem.
The reality
None of this is malicious — it's just how a busy property runs. But each one is a real GDPR gap a guest, a competitor or a disgruntled ex-employee can report.
Guest IDs and registration data get passed around the whole team and over WhatsApp — on personal phones, in chat backups, with no encryption, access control or deletion.
Past guests are added to newsletters and promotional broadcasts without a valid legal basis or a clear way to opt out — a classic complaint trigger.
Cameras film guests with no signage, no defined retention and no documented lawful basis — and footage anyone on shift can pull up.
Guest data is exported from Booking and Airbnb into uncontrolled Excel files and shared drives, far outside the platforms' own controls.
Everyone signs into the PMS and front desk with one shared login — no access levels, no audit trail of who saw which guest's data.
Police/tourist registration data and guest IDs are kept indefinitely, and there's no data-processing agreement with the OTAs or the PMS.
It only takes one. A lost laptop, a leaked OTA spreadsheet, a guest who asks "what data do you hold on me and why?" — any of these can turn into a complaint to the data protection authority. The fix is far cheaper than the incident.
The fix
We don't hand you a policy and leave. We change how guest data actually flows through your property, with tools your team will actually use.
Guest IDs and registration data handled in a secure system with proper access levels and audit logs — who can see what — replacing WhatsApp and shared inboxes.
A clean, documented consent and easy opt-out for guest newsletters and offers — so you can market to past guests lawfully and keep the proof.
A documented lawful basis, clear guest signage, a defined retention period and restricted access — your cameras brought fully in line.
A retention schedule aligned to your police/tourist registration duties and marketing lists — with deletion once the period ends, so you stop holding data you no longer need.
Data-processing agreements and storage checks for Booking, Airbnb, your PMS, Wi-Fi and CCTV vendors — so your supply chain is covered too.
A short, practical staff briefing and a simple breach procedure (including "I lost the laptop"), plus the records an authority will ask for.
How we work
We follow a real booking end-to-end: where the guest's ID, registration data and email go, across the OTA, PMS, front desk and CCTV.
We flag the non-compliant flows and the concrete risks — prioritised, in plain language, not a 90-page report.
We set up secure guest data handling, consent, CCTV controls, retention and the DPAs — and migrate you off WhatsApp and loose spreadsheets.
A short team briefing, a breach plan and the records of processing — so it stays compliant day to day.
FAQ
The questions hotels and B&Bs ask us most.
Tell us how you take in guest data and run your bookings today. We'll show you the gaps and the fix — response within 4 working hours, no commitment.
EN
IT
ES