GDPR Compliance

On May 25, 2018 the General Data Protection Regulation (“GDPR”) went into effect in the European Union. The GDPR provides an updated set of data protections for EU residents world-wide. That means that any business that deals with user data for EU residents must comply with the regulations, even if the business itself is not based within any of the EU member nations.

GDPR In A Nutshell

The GDPR provides an update to the set of privacy regulations granted by the Data Protection Directive of 1995. To put that into perspective, Netscape Navigator had its initial release in December of 1994. The patent for the HTTP Cookie (US 5774670) wasn’t even filed until 1995.

You can find the full GDPR specification here. The important parts boil down to three items for hoteliers.

1. Don’t sell your guests’ data.

You should only be using this data throughout the lifespan of a reservation to confirm bookings, perform check-in/check-out, and process payments.

2. Data extraction.

Guests have the right to know what you have on file about them. In this case, booking history and basic profile data.

3. Right to be forgotten.

Guests can request that you anonymize/redact their data.

Updates to Help with GDPR Compliance

We have updated our platform to assist our users with GDPR compliance. Here’s how we can help with each of the above items.

1. Don’t sell your guests’ data.

It’s up to the hotelier to do the right thing with their guests’ data. Emails and other communications made throughout the lifespan of a booking, from reservation to check-out, fall within the scope of fair use. It’s after check-out that you should carefully consider how you use the data available to you.

In any case, we have made all our email notifications opt-in for the hotelier. Up until now, email notifications for booking confirmations, check-out, etc. would be sent automatically. We have updated our system to only send the notification types specified by the hotelier. Go to ‘Settings > Email Settings’ in the main menu to view set an email response for each message type.

2. Data Extraction

You can now export the profile and reservations data for any guest. Go to ‘Guests > Search by Name’ to find the guest profile. Select ‘Export Data’ in the ‘Actions’ menu to export all the profile and reservation data related to this guest.

3. Right to be forgotten.

Anonymizing guest data is as simple as deleting a guest’s profile. Select ‘Delete Guest’ from the ‘Actions’ menu. The profile will be permanently deleted from our platform, along with any notes and ID document.

Reservations and payments data will not be affected by deleting a guest profile. Any booking that included this guest will have a blank spot that reads, ‘Guest N’. You won’t lose any important reservation data when you delete a guest profile.

Any reservations under this guest’s name will remain unchanged. Previously, deleting a guest profile would update the reservation name for each reservation including this guest. Since guest registration is now optional, we have removed this automatic update to the booking name. In addition, the reservation name can now be edited. Just open any booking and click the name title at the top left to edit.

Summary

GDPR compliance is now even easier after this update. You can forward data on request, or delete any records that you need to delete, without affecting important reservation data. Email notifications are no longer automatic, but you can opt-in by setting a message for each response type.