GDPR and guest data in restaurant bookings

Who is the controller and who the processor

The General Data Protection Regulation (GDPR) distinguishes the controller, who determines the purposes and means of processing personal data, from the processor, who processes personal data on the controller’s behalf (Article 4(7) and (8)). With bookings, the venue is the controller: it decides why it collects guest data and what it does with it. The reservation system is the processor, which stores the data, shows it to staff and sends guests messages on the venue’s instructions.

Their relationship is governed by a data processing agreement under Article 28 GDPR. It sets out the subject matter and duration of the processing, its nature and purpose, the type of data, the categories of people and the obligations of both sides. It must be in writing, which includes electronic form.

Which guest data a booking contains

According to Booklio’s data processing agreement, for guests and people requesting a booking this means name, email, phone number, date and party size, the booking note, the assigned table, visit history, staff notes and a no-show list entry, feedback and ratings, and consent to invitations. Payment data is held without card numbers, and only if the venue switches payments on.

What the venue is responsible for as controller

An overview of a controller’s main obligations under the GDPR. It’s general and doesn’t replace an assessment of your own venue.

• A legal basis. Every processing activity needs a legal basis under Article 6. One of them is processing necessary for the performance of a contract or for steps taken at the guest’s request before entering into one (Article 6(1)(b)). Which basis fits which data is for your venue to assess.
• Information for guests. When collecting data, the controller tells the guest who the controller is, why and on what legal basis the data is processed, who receives it, how long it’s kept and what rights the guest has (Article 13). This is usually done in the privacy policy on the venue’s website.
• Guests’ requests. Guests have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21). The controller responds without undue delay and at the latest within one month of receiving the request; in complex cases this can be extended by two further months (Article 12(3)).
• Only the data needed, only as long as needed. The principles of data minimisation and storage limitation (Article 5).
• Security and reliable processors. The controller ensures appropriate security (Article 32) and uses only processors that provide sufficient guarantees, with an agreement under Article 28.
• Reporting a data breach. The controller reports a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it’s unlikely to result in a risk to people’s rights and freedoms (Article 33). The supervisory authority is your country’s data protection authority; in the Czech Republic it’s the Office for Personal Data Protection (ÚOOÚ).
• Records of processing activities. The obligation to keep them (Article 30) doesn’t apply to an organisation with fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special categories of data. Bookings come in every day, so look at this exemption carefully.
• Invitations are marketing. Rules for marketing emails and texts differ by country. In the Czech Republic, section 7 of Act No. 480/2004 Coll. allows them with prior consent, or without it only to your own customer whose email you got in connection with a sale, for your own similar services, with an option to opt out in every message. The email must be clearly marked as marketing and must not hide the sender.

What Booklio does for the venue as processor

• The data processing agreement comes with sign-up. Booklio’s data processing agreement is part of the terms of service and is concluded when you sign up. Booklio processes data only on the venue’s instructions: the agreement, settings and actions in the admin, and emails from the account address.
• Data in the EU, each venue separately. Booklio runs on Cloudflare with its database in the EU, and every venue has its own database. Connections are encrypted, the admin is protected by sign-in and role-based permissions, and data is backed up regularly.
• Deleted on schedule. Names and contact details on a booking are erased 3 months after the booking date; the stats stay.
• One-tap erasure. Staff handle a guest’s GDPR erasure request in the guest database. Booklio helps with other guest requests on request.
• Breach notification. Booklio reports a breach to the venue without undue delay, within 48 hours at the latest, by email to the account address.
• Sub-processors are listed. Cloudflare (hosting, databases and backups in the EU), Resend (emails), BulkGate (text messages, if the venue switches them on), Anthropic (drafts by Claude, only when staff ask for one) and Stripe (guest payments, if the venue switches them on). Booklio announces any change to the list at least 30 days ahead.
• No cookies. Booklio’s traffic stats work without cookies and without storing IP addresses, so your site needs no consent banner for them.
• Invitations by the book. Marked as marketing, sent in your company’s name, with one-tap unsubscribe.
• Data when you leave. Within 30 days of the end of the contract you can ask for your data in a machine-readable format; after that it’s deleted, copies included.

What to check at your venue

1. The privacy policy on your website: does it cover bookings, the reservation system as processor and how long data is kept?
2. A data processing agreement with every supplier that processes guest data.
3. Who handles guests’ requests at your venue, and whom staff tell about a suspected data leak.
4. Invitations only to guests who consented or under the exception for your own customers, always with an unsubscribe option.
5. A paper reservation book doesn’t lie on the bar where anyone can read it. How to replace it is in A digital reservation book instead of a paper one.

Frequently asked questions