[Whitepaper] What is GDPR? Know all about the General Data Protection Regulation.

The contacts database is one of the most important assets held by a hotel. Because in all reality, self-made contacts are not that easy to make with the large number of hotel intermediaries. And when you do make them, you try to look after them with great care using different online strategies like email marketing, for example, to boost direct bookings.

But now, the goal of getting new contacts to feed our CRM and make them loyal seems a bit threatened by the new data protection regulation that went into effect last May.

So, do you know what GDPR is all about and if it applies to your hotel?

The GDPR (General Data Protection Regulation), which entered into force last May, is a regulation that aims to strengthen and unify the data protection of EU citizens through a set of rules that are applicable as of 25 May 2018.

This regulation has brought a large number of changes with it meaning the hotel sector, which manages a large quantity of their customers’ personal data, must be up-to-date on all the new developments involved with this new regulation.

And does it apply to your hotel? Yes, whenever you market your products to EU citizens, work with their data and/or analyse them even if your business is not located in the European Union.

This new regulation is based on many of the principles of the Data Protection Directive (DPD) of 1995, which it replaces with new provisions to reinforce citizens’ and harsher penalties for those who commit violations.

The truth is, as a sector, the hotel industry is one of the most vulnerable when it comes to security. And that is because there’s a large quantity of personal data being processed in booking systems and CRMs meaning hotels are an easy target for many cyberattacks.

Thus, the GDPR aims to improve the protection of personal data for EU citizens by increasing the obligations on companies that compile or process these data.

Now, what are the most important changes and obligations?

With regard to data collection

• The transparency. With the GDPR, any company that is going to compile contact data through web forms must clearly communicate what these data will be used for while users, after being informed, must grant clear consent to said use and have the option of withdrawing any such consent.
• Data minimization. This data protection regulation only allows the compilation of information that is adequate, relevant and limited to the purpose at which the data collection is aimed. Requesting unnecessary or excessive data is a violation.

Data storage and processing

• Purpose and limitation of use. Personal data may only be used for the purpose for which they were collected – a specific, explicit and legitimate purpose that has been consented to by the contact.
• Technical and organizational security measures. In other words, with the GDPR, the company must ensure the data are stored securely and even encrypted to protect them from unauthorized processing, loss, dissemination or alteration. And only the authorized parties may control the data.
• Under the GDPR, companies must consider the impact of the use of personal data by their contacts meaning they must ensure not only they comply with the obligations under the new regulation but can also prove they do.
• Updates and corrections. Contacts may ask that their data be updated or corrected if the information is not accurate.
• Data storage. Companies may only keep their contacts’ personal data for the time necessary as per the purpose for which they were collected. In other words, they may not continue to store data from users who have no further ties to the company and have not granted their consent.
• Data deletion. Pursuant to GDPR, a company must comply with any requests from users to delete their data and confirm such deletion.

As can be seen, there is a whole series of important changes for hotels because one thing is for sure – the GDPR leaves no European Union company indifferent.

Is your hotel ready for the new Data Protection Regulation?

How do we do this at Hotelinking?

We’re prepared and guarantee compliance with GDPR.

You can download our whitepaper here explaining what we do in detail:

• GDPR and Hotelinking.