Bookings and GDPR: your customers' data

Only ask for what you need

For a booking, a name, an email address and often a phone number are enough. A postal address or a date of birth should only be asked for if you really need it: an invoice, insurance, a minimum age. The less you ask for, the less you have to protect, and the faster people book.

Tell the customer

When they book, customers must be able to read who keeps their data, what for, for how long, and who it is passed on to, for example your payment provider. One line under the form, with a link to your privacy policy, is enough.

How long to keep them

• Paid bookings are accounting records: they are kept for as long as the law of your country requires.
• The contact details of a customer who hasn't booked for a long time no longer need to be kept.
• A sign-up on a waiting list no longer needs to be kept once the date has passed.

When a customer writes to you

A customer can ask for a copy of their data, or for it to be erased. You have one month to reply. Erasing doesn't mean deleting everything: a paid booking remains an accounting record. You remove what identifies the person, and you keep the date, the amount and the status of the booking.

Where the data is

A plugin that keeps bookings in your own WordPress database doesn't pass them on to anyone on its own initiative. An online booking platform, on the other hand, keeps your customers on its servers: it becomes your processor, and your contract with it must say so.