The General Data Protection Regulation (GDPR) has applied since 25 May 2018. This article explains who is responsible for your guests’ personal data, what FrontDesk Master does to protect it, what to do if a security incident occurs, and which tools in FrontDesk Master help you comply.
1. Who is responsible for what?
Your property is the Data Controller. You decide which guest data you collect, why you collect it, how long you keep it, and who on your team can access it.
FrontDesk Master is the Data Processor. We store and process guest data on your behalf and only according to your instructions, to provide the FrontDesk Master service. You can read more in our Privacy Policy.
2. Your responsibilities as a Controller
When accepting bookings, you have a lawful reason to collect guests’ personal data. You should still make sure that each guest is informed about:
- What data you collect
- How long you store it
- How you use it and why
For instance, you may need to inform guests that you are legally obliged to store certain data for a number of years after check-out, or request their consent to use their data for marketing purposes.
As a Controller, you are also responsible for:
- Responding to guests who ask to see, correct or delete their data
- Deciding how long guest data is kept, and anonymising or deleting it when it is no longer needed
- Limiting access to guest data, including credit card details, to staff who need it
- Keeping your own FrontDesk Master logins secure
- Deciding on reporting and guest notifications if a personal data breach occurs (see section 4)
3. What FrontDesk Master does as a Processor
- Processes guest data only to provide the FrontDesk Master service, on your instructions
- Applies technical and organisational security measures to protect the data
- Automatically deletes credit card details received from OTAs and the Booking Engine 2 weeks after check-out (details)
- Requires two-factor authentication (2FA) to view credit card details
- Provides tools to help you meet your obligations (see section 5)
- Informs you without undue delay if we become aware of a personal data breach affecting your data, and supports you with the information you need
4. If a security incident occurs
What we do: we inform you, share the facts we have verified, take steps to contain the incident, and support your decisions.
What you decide as the Controller:
- Reporting to your data protection authority. Under GDPR, Controllers generally must report a personal data breach to their supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms. Please check with your legal adviser or your local authority whether this applies to you.
- Notifying your guests. If a breach is likely to result in a high risk to guests, they may need to be informed. You can send the notice yourself, or authorise FrontDesk Master in writing to send it on your behalf by emailing security@frontdeskmaster.com.
- Booking.com guests. To allow us to email guests who booked through Booking.com, please follow these authorisation steps.
We will not contact your guests without your authorisation.
5. Tools in FrontDesk Master that help you comply
- Printouts made automatically per each guest may help you collect the necessary consent in a traditional way. See how here.
- Collect Consent during Booking Engine reservations. Guests accept your Terms of Stay and can give explicit marketing consent.
- Online Guest Account can be accessed by any guest whose data is in the system. Guests can see what data you store, manage the consent they gave or even delete their profile (if you allow it). You can find Online Check-in settings in Property Details.
- Credit card access permissions let you choose which staff roles can see card details. See how to set up credit card details access permission.
- Blacklist. If you use a blacklist, make sure guests are informed. See how to use a blacklist in accordance with GDPR.
- Anonymization of guest details (see below).
Anonymize guest details
FrontDesk Master will let you anonymize guest details automatically some time after the check-out. It means that personal details will be turned into dummy details allowing you to maintain the statistics and comply with GDPR.
You will find the anonymization settings in the Property Settings / General / Data Protection Settings.
Click on Enable anonymization button to activate the feature.
A new window will appear where you can confirm enabling anonymization and decide what information should be removed and when.
1. Enter your username and password which you use to log in to FrontDesk Master in order to confirm the action.
2. Decide how many days after check-out the data should be anonymized, for example, 30 days.
3. Select what information should be anonymized.
4. Confirm the action for FrontDesk Master.
5. Click on Enable button.
After that, on the right side of the screen, you will see the Consent Log which shows when and by whom the anonymization has been enabled.
In order to change the anonymization settings, it is necessary to disable current ones. To do that, click on Disable Anonymization button. In the new window, enter your login details in order to confirm disabling the setting.
Next, you can enable it again by changing the settings you need.
Important!
At FrontDesk Master, we believe that anonymization may be one of the best ways for you to deal with your past reservation data, but remember it is your responsibility as a Controller to take actions and determine what to do with the data you collect in order to comply with GDPR.
Please note that for legal and ethical reasons, we can’t provide legal advice regarding another company’s compliance requirements under the GDPR. Because every business is different and the GDPR takes a risk-based approach to data protection, we also can’t interpret the legislation for our customers or advise how to apply its requirements to your business practices, or your current database. If you have any doubts or questions, please consult a lawyer.
Check also:
Terms & Conditions and Policies in Booking Engine
How long FDM stores credit card details?
How to authorize FrontDesk Master to email your guests through Booking.com