Data for the booking
For the booking itself you may use the data you need: a name, an email address for the confirmation and a phone number. No separate consent is needed for that.
Consent for marketing
Want to send guests your monthly menu or a newsletter? You need consent for that, with a separate tick box that isn’t ticked in advance. Keep a record of when and how the guest consented, and put an unsubscribe link in every email.
Allergies and dietary needs
An allergy is health data. Only use it for the visit and let guests fill it in themselves.
Don’t keep data longer than needed
You don’t have to keep guests who haven’t visited for a long time forever. Set a period and anonymise or delete data after that.
Access and deletion
A guest may ask what data you hold and may ask you to delete it. Make sure you can do that quickly.
Data processing agreement and privacy statement
If you use a reservation system, that company processes data for you. So sign a data processing agreement. And state in the privacy statement on your website which data you use and why.
With Jesdi
Jesdi has separate consent tick boxes, records when consent was given, puts an unsubscribe link in every email, can export and delete per guest and anonymises automatically. You sign the data processing agreement when you sign up. See the reservation system.