AI and Privacy in Hospitality: Does HorecaHub Comply with the GDPR?

Any hospitality entrepreneur using AI for reservations, questions or follow-ups will sooner or later face the same question: how exactly does privacy and the GDPR work? It’s a legitimate concern, because guest data is sensitive. Names, phone numbers, dietary preferences and sometimes even medical information such as allergens are involved. In this article we explain how HorecaHub approaches AI hospitality privacy, the choices we make to comply with the European GDPR and what this means in practice for you as an entrepreneur.

We base our approach on guidance from the Dutch Data Protection Authority, the official text of the European AI Act and practical guidance from the EDPB.

What falls under AI hospitality privacy

In practice, AI hospitality privacy involves four types of data: contact details (name, phone, email), reservation data (date, time, number of guests), conversation content (what a guest says in a chat or phone call) and sensitive notes (allergens, mobility needs, dietary preferences). Not all of this data is automatically considered personal data under the GDPR, but in combination it often is.

Our rule is simple: we only process what is necessary to help the guest at that moment, nothing more. This principle is called data minimisation and is explicitly stated in Article 5 of the GDPR.

How long the AI stores guest data

The standard retention period for conversation content is 30 days. After that period, conversations are automatically deleted or anonymised. Reservation data itself falls under the retention periods of the entrepreneur’s reservation system, not our systems. Special categories such as allergen information are stored only for the duration of the reservation and up to a maximum of seven days afterwards for complaint handling.

Entrepreneurs can shorten these periods in consultation if their own privacy policy requires it. Extending them is also possible, but only with an explicit legal basis and justification recorded in the processing register.

Where the data is physically stored

All guest data is stored in encrypted form on servers within the European Union. We do not use data centres outside the EU for the storage of personal data. When using AI models, we run on European instances where possible; where this is not yet technically available, we use standard data processing addenda and additional safeguards in line with the guidelines of the EDPB.

How guests know they are speaking with AI

The European AI Act requires that guests know when they are communicating with an AI. We incorporate this by default in the opening lines of a conversation, in the guest’s language, in a natural way so that it does not feel like a legal disclaimer. In chat, this is visible in the chat widget. In voice interactions, the guest hears in the greeting that a digital assistant is listening and helping.

Who is the controller and who is the processor

In the standard model, the hospitality entrepreneur is the data controller and HorecaHub acts as the processor. This means the entrepreneur determines why data is collected and we carry out the processing on their behalf. A data processing agreement is signed as standard at the start of the collaboration. Signing it takes less than five minutes and the content is based on the model contract of the Dutch Data Protection Authority.

What rights a guest has

Under the GDPR, a guest has the right to access, correction, deletion, restriction and data portability. In practice, we process requests through the hospitality entrepreneur: if a guest asks for their data to be deleted, the entrepreneur can submit this with one click in the admin panel. We carry out the request within five working days and confirm it in writing. For sensitive requests, we can also communicate directly with the guest if the entrepreneur approves this.

How we handle complaints and data breaches

In the event of a suspected data breach, we follow a fixed incident protocol: reported internally within 24 hours, impact analysis within 48 hours, and notification to the Dutch Data Protection Authority within 72 hours if required. The entrepreneur is involved from the very beginning and receives a written report explaining what happened, which data was affected and what measures were taken. We intentionally keep this protocol short because speed is crucial in privacy incidents.

What you as a hospitality entrepreneur need to arrange yourself

Three things. One: an up-to-date privacy and cookie statement on the website that explicitly mentions AI processing. We provide standard text blocks you can adopt or have validated by your own lawyer. Two: an internal data processing agreement with HorecaHub, which we supply as standard. Three: short internal agreements about who on the team can access AI results and what the team should do if a guest makes a data request.

How this connects with other regulations

In addition to the GDPR and the AI Act, hospitality businesses also deal with sector-specific rules. For example, information obligations regarding allergens under the European Food Information Regulation. A practical framework can be found via KHN, the industry association that provides members with translations of European rules into daily operational practice. A properly configured AI helps communicate this type of information consistently and uniformly, regardless of who is behind the bar that evening.

What this means for future developments

The European AI Act will be introduced in phases over the coming years, with stricter requirements for higher-risk applications. Customer service AI largely falls under a lighter regime, but transparency remains the cornerstone. We actively follow developments and update the platform before new rules take effect so that entrepreneurs are never faced with surprises.

Practical checklist for entrepreneurs

Review these five points once per quarter: is the privacy statement on the website still up to date, is the data processing agreement registered under the correct name, does the team know where guest data requests should go, do the retention periods match your current working practice and is the AI disclosure still visible in chat and telephony. Fifteen minutes of work per quarter, but it prevents the vast majority of compliance problems.

Common follow-up question from entrepreneurs

Almost every entrepreneur asks: can the Dutch Data Protection Authority fine me if I use AI and something goes wrong? The short answer is that fines usually result from the absence of basic measures: no data processing agreement, no privacy statement, no reporting procedure. If that foundation is in place and you work with a processor that demonstrably follows the GDPR, the risk of fines is low. We actively support entrepreneurs in setting up this foundation properly, because a strong privacy approach also increases guest trust.