GDPR

Your data and GDPR

When accommodation providers collect and submit guest identification data, they must comply with the General Data Protection Regulation (EU) 2016/679. GDPR applies across the European Union and sets strict rules on how personal data may be processed, protected and used.

Lawful basis for processing

Guest data is processed because it is required by law. Under GDPR, personal data may be processed when it is necessary to comply with a legal obligation imposed on the data controller. In this case, the legal obligation arises from national guest registration laws adopted by EU Member States.

Accommodation providers do not collect guest data for commercial purposes, marketing or profiling.

Who processes your data?

  • The accommodation provider, solely for the purpose of legal compliance
  • Competent public authorities, such as police, immigration or tourism authorities

Guest data is submitted directly to official government systems and is not shared with third parties beyond what is required by law.

Your GDPR rights

Under GDPR, guests have the right to:

  • Access their personal data
  • Request correction of inaccurate or incomplete data
  • Receive information about the purpose and legal basis of data processing
  • Know how long their data will be retained
  • Lodge a complaint with a national data protection authority

To exercise these rights, contact the accommodation provider that registered your stay. They are the data controller for the registration, and the competent public authority is the controller for the data once submitted.

Rights that may be limited

Because guest data is processed to comply with legal requirements, certain GDPR rights may be restricted by national law, such as:

  • The right to erasure (the "right to be forgotten")
  • The right to object to processing

Such limitations are permitted under GDPR when necessary for public security, law enforcement or compliance with legal obligations.

Data retention

Guest data is retained only for the period defined by national law. Retention periods vary by country and are determined by public authorities. Once the legal retention period expires, the data must be deleted or anonymised in accordance with applicable regulations.

Security and confidentiality

GDPR requires both accommodation providers and public authorities to implement appropriate technical and organisational measures, including:

  • Secure data transmission
  • Encryption where required
  • Access controls limited to authorised personnel
  • Protection against unauthorised access, loss or misuse

Failure to protect personal data may result in legal penalties under GDPR and national law.

No central EU database

Guest personal data is not stored in a central European Union database. Each Member State processes guest data independently, within its own legal framework and under the supervision of national data protection authorities.

How EuroCheckin itself handles data when a provider uses it is described under data protection.