Where a guesthouse website touches personal data
A guest who writes “Is the apartment free from 14 to 21 July for two adults and a child?” has just given you a name, an email address and details about their family and travel plans. That is personal data under the GDPR, and you are the controller of it. The same applies to a phone number typed into a callback field. The website is often the first place where this happens, and it happens in more spots than the form.
Five places to check
The enquiry form
Ask only for what you need: name, email, dates, number of guests and a message. The phone number can be optional. Every extra field needs a reason. Put a link to the privacy notice next to the button.
Email links and a WhatsApp button
A plain email link collects nothing by itself, but once the guest writes, you process their data. A WhatsApp button opens a conversation on a third-party service, so the privacy notice should mention it.
Embedded maps, videos and booking widgets
When a page loads a map or video from another provider, the visitor's browser connects to that provider, which receives at least the IP address. A common solution is a placeholder that loads the content only after a click, or a static map image with a link.
Visitor statistics
Statistics are normally not treated as “strictly necessary” for the service the visitor asked for. A tool that stores or reads identifiers on the device therefore usually needs consent before it starts. Check the tool's documentation and the guidance of your supervisory authority.
Newsletter
Keep it separate and optional, with an unticked box. Consent to a newsletter and an enquiry about dates are two different things.
What the privacy notice has to contain
Article 13 of the GDPR lists what a person must receive when their data is collected directly from them: who the controller is and how to reach them, the purposes and legal basis, the recipients (for example the hosting and email providers), whether data leaves the EU, how long it is kept, the rights of access, correction, erasure, restriction, objection and portability, and the right to complain to the supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (CPDP). For a booking enquiry the usual basis is steps taken at the guest's request before a contract, not consent. The text must describe your business, not someone else's, so have it checked by a lawyer or a data protection adviser.
What valid consent looks like
According to the European Data Protection Board's summary, consent has to be freely given, specific, informed and unambiguous. Pre-ticked boxes, silence and simply scrolling are not consent. A banner that blocks the content until the visitor clicks “Accept” does not produce valid consent either, which the summary gives as an example. Withdrawing must be as easy as giving it, so a link in the footer that reopens the settings belongs on every page. Scripts of non-essential tools load only after the click. The EDPB's guidelines on the technical scope of Article 5(3) of the ePrivacy Directive make clear that the rule is not limited to classic cookies and can also cover tracking pixels and local storage. Bulgaria has implemented the directive in national law, so check the current text or ask a lawyer.
Before launch
Before a site goes live we go through a short list: which fields are really needed, which external tools load, who the controller is and how to reach them, how long enquiries are kept and where the privacy link sits. Guest registration duties of accommodation providers and tax questions are separate from the website and are not covered here.
What it costs and what I need from you
A “Start” website of up to five pages in Bulgarian and English starts at €490 net. Hosting starts at €24.90 per month. I need to know which form fields you want, which tools you use (booking widget, map, statistics, newsletter) and who the data controller is. The legal texts should be reviewed by a lawyer; I build them into the site.
Sources: EDPB: summary on consent · EUR-Lex: GDPR (Regulation 2016/679) · EUR-Lex: ePrivacy Directive 2002/58/EC
Frequently asked questions
Do I need a cookie banner if my guesthouse site only has a contact form?
It depends on what the site loads. Technically necessary storage needs no consent, but embedded maps, videos, statistics or ads may. A privacy notice is needed in every case, because the form collects data.
Can I copy a privacy policy from another website?
That is not a good idea. The text has to describe your own processing: who you are, which tools you use, who receives the data and how long you keep it. A copied text often names tools you do not use and misses those you do. Have it reviewed by a lawyer.
Does my notice cover bookings made through a portal such as Booking.com?
What happens on the portal falls under the portal's own privacy information. Your notice covers your website: the form, your emails and any embedded tools. If you embed a portal widget on your site, say so.
How long may I keep enquiries?
The GDPR sets no fixed period. Article 13 requires you to state the period or the criteria used to set it. Decide it yourself, for example how long an enquiry without a booking is kept, and write it down.
Ready for a guesthouse website that handles guest data properly?
Tell me about your property and the tools you use. I will reply with a first assessment and a fixed price.