GDPR Policy and Process for Hotel and Event Operations
GDPR Policy and Process for Hotel and Event Operations, for protecting the personal data of your guests, staff, and job applicants.
The policy outlines key aspects of GDPR compliance, including data collection, usage, retention, access, and employee recruitment.
GDPR Policy for IRG Hotel and Event Operations
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy.
This policy outlines our commitment to safeguarding personal data and ensuring that the rights of individuals are respected in all our IRG hotel and event operations, including recruitment.
This policy applies to:
- Hotel guest data.
- Event participant and attendee data.
- Employee and contractor data, including recruitment.
- Data collected for marketing, communication, and operational purposes.
Data Protection Principles
We are committed to complying with the following GDPR principles:
- Lawfulness, fairness, and transparency: Data will be processed lawfully, fairly, and transparently.
- Purpose limitation: Data will only be collected for specified, legitimate purposes.
- Data minimisation: Only the data necessary for the intended purpose will be collected.
- Accuracy: Personal data will be accurate and kept up to date.
- Storage limitation: Data will be retained only for as long as necessary.
- Integrity and confidentiality: Data will be processed securely, protecting against unauthorised access and loss.
Data Collection and Processing
We collect personal data in the following ways:
- Hotel Guest Data: When guests make a reservation, check-in, or use hotel services, we collect personal details such as name, address, contact details, payment information, and preferences.
- Event Data: For event participants, we collect personal details (e.g., name, contact details, payment details) for event registration and communication.
- Recruitment Data: During recruitment, we collect personal details from applicants (e.g., CVs, application forms, interview notes, references, videos) to assess their suitability for roles.
- Marketing and Communication Data: We may collect data through newsletters, surveys, and other communication forms.
Data Usage
We use personal data for the following purposes:
- Hotel Operations: To fulfill reservations, provide services, and communicate with guests.
- Event Operations: To manage event registrations, communication, and any specific needs of participants.
- Recruitment: To assess and process applications, conduct interviews, and evaluate qualifications.
- Marketing: To inform individuals about new services, promotions, or events, but only when they have consented.
- Loyalty Programs & Memberships (Clients & Staff): To manage rewards programs, track usage, for the offering of benefits for clients & discounts.
Consent and Legal Basis for Data Processing
We process personal data based on one or more of the following legal grounds:
- Consent: For specific purposes, including marketing communications.
- Contractual necessity: To fulfill obligations under a contract (e.g., hotel bookings, event registrations).
- Legal obligation: To comply with legal requirements (e.g., tax and accounting obligations).
- Legitimate interest: To protect our business interests, provided this does not override the rights of individuals.
For recruitment, we collect and process data based on the following legal grounds:
- Consent: During the application process (e.g., consent to use data & consent to contact references etc).
- Contractual necessity: For employment contracts.
- Legitimate interest: For selecting suitable candidates and protecting our business.
Data Access and Security
- Access Control: Personal data is only accessible to employees or third parties who need it to perform their duties.
- Data Security: We implement appropriate technical (IT department) and organisational measures to ensure personal data is protected against unauthorised access, loss, or disclosure.
Data Retention
We retain personal data for the following periods:
Guest and Event Data: Retained for the duration of the stay/event and up to 6 months after, unless legal obligations require longer retention.
Recruitment Data: Retained for up to 6 months after the recruitment process unless the applicant is hired, in which case the data is retained for the duration employment.
Data Subject Rights
Under GDPR, individuals have the following rights regarding their personal data:
Right to Access: Individuals can request a copy of their personal data.
Right to Rectification: Individuals can request corrections to inaccurate or incomplete data.
Right to Erasure: Individuals can request the deletion of their data, subject to certain legal exceptions.
Right to Restrict Processing: Individuals can request restrictions on how their data is processed.
Right to Object: Individuals can object to the processing of their data in certain situations.
Requests should be submitted in writing to the Data Protection Officer (DPO), and we will respond within
the statutory timeframe.
Recruitment Process and GDPR Compliance
During the recruitment process, we take the following steps to ensure compliance:
Data Collection: Collect only the necessary data (e.g., CV, application forms, videos) and inform candidates about why we collect the data.
Consent and Legitimate Interests: Obtain consent for specific purposes, such as storing applicant data for future job opportunities. We may process data based on legitimate interests in evaluating candidates.
Data Retention: If an applicant is unsuccessful, we will retain their data for up to 6 months, with their consent.
Confidentiality: All recruitment data (including interview notes, videos and references) is kept confidential and accessible only by authorised personnel. To be deleted is insuccessful.
Third-Party Data Processing
We may share personal data with third-party service providers (e.g., payment processors,
HR software providers) to facilitate hotel or event operations. We ensure these third parties are GDPR-
compliant and have appropriate data protection agreements in place.
Data Breach Notification
In the event of a data breach, we will follow these procedures:
Immediate Action: Investigate the breach, mitigate damage, and secure the data.
Notification: If the breach results in a risk to individuals' rights and freedoms, we will notify the relevant
data protection authority and affected individuals within 72 hours.