Under UK GDPR, a restaurant can collect the guest details it needs to manage a booking, such as name, phone number, email and party size, because it needs them to provide the service. Using those details for marketing is different: you need the guest’s consent, or for existing customers you may rely on the “soft opt-in” if you give them a clear way to say no. Keep only what you need, keep it secure, and tell guests what you do with it.
This is a general guide, not legal advice. The Information Commissioner’s Office (ICO) publishes official guidance for small businesses.
What you can collect for a booking
To take and manage a booking, you’ll normally need:
- name;
- phone number and/or email, to confirm or contact the guest about the booking;
- date, time and party size;
- notes the guest chooses to share, such as allergies or an occasion.
Allergy and dietary notes can reveal health information, so treat them with care: share them with the kitchen, and don’t use them for anything else.
Marketing is a separate question
Sending newsletters, offers or event invitations by email or text is marketing. In the UK, the rules for electronic marketing come from the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. In short:
- New contacts: you need clear consent, usually an unticked box on the booking form.
- Existing customers: the “soft opt-in” may let you email people who have booked with you about similar services, if you gave them the chance to opt out when you collected their details and in every message.
Never pre-tick a marketing box.
Keep only what you need
- Don’t ask for information you won’t use, such as date of birth “just in case”.
- Decide how long to keep booking records and delete old ones.
- Limit who on the team can export guest lists.
Tell guests what you do
Your privacy notice should explain, in plain words, what you collect, why, who you share it with (for example your booking system and payment provider) and how guests can ask for their data or have it deleted. Link to it from the booking form.
Choose suppliers carefully
Your booking system processes guest data for you. Check where it stores data, whether it uses your guest data for its own marketing, and whether you can export your data if you leave.
How ForStars fits
ForStars keeps guest profiles and visit history in your account, for your restaurant. Guests book on your own website under your name, not on a marketplace. Read the ForStars privacy policy and the list of subprocessors.
Questions owners ask
Can I use booking emails to send a newsletter?
Only within the marketing rules: with consent, or under the soft opt-in for existing customers with a clear opt-out. When in doubt, ask for consent.
Do I need to delete guest data?
Keep it only as long as you need it for a clear purpose, and delete or anonymise it after that.