When someone books a table or registers for an event, they give you personal data: a name, an email address, a phone number, sometimes an allergy. That brings in the General Data Protection Regulation (GDPR, in Dutch: AVG). This article explains what that means for restaurants, caterers and event organisers. It's an explanation, not legal advice. What applies to your organisation is for you to decide, with help from a lawyer or your data protection officer if needed. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has plenty of guidance on its website.
Which guest data do you actually process?
It starts with an honest overview. For a reservation or an event, it usually comes down to:
- Contact details. Name, email address and phone number, to confirm, remind or invite.
- Booking details. Date, time, number of people, notes.
- The guest's answers. Whether someone is coming, who they're bringing and which dishes they choose.
- Dietary needs and allergies. What someone can't or won't eat.
- Message data. Whether an invitation was delivered, opened or clicked.
Most of this is ordinary personal data. Allergies and medical diets are not. More on that below.
On which lawful basis do you process guest data?
You may only process personal data if you have a reason the GDPR recognises. The GDPR names six. Their legal name is "lawful bases". Which one applies to you is for you to assess. The AP states plainly that it can't advise you on this (Autoriteit Persoonsgegevens).
For a guest list, legitimate interest is the obvious candidate. You need a name and an email address to invite someone and let them know what time things start. You may only rely on this basis if you've weighed your own interest against the guest's rights and interests (EDPB). Write that assessment down.
One practical example is the privacy statement of Rijkswaterstaat, the Dutch public works agency, for business meetings and events. It bases registration and communication about a meeting on legitimate interest. For dietary needs and allergies it asks for consent, and anyone who doesn't give it suffers no disadvantage (Rijkswaterstaat).
If you rely on consent, it must be freely given, informed, specific and unambiguous (EDPB). A pre-ticked box, or consent hidden in the terms and conditions, doesn't meet that bar.
Diet and allergy data is special category data
An allergy or a medical diet says something about a person's health. Health data is special category personal data. The AP is strict about it: processing it is prohibited unless you meet a number of strict requirements. The first exception the AP names is that the person has given explicit consent to the processing of their own data (Autoriteit Persoonsgegevens).
Not every dietary need is health data. Whether someone eats vegetarian is usually a preference. But a nut allergy or coeliac disease is health data. In a free-text field you can't draw that line, because the guest writes whatever they want.
What you can do in practice:
- Ask only what the kitchen needs. What someone can't eat, not why.
- Explain why you're asking. For example: "so the kitchen can take it into account".
- Use it only for that. An allergy doesn't belong on a newsletter list.
- Don't keep it longer than needed. After the dinner or the event, the kitchen no longer needs it.
Why asking about dietary needs in advance matters for the kitchen too is covered in Allergens and dietary needs in hospitality: rules and practice.
How long do you keep guest data?
The GDPR sets no fixed retention period. Organisations decide for themselves how long they keep personal data. The starting point of the law, though, is to keep it as briefly as possible (Autoriteit Persoonsgegevens).
So set a period yourself, justify it and put it in your privacy statement. Rijkswaterstaat keeps the data of meeting participants for six weeks after the event and then deletes it (Rijkswaterstaat). That's not a standard, but it is a clear example. A restaurant may need a different period, for instance to recognise regular guests. As long as you can explain why.
Who is responsible: you or your software provider?
If you use software to manage reservations or guest lists, there are two roles. The AP explains it like this. The organisation that engages another organisation is the controller. The other organisation, which only carries out the processing on the controller's instructions, is called a processor. The AP gives a cloud service that stores personal data as an example (Autoriteit Persoonsgegevens).
For reservations and events, that usually means:
- The restaurant or organiser is the controller. You decide which data you ask for, why and for how long. You choose the lawful basis. And guests come to you with their questions.
- The software provider is the processor. It stores the data and sends messages on your behalf.
Between the two, there must be a data processing agreement. The GDPR requires one of both parties, and both are liable if it's missing. A processor also may not use the data for its own purposes (Autoriteit Persoonsgegevens).
WhatsApp messages: opt-in first
WhatsApp is a handy way to reach guests. Meta does set its own rules. Under its business messaging policy, you may only contact people on WhatsApp if they've given you their phone number and have confirmed that they want to receive messages from you (WhatsApp Business Messaging Policy).
Meta asks two things of that opt-in (Meta):
- Make clear that the person is opting in to receive messages.
- State the name of the business they'll receive messages from.
The opt-in doesn't have to be specific to WhatsApp, as long as you comply with the law. And if someone no longer wants messages, you must respect that, whether they ask on WhatsApp or some other way.
For a guest list you receive from a client, that means: check that the people on it know they may get a message from you. Why invitations and reminders by message are still worth the effort is covered in Food waste at events and catering: where it goes wrong.
What guests can ask
Under the GDPR, guests have rights over their own data. Among other things, they can ask you which data you hold about them, and have it corrected or deleted. Those requests come to you, because you're the controller. Your software provider helps you answer them.
So agree in advance who on your team picks up such a request, and how you find and delete one guest's data. Then you don't have to go looking when the request comes in.
How Waste Warrior handles guest data
With Waste Warrior, you're the controller and we're the processor. You record the arrangements with us in a data processing agreement. If you don't have one yet, get in touch.
The database and files are stored in the EU, with Microsoft Azure. For a few tasks, we use other parties:
- SendGrid sends emails, such as confirmations and invitations.
- Meta sends WhatsApp messages.
- Sentry helps us track down errors in the app. We strip out links containing a guest's personal code.
The AI analysis in Waste Warrior Monitor receives no guest data.
Within the app, your team only sees the data of its own restaurants. Guests don't need an account. They get a personal link with a long, random code, through which they see their own details. For a table reservation, they can change the number of people, the date, the time and the notes, or cancel. For an event, they can change their name, email address and phone number, say whether they're coming and choose their dishes. A guest who no longer wants WhatsApp messages can change their phone number. You can also remove it from that guest's details.
We don't delete anything automatically. Data is kept while your contract runs and is deleted on request. The only exception is old versions of changed answers, which we clear up ourselves 90 days after the reservation. You can also permanently delete a reservation or remove a guest from the guest list yourself. A cancelled reservation is kept, though. When a booking is cancelled in your connected booking system, we delete it on our side too. If you work with a fixed retention period, such as Rijkswaterstaat's six weeks, ask us to delete the data once it has passed.
Waste Warrior doesn't arrange for you whether a guest has agreed to WhatsApp messages, or to the processing of an allergy. That's part of your role as controller. Mention it in your privacy statement and in the invitation.
Questions about privacy and data? Check the FAQ on data and privacy or plan a demo. You can read more about Waste Warrior Reservations and Waste Warrior Events on the product pages.
