Most accommodation owners are used to thinking carefully about guest experience. You make sure your property is clean, welcoming, well presented and easy to book.
But there is another part of the guest experience that is easy to overlook: how your website handles guest information.
From enquiry forms and booking systems to cookies, analytics, email enquiries, reviews and newsletter sign-ups, most accommodation websites collect or use personal data in some way. That means your website privacy setup matters.
It is not just about having a Privacy Policy hidden in the footer. It is about making sure your website clearly explains what guest information is collected, how it is used, who it may be shared with, and what choices guests have.
Privacy compliance is not just for large businesses
Many small accommodation owners assume that data protection rules mainly apply to big companies, online retailers or large hotels.
In reality, even a small B&B, holiday cottage, glamping site, campsite or guest house may collect personal information every day.
For example, your website may collect or use:
- Guest names and contact details
- Enquiry form submissions
- Booking information
- Email correspondence
- Payment or deposit information through a booking provider
- Website analytics data
- Cookie consent choices
- Newsletter sign-ups
- Guest reviews or testimonials
- Photos or videos used in marketing
- Information shared with cleaners, private chefs, activity providers or other suppliers
Even if your direct booking system is handled by a third-party provider, your website still needs to explain the role that provider plays and signpost guests clearly.
Why your Privacy Policy may be out of date
Many accommodation websites already have a Privacy Policy and Cookie Policy. That is a good starting point, but these pages can quickly become outdated.
A Privacy Policy written several years ago may not mention your current booking system, cookie banner, analytics tools, email marketing platform, review widgets, embedded maps or third-party services.
It may also include old wording that no longer reflects current expectations, such as outdated references to previous data protection legislation, unclear wording about data requests, or vague statements about marketing.
A good Privacy Policy should reflect how your business actually works today.
For accommodation owners, this usually means explaining:
- How guests can contact you
- What happens when someone sends an enquiry
- How direct bookings are managed
- Which booking system or payment provider is used
- Whether guest information is stored in email inboxes
- Whether enquiry forms are stored on the website
- Whether guest details are shared with suppliers
- Whether you send marketing emails
- How long information is kept
- How guests can raise a privacy concern or complaint
Cookie banners need to do more than simply appear
Many websites now have cookie banners, but having a banner does not automatically mean the website is set up correctly.
The important question is whether the banner actually controls non-essential cookies before they are used.
For example, if your website uses tools such as Google Analytics, Google Tag Manager, Meta Pixel, embedded maps, social media feeds or advertising tracking, these may need to be handled carefully.
A good cookie setup should make it clear:
- What cookies are used
- Which cookies are essential
- Which cookies are optional
- How analytics or marketing cookies are handled
- How visitors can accept, reject or manage their choices
- Whether visitors can change their consent later
This is an area where many small accommodation websites fall behind, especially if tracking tools have been added over time.
Recent data protection changes make now a sensible time to review
UK data protection requirements continue to evolve, and recent changes have placed more emphasis on organisations having a clear process for handling data protection complaints.
This does not mean accommodation owners need to panic. It does mean it is sensible to check that guests know how to raise a concern about their personal data, and that you have a simple process for dealing with those concerns.
For most small accommodation businesses, this does not need to be complicated.
It may simply mean making sure your Privacy Policy explains:
- Who guests should contact with a privacy concern
- Which email address to use
- That complaints will be acknowledged and looked into
- That guests can contact the Information Commissioner’s Office if they remain unhappy
Clear information helps protect both the guest and the business.
Direct booking systems and third-party tools
Many accommodation websites use third-party booking systems such as SuperControl, Freetobook, Eviivo, Anytime Booking, Smoobu, Lodgify or other specialist platforms.
This is perfectly normal, but your privacy wording should explain how these systems fit into the booking journey.
If a guest clicks from your website to a booking system, or uses an embedded booking form, they should be able to understand that their booking details may be processed through that provider.
Your website should also consider other third-party tools, such as:
- Payment providers
- Email marketing platforms
- Review widgets
- Google Analytics
- Cookie consent tools
- Website hosting providers
- Spam protection tools
- Image optimisation or CDN services
- Embedded maps or videos
You do not need to overwhelm visitors with technical detail, but your website privacy information should be accurate and transparent.
Guest trust is part of the booking journey
Privacy compliance can sound dry, but it is really about trust.
Guests are sharing personal information with you. They may be sending names, phone numbers, email addresses, holiday dates, guest numbers, accessibility requirements, payment details or special requests.
A clear and up-to-date privacy setup helps show that your business is professional and trustworthy.
It also helps reduce confusion. If a guest wants to know how their information is used, whether they will be added to a mailing list, or who handles their booking details, they should be able to find clear answers.
What accommodation owners should review
A practical website privacy review should usually include:
- Privacy Policy
- Cookie Policy
- Cookie banner and consent setup
- Website enquiry forms
- Booking links and booking system signposting
- Analytics and tracking tools
- Email newsletter sign-ups
- Guest review/testimonial use
- Guest photo/video use
- Third-party supplier sharing
- Data retention habits
- Data protection complaint wording
- ICO data protection fee self-assessment signposting
This is not about making privacy feel frightening. It is about making sure the basics are in place and that your website reflects how your business actually handles guest information.
Do you need to pay the ICO data protection fee?
Many organisations that use personal information need to pay an annual data protection fee to the Information Commissioner’s Office unless they are exempt.
The official ICO self-assessment is the best way to check what applies to your business.
This is something the business owner should complete using their own details, as the answers depend on how the business operates, whether personal information is processed, whether CCTV is used, whether marketing emails are sent, and other business-specific factors.
Our Website Privacy MOT for accommodation owners
To help accommodation owners review their website privacy setup, we now offer a practical Website Privacy MOT.
For £195 + VAT, we review the website-side privacy setup and provide a clear, practical report covering:
- Existing Privacy Policy and Cookie Policy, if present
- Website enquiry/contact forms
- Cookie banner and consent setup
- Analytics/tracking tools
- Booking system signposting
- Guest data touchpoints on the website
- Basic privacy wording recommendations
- Simple owner actions, such as data retention and complaint handling
- Any obvious gaps or outdated wording
Where simple website text updates are needed, we include up to 30 minutes of minor amendments as part of the MOT.
This is not a legal service and does not replace formal legal advice. It is a practical website review based on current ICO guidance and the way accommodation websites typically collect and handle guest information.
Is your website privacy setup up to date?
If your Privacy Policy or Cookie Policy has not been reviewed for a while, now is a sensible time to check it.
Your website may have changed. Your booking system may have changed. Your cookie banner, analytics tools or enquiry forms may have changed. Your business processes may have changed too.
A Website Privacy MOT gives you a clearer picture of where things stand and what action, if any, may be needed.
If you would like us to review your accommodation website, please get in touch to book your Website Privacy MOT.