The privacy policy is a legally required document that informs users about the collection, processing and use of their personal data. Under the GDPR, the privacy policy must be easily accessible and written in clear, understandable language.
Mandatory information in a privacy policy for booking systems
- Name and contact details of the controller
- Which data is collected (name, email, phone, booking data etc.)
- Purpose of data processing
- Legal basis for processing
- Storage period of the data
- Rights of the data subject (access, rectification, erasure)
- Whether data is passed on to third parties (e.g. payment providers, email marketing)
The booking form must contain a visible link to the privacy policy.