Travel and hospitality
Hotels, travel agencies and booking platforms.
In short
Travel businesses send guest data to reservation systems, loyalty programmes and partners abroad, and each of those transfers needs a contract.
Travel and hospitality businesses collect identity documents, passport details and payment information, often before a guest arrives. Under the DPDP Act, guests need to be told what is collected and why, and the data should be kept only as long as the purpose or the law requires.
Booking data is routinely sent to global reservation systems, loyalty programmes and partners in other countries. These transfers are generally permitted, but they need to be covered by contracts and explained in the privacy notice.
Much of the commercial risk sits in distribution agreements with online travel platforms, which set commission, rate parity, cancellation handling and liability for errors. The booking terms shown to guests need to be consistent with those agreements.
What usually comes up
- Guest identity and passport data
- Booking platform and distribution agreements
- Transfers of guest data to global booking systems
Under the DPDP Act
Hotels and travel companies often must collect passport and identity details by law. Data collected for that requirement should not be reused for marketing without consent.
What our work involves
- Notice, consent and retention for guest and identity data
- Transfers of guest data to global booking and loyalty systems
- Distribution agreements with online travel platforms
- Terms, cancellation policies and privacy notices for bookings