Guest privacy notice

What you need to know

The plain-English guidance that comes with this document.

• You collect guest data, so UK GDPR applies — even for a single let. Names, contact and payment details, and especially the passport/ID details you're legally required to record for overseas guests, are all personal data. UK GDPR requires you to tell guests, in plain language, what you hold and why. Make this available at booking (a link in your confirmation is fine) and in the property.
• You're the data controller. Even a one-property host letting a spare room is a controller and must comply. That's why this notice carries your name and address.
• The guest register creates real, sensitive data — treat it with care. Passport numbers and travel details are exactly the kind of information that causes harm if lost. Keep the register secure, don't leave one guest's details visible to the next, and dispose of it securely once you've kept it for the required period. This notice tells guests you do that.
• Name your helpers honestly. If a cleaner, a co-host, or a platform like a booking site handles guest data, guests should understand that. You don't need to list them by name, but "the people who help us run the property" should be true and, behind the scenes, you should be satisfied they handle data properly.
• Sharing with the authorities is lawful and expected. Producing the guest register to a police or immigration officer on request is a legal duty, not a breach — saying so here is honest and reassuring.
• Adapt it to how you actually operate. If you use CCTV (even a doorbell camera), a noise monitor, or a specific booking platform, add a line about it — those raise their own questions and guests should know. Keep it accurate and review it if your setup changes.