Skip to content

Guide

Does AI in a hotel comply with the GDPR and the EU AI Act?

. Written by Martin Veltman.

Short answer

It can, and with us it is on paper before anything is built. Hosting inside the European Union is possible, guest data trains no model, every system comes with a processing agreement, and an employee keeps control of outgoing messages. Every agreement can be checked.

What the GDPR asks, and what we put in writing

Our systems process guest data: names, stays, preferences, correspondence. We treat that as the property of the house that entrusts it to us. Your data does not leave the agreed environment, is not reused anywhere and can be retrieved and deleted at any moment.

For houses that ask for it we set up the entire processing on servers within the European Union. That applies to the AI models themselves as well, which then run in a European cloud region. Every system comes with a processing agreement under article 28 GDPR, covering purpose limitation, security, sub processors, incident notification and deletion afterwards.

No training on your guest data

Data about your guests is not used to train or improve AI models. Not by us, and under our agreements with model providers not by them either.

On top of that, every system only gets access to the data it needs for its task. A system that writes daily reports has no need to read guest profiles, and with us it cannot.

What the EU AI Act adds

Where the law asks for it, it is clear to the guest that an AI system is writing or thinking along. What that notice looks like we decide together with your house, in keeping with the tone of your brand.

Messages to guests pass an employee before they leave the building. Only when your house decides itself to let a category of messages go, and the law allows it, does that change.

What we do not build, and what you get

We build no systems that fall under the prohibited practices of the EU AI Act and no applications in the high risk categories of annex III. Our systems support administration and communication; they make no decisions about people.

Every delivered system comes with a file: purpose, data flows, models used, human control points and logging. That lets your house show, at an audit or on a guest's question, how guest data is handled.

Tell us how your house runs and in half an hour you will know whether this suits your house.

Book a call

A first conversation takes half an hour and commits you to nothing.

Read the full statementWhat an AI automation agency for hospitality doesBack to the guide