Can AI in a hotel comply with the GDPR and the EU AI Act?

Our systems process guest data: names, stays, preferences, correspondence. We treat it as belonging to the hotel that entrusts it to us. Your data does not leave the agreed environment, is not reused anywhere and can be retrieved or deleted at any time.

For properties that ask for it, we run the entire processing on servers within the European Union. That includes the AI models themselves, which then run in a European cloud region. Every system comes with a data processing agreement under Article 28 GDPR, covering purpose limitation, security, sub-processors, incident notification and deletion when the work ends.

Your guests' data is not used to train or improve AI models. Not by us, and under our agreements with model providers, not by them either.

On top of that, each system only has access to the data it needs for its task. A system that writes daily reports has no need to read guest profiles, so with us it cannot.

Where the law requires it, the guest is told clearly that an AI system is helping to write the message. We decide together with you what that notice looks like, in keeping with the tone of your brand.

Messages to guests are checked by a member of staff before they go out. That only changes when your property decides to release a category of messages, and the law allows it.

We do not build systems that fall under the prohibited practices of the EU AI Act, nor applications in the high-risk categories of Annex III. Our systems support administration and communication; they make no decisions about people.

Every system we deliver comes with documentation covering purpose, data flows, models used, human checkpoints and logging. So if there is an audit or a guest asks, your property can show for itself how guest data is handled.