You may have seen Georgia's story come along. She went for drinks with friends and neatly left her name and phone number for source and contact investigation as part of coronama measures. Half an hour later, she received a flirty app from one of the waiters, she shares on Twitter.
Georgia was not amused by this. 'This does not seem to me to be the intention,' she wrote. Clearly, then, this is not how you handle personal data. But what exactly are the rules when recording guest data for source and contact investigations? How do you store this data securely? And when should you delete it again? We list it for you.
This data is about
With corona virus lurking everywhere, it is mandatory in the hospitality industry to ask guests to register. This is to enable source and contact investigation by the GGD, in case someone who has visited your establishment is found to be infected with the virus. This is why you ask for name, phone number and e-mail address.
You should also record that the questions from the mandatory Corona health check were asked, plus the guest's date, arrival time and table number. Finally, you need to record that the guest gave permission to store the data, for the sole purpose of sharing it with the GGD on request.
Are guests required to register?
There still seems to be some confusion about whether guests are required to register. The answer to this is: no. But beware! You are obliged to ask them to leave their details. This applies both inside and outside and regardless of the size of the catering establishment. Guests are also required to make a reservation (in advance or at the door), answer a health check (without recording these answers) and be assigned a fixed seat.
What if guests refuse?
Guests may therefore refuse to leave their name and contact details. Subsequently, you may not refuse them a snack or drink for that reason. On the registration form, you then only report the table number, arrival time and an initial from the staff member as confirmation that contact details have been asked for.
Health check is mandatory
The health check is another story. This is mandatory and guests who refuse to participate in it, or give a positive answer to any of the questions, should be asked to go home. The health check consists of the following questions, click here To download it!
How do you store contact details securely?
You store the name and contact details of your guests according to AVG privacy guidelines. This means that you may only use the data to share with the GGD, at its request for source and contact investigation. The guest must also give permission for this.
Do not use the data for marketing purposes
So it may seem like a smart idea to add the collected contact details directly to your mailing list or some other marketing tool, but then you are not AVG-proof. And even if it is love at first sight as soon as you cross glances with your future life partner who has just taken a seat on the terrace: you will really have to find another way to approach him or her.
Keep data out of reach of others
Therefore, it is important to store the data out of sight of other guests and make it clear to your staff that they too should not do anything with it. The advice is to keep them in a safe, a locked cabinet or a sealed envelope each day. Do you store the data digitally? Then secure them with a password.
In doing so, Koninklijke Horeca Nederland (KHN) advises against clever constructions to use the data for other purposes anyway. After all, this damages guest confidence. Something you don't want, of course.
How long do you keep the data?
After 14 days, you have to destroy the data. And destroy means really destroy. If you work with paper registration forms, you should not store them somewhere or throw them in the paper bin altogether. Because there remains a risk that someone will fish them out of here again. So make sure all data is completely unreadable. Preferably with a paper shredder or by cutting the forms. In the case of digital registration forms, you should delete them. It is smart to start or end the day by deleting the data that is 14 days old at that time.
Ways of registration
There are several options for registration. For example, with a paper form, via an app or with a digital registration form. What should you pay attention to here?
Paper registration form
Do you opt for a paper registration form? Then put these on the tables by default with a request to fill them in. Employees can then take them immediately when taking the order. Also, when taking the order, have the employee immediately clean the pen with a cloth instead of doing it inside. This will show your guests that you take the measures seriously. When clearing away, the employee then puts a new form on the table.
Handily, KHN has a example of a registration form source and contact investigation data prepared. This form complies with privacy guidelines. Use this form, or create it in your own house style. But we recommend not 'fiddling' with the questions any further, to make sure the form complies with all the guidelines.
Digital registration
Prefer digital registration? We get that. Because this is quicker to fill in, easy to keep and you avoid contamination via pens and paper. However, it is important to observe the AVG rules here.
Beware of apps
For instance, there are in apps in circulation that claim to store data securely, but sometimes they are used in the meantime to obtain marketing data in a 'clever' way. To make sure you are in the right place, the app should provide an unconditional and AVG-approved guarantee from the Personal Data Authority. You as a business owner should also be indemnified in advance for any AVG claims.
Use digital form
Another digital option is to let guests fill in a form on your website or via Google Forms. Again, it is important that the data is stored securely and not used for other purposes.
Let us create a free digital form
We can help you create a secure form on your website (provided it is properly secured) or via Google Forms. How does this work? We create a QR code that your guests scan with their phones. They then come out to this form and fill in their details. It's then up to you to make sure you delete the data after 14 days.
Are you interested in a digital registration form source and contact investigation? Email or call then feel free to contact us. As a hospitality entrepreneur, you probably have it tough enough right now, so we'll take care of this for you for free.
