Question 1

What is HotelComply?

Accepted Answer

HotelComply helps hotel portfolio operators, asset managers, and management companies turn their operating systems into audit-ready privacy records. The Compliance Package documents CCPA, CPRA, and GDPR workflows across vendor oversight, DPA verification, guest rights request procedures, records of processing, and compliance posture reporting.

Question 2

What does HotelComply deliver for hotel portfolios?

Accepted Answer

Audit-ready privacy documentation for hotel portfolios, delivered as a service by hotel operators. The binder documents vendor classification, DPA tracking, guest rights request procedures, processing records, retention records, and defensible compliance evidence.

Question 3

Who is HotelComply built for?

Accepted Answer

HotelComply is built for hotel portfolio operators, asset managers, and management companies managing multiple properties, especially teams with California exposure, CPRA/CCPA obligations, GDPR considerations, or vendor documentation requirements.

Question 4

Does HotelComply replace legal counsel?

Accepted Answer

No. HotelComply supports operational compliance workflows and documentation. It is not a substitute for legal counsel. The Compliance Package helps teams organize records, workflows, and verification steps that support legal review and privacy operations.

Question 5

Does my hotel need to comply with CCPA, CPRA, or GDPR?

Accepted Answer

Many hotel portfolios need to evaluate more than one privacy regime. California operators may trigger CCPA and CPRA based on revenue, data volume, or data-sharing activity, while hotels with EU or EEA guests, loyalty members, employees, or reservation activity may also need GDPR records. Hotel portfolios often meet thresholds through shared systems, centralized marketing, PMS records, loyalty data, and vendor relationships.

Question 6

What's the difference between CCPA and CPRA?

Accepted Answer

The CPRA (California Privacy Rights Act) amended the original CCPA. The CPRA added new consumer rights, including the right to correct data and limit use of sensitive personal information, created the California Privacy Protection Agency (CPPA), and introduced stricter vendor contract requirements. All CPRA requirements have been in effect since January 1, 2023. HotelComply documents the hotel operating records needed to support these obligations.

Question 7

What guest data do hotels actually collect that triggers compliance?

Accepted Answer

Hotels collect substantial personal information: full names, email addresses, phone numbers, payment card data, government IDs (for check-in), IP addresses from booking engines, location data, loyalty program activity, and stay preferences. Under CPRA, passport numbers and precise geolocation are classified as sensitive personal information, subject to stricter handling requirements. Most hotels collecting any of this data have compliance obligations.

Question 8

What are the six guest privacy rights hotels must honor?

Accepted Answer

Under CPRA, your California guests have the right to: (1) Know what data you've collected and how it's used; (2) Delete their personal information; (3) Correct inaccurate data; (4) Opt out of the sale or sharing of their data; (5) Limit use of sensitive personal information; and (6) Non-discrimination for exercising any of these rights. Hotels must have documented workflows to fulfill each of these requests within legal timeframes.

Question 9

How does the HotelComply service start?

Accepted Answer

HotelComply starts with a focused property review that identifies your systems, vendors, and guest privacy workflows without turning onboarding into legal paperwork. The Compliance Package ($2,500/property) is scoped around your portfolio, vendor stack, and jurisdictions so the core binder can be assembled with defensible records.

Question 10

Do I need to be a lawyer or compliance expert to use HotelComply?

Accepted Answer

No. HotelComply is built for hotel operators, asset managers, and portfolio teams, not attorneys or IT specialists. Every workflow uses plain-English guidance and hotel-specific language around guests, reservations, PMS records, front desk procedures, vendor contracts, employee records, and operating systems.

Question 11

What does the Compliance Package actually produce?

Accepted Answer

The Compliance Package produces an audit-ready operating file for your hotel portfolio: vendor documentation, DPA status tracking, guest privacy request procedures, ROPA and retention records, evidence checklists, and prioritized gaps. The goal is a practical file your ownership group, insurer, or privacy counsel can review without reconstructing your data flows from scratch.

Question 12

How does HotelComply use vendor classification?

Accepted Answer

HotelComply maps a hotel's actual technology stack against a hospitality vendor reference library. Vendors are classified by CPRA role, GDPR Article 28 relevance, DPA documentation status, sub-processor visibility, international transfer considerations, and risk level. Hotel-specific verification is tracked separately from reference-grade classifications.

Question 13

What is reference-grade vendor status?

Accepted Answer

Reference-grade vendor status means a vendor has been classified based on available documentation, common hospitality use cases, expected contractual role, DPA expectations, sub-processor visibility, and risk indicators. It is not the same as verified hotel-specific compliance status.

Question 14

What is verified vendor status?

Accepted Answer

Verified vendor status means a hotel or portfolio has confirmed its actual contract, uploaded or documented the executed agreement, reviewed the vendor relationship, and recorded the vendor's role in that specific operating environment.

Question 15

How does HotelComply support CPRA, CCPA, and GDPR workflows?

Accepted Answer

HotelComply supports operational privacy workflows across vendor oversight, DPA tracking, guest rights request management, records of processing, retention documentation, and compliance posture reporting. CCPA and CPRA workflows focus on California privacy obligations, while GDPR workflows support lawful basis documentation, Article 28 vendor review, records of processing, and data subject request handling.

Question 16

What is a Foundation Audit?

Accepted Answer

A Foundation Audit is the structured intake behind the Compliance Package. It identifies property-level systems, maps vendors against the hospitality reference library, generates initial processing records, surfaces DPA gaps, and produces a baseline compliance posture for each property.

Question 17

What is a ROPA and why does my hotel need one?

Accepted Answer

A Record of Processing Activities (ROPA) is a documented inventory of every way your hotel collects, uses, stores, and shares guest and employee personal information. While CPRA doesn't mandate a ROPA by name, it requires businesses to know and document their data flows — which is exactly what a ROPA provides. It's the foundation of any defensible compliance program and the first thing regulators ask for during an investigation.

Question 18

What happens if a guest submits a data request to our hotel?

Accepted Answer

When a guest submits a Data Subject Access Request (DSAR), your hotel has 45 days to respond (extendable by another 45 days with notice). HotelComply documents a compliance timeline, assigns a 6-stage task queue (verify identity → collect data → redact → legal review → generate response → deliver), tracks deadline alerts, and produces a complete audit trail. No request falls through the cracks.

Question 19

How long does a hotel have to respond to a guest data request?

Accepted Answer

Under CPRA, hotels must respond within 45 calendar days of receiving a verifiable consumer request. A one-time 45-day extension is permitted if you notify the guest of the delay within the original 45-day window. Failure to respond is a violation. HotelComply tracks every open request with documented deadline alerts so your team always knows the clock.

Question 20

How do we train front desk staff to handle privacy requests from guests?

Accepted Answer

Front desk staff don't need to become compliance experts. HotelComply provides an embeddable DSAR intake form (/embed-dsar) that guests can submit directly. Staff only need one instruction: 'Direct the guest to this link.' All processing, documentation, and response generation happens in the back office. Initial front desk training typically takes under 15 minutes.

Question 21

Can a hotel deny a guest's request to delete their data?

Accepted Answer

Yes, in certain circumstances. CPRA provides exceptions that allow hotels to retain data when it's needed to complete a reservation, fulfill a legal obligation, detect security incidents, or comply with other laws. HotelComply's DSAR workflow includes legal review checkpoints and helps you apply the correct exemptions — with documentation to back up every decision.

Question 22

Does HotelComply store hotel guest personal information?

Accepted Answer

No. HotelComply is designed around compliance records, not guest data storage. Hotel guest personal information such as names, email addresses, and booking records should remain in your property management system and source systems. DSAR records are tracked using operational metadata and reference tokens, not a duplicate guest database.

Question 23

What happens to guest data files uploaded during DSAR fulfillment?

Accepted Answer

When a hotel administrator uploads a guest data package to fulfill an access or portability request, that file is never stored permanently on our infrastructure. It is held transiently, delivered to the guest via a single-use secure link, and deleted automatically within 72 hours — whether or not the guest downloads it. Our system retains an audit record confirming that delivery occurred, without retaining the underlying file.

Question 24

Can HotelComply staff access our guests' personal information?

Accepted Answer

No. Because guest personal information is never written to our database, there is nothing for HotelComply staff to access. DSAR records contain only operational metadata: request type, jurisdiction, SLA deadline, status, and a one-way cryptographic hash. That hash cannot be reversed to identify the guest.

Question 25

How does this affect our own CPRA compliance posture?

Accepted Answer

It strengthens it. When you engage a technology vendor, you are responsible for ensuring that vendor handles guest data appropriately and is contractually bound as a service provider. Because HotelComply does not receive or store guest personal information, the data processing relationship between your property and HotelComply is substantially narrower than with most compliance vendors — reducing your vendor risk surface and simplifying your own ROPA documentation for this service.

Question 26

Where can I review HotelComply's data processing commitments?

Accepted Answer

Our Data Processing Agreement is available at hotelcomply.com/dpa. It describes exactly what we process, on whose behalf, and under what restrictions. If you have specific questions about our security architecture or need documentation for your own compliance file, contact us at chris@hotelcomply.com.

Question 27

What are the CPRA fines for California hotels?

Accepted Answer

As of 2025, CPRA civil penalties are up to $2,663 per unintentional violation and up to $7,988 per intentional violation (amounts adjust annually with the Consumer Price Index). Because each affected guest can count as a separate violation, a single compliance gap involving thousands of guest records can result in millions in total exposure. Hotels can also face private lawsuits in the event of a data breach, with statutory damages of $107–$799 per guest.

Question 28

Is there a 30-day cure period before fines kick in?

Accepted Answer

No — that protection was eliminated when CPRA took effect on January 1, 2023. The California Privacy Protection Agency (CPPA) can now investigate and impose penalties without giving businesses an opportunity to cure first. This makes proactive compliance documentation significantly more important than it was under the original CCPA.

Question 29

Are hotels actually being fined for CCPA violations?

Accepted Answer

Yes. The California Privacy Protection Agency has ramped up enforcement activity, and hotel chains have appeared in regulatory actions related to loyalty programs, third-party advertising pixels, and inadequate data deletion processes. The CPPA has broad authority to audit businesses proactively — you don't need to wait for a complaint. Having documented compliance with audit-ready evidence is your primary defense.

Question 30

Does a cyber insurance policy protect us from CCPA/CPRA liability?

Accepted Answer

Partially — but insurers are increasingly requiring documented compliance programs before extending coverage or processing claims. A hotel that experiences a data breach without a ROPA, vendor DPAs, and consumer rights workflows may find their insurer citing inadequate security practices. HotelComply's audit pack is designed to satisfy insurer documentation requests and demonstrate a defensible compliance posture.

Question 31

We operate multiple hotel properties. Can HotelComply manage them all?

Accepted Answer

Yes. HotelComply is built with portfolio operators and asset managers in mind. The Compliance Package can map multiple properties, shared vendor relationships, separate compliance records, DSAR queues, and ROPA entries per property. Corporate oversight gets a consolidated view across the portfolio while property-level records remain distinct.

Question 32

Does HotelComply integrate with our Property Management System?

Accepted Answer

HotelComply starts by documenting the systems already in your hotel stack, including PMS, CRS, POS, loyalty, marketing, HR, Wi-Fi, CCTV, and guest messaging platforms. Where direct integrations are available, they can support workflow automation, but the Compliance Package does not require you to replace or disrupt front desk and reservation systems.

Question 33

What is a Vendor DPA and which of our hotel vendors need one?

Accepted Answer

A Data Processing Agreement (DPA) is a contract with any third-party vendor that processes guest personal information on your behalf — your PMS provider, booking engine, loyalty platform, email marketing service, and more. Under CPRA, these contracts must include specific compliance obligations. Without executed DPAs, your vendor relationships may be classified as data 'sales,' triggering additional opt-out requirements. HotelComply's Vendor DPA Hub tracks all vendor agreements and their status.

Question 34

What is DPA verification for hotel vendors?

Accepted Answer

DPA verification is the process of documenting whether a hotel vendor has an executed data processing agreement or equivalent privacy contract in place. HotelComply tracks vendor DPA status from reference-grade classification through hotel-specific verification, helping teams identify which vendor relationships need review.

Question 35

What does the California Privacy Protection Agency look for when auditing a hotel?

Accepted Answer

During an investigation, the CPPA typically requests your privacy notice, consumer rights procedures, ROPA or data inventory, records of DSAR requests and responses, and executed vendor contracts. HotelComply generates an audit pack that compiles all of this documentation into a single, regulator-ready ZIP bundle with a manifest and file checksums — exactly what investigators ask for.

Question 36

How much does HotelComply cost?

Accepted Answer

The HotelComply Compliance Package is $2,500 per property. It covers the diagnostic review, guided discovery, operating record buildout, vendor documentation review, guest privacy request procedures, and audit-ready compliance file for one property. Portfolio pricing is available by inquiry and confirmed during discovery.

Question 37

Does HotelComply replace our need for a privacy attorney?

Accepted Answer

No. HotelComply is a compliance operations and documentation service, not a substitute for legal counsel. We organize records, generate documentation, and keep your operating file coherent. For questions about specific legal exposure, vendor contract language, or enforcement response, you should consult a qualified privacy attorney. HotelComply makes that review easier by giving counsel a complete record set to work from.

Question 38

How quickly can we be compliant after signing up?

Accepted Answer

The property snapshot and Compliance Package intake are built to move efficiently around a focused operating review. The full Compliance Package timeline depends on portfolio size, vendor count, jurisdictions, and how complete your existing contracts and policies are. The goal is to get a defensible foundation documented first, then maintain it through optional ongoing support if your team wants help keeping records current.

Frequently Asked Questions

About HotelComply