Interactive sample

Sample Compliance Package

Explore the same CCPA / CPRA Audit Pack sections as the live export — Cover through Supporting Documents — in an interactive teaser with fictional Bayview Sample Hotel data. Scores and section order match the real pack, not PDF page screenshots.

Interactive Audit PackBayview sample · 67% posture

Start discovery →

hotelcomplyAudit Pack · Bayview Sample

1 / 11Cover

Jump to section

CCPA/CPRA Audit Pack

CCPA / CPRA Audit Pack

Bayview Sample Hotel

1200 Harbor Drive, San Diego, CA 92101

Contact: [email protected]
Reporting window: Last 90 days
Pack ID: sample-bayview-v1
Generated: Aug 15, 2026

Cover page with property scope, contact fields, reporting window, and operational disclaimer — the same opening sheet as the live export.

Fictional sample for product demonstration. Not a legal opinion and not based on a real property.

Section 1 of 11Cover

Start discovery

No login required to explore this sample. Book discovery to confirm scope for your hotels.

Sample · fictional property · not legal advice

This is the operating-record density ownership expects.

Three full-fidelity sample pages from the CCPA / CPRA Audit Pack — Executive Summary, Data Mapping / ROPA, and Vendor DPA register — built on the same structure as the live export. Interactive teaser above is the map; these pages are the binder.

Compliance Package · $2,500 per property

See fuller sample →

hotelcomply · CCPA / CPRA Audit Pack

Executive Summary

Bayview Sample Hotel · Page 1 of 3 · excerpt

SAMPLE

Sample · fictional property · not legal advice

Operational posture for the reporting window (Last 90 days). Scores and section order match the live HotelComply export structure. Fictional property data only — not a legal opinion.

Posture

67%

Checks

30/45

Open gaps

Weighted

Section readiness (I–V)

Traffic-light rollup

Section	Checks	Score	Status
Section I — Business Applicability	4/5	80%	green
Section II — Data Mapping	6/10	60%	yellow
Section III — External Disclosures	5/7	71%	yellow
Section IV — Consumer Rights (VCR)	7/11	64%	yellow
Section V — Vendor Management	8/12	67%	yellow

Priority findings (excerpt)

HighSection II · Data MappingCal. Civ. Code § 1798.100(c)
Document retention periods for each PI category collected at booking and check-in.
Missing retention schedules leave the property unable to show purpose limitation during an audit.
Owner: Director of Rooms
HighSection V · Vendor ManagementCal. Civ. Code § 1798.140(ag)
Execute DPAs for service providers that process guest PI on behalf of the hotel.
Vendors without a DPA undermine service-provider treatment and sale/share analysis.
Owner: General Manager
MediumSection IV · Consumer RightsCal. Civ. Code § 1798.130
Demonstrate 45-day fulfillment workflow for access and deletion requests.
Without a tracked queue, late responses create statutory exposure.
Owner: Front Office Manager

Fictional sample for product demonstration. Not a legal opinion and not based on a real property. Pack ID sample-bayview-v1. Generated Aug 15, 2026. HotelComply is an operational documentation service, not a law firm.

hotelcomply · CCPA / CPRA Audit Pack

Section II — Data Mapping / ROPA

Bayview Sample Hotel · Page 2 of 3 · Section II excerpt

SAMPLE

Sample · fictional property · not legal advice

Processing activities mapped to collection points, PI categories, recipients, and retention — operating-record density ownership and counsel can review in a Records of Processing binder excerpt. Cites reference Cal. Civ. Code §§ 1798.100, 1798.140.

Activities shown

8of 8

§ 1798.100(c) — purpose limitation / retention§ 1798.140 — definitions (PI / sensitive PI / sale)

Guest reservation & check-in
Front Office · Contract performance / CPRA operational purpose
Purpose
Fulfill stays and communicate itinerary changes
Categories
Identifiers, Commercial information, Internet activity
Sources → Recipients
Booking engine, PMS, Front desk → Opera Cloud PMS, Email ESP
Retention: 24 months after departure (draft)Sale/share: NoSensitive PI: No
Loyalty enrollment
Sales & Marketing · Consent
Purpose
Manage membership benefits
Categories
Identifiers, Commercial information
Sources → Recipients
Website form → CRM platform
Retention: Until membership closed + 12 monthsSale/share: NoSensitive PI: No
Payment authorization & folio settlement
Front Office / Accounting · Contract performance / Cal. Civ. Code § 1798.140(e)(1)
Purpose
Process deposits, incidentals, and final settlement
Categories
Identifiers, Commercial information, Financial information
Sources → Recipients
PMS, Payment gateway → Payment gateway, Opera Cloud PMS
Retention: 7 years (tax / chargeback window)Sale/share: NoSensitive PI: Yes
Guest Wi-Fi access logging
IT / Engineering · CPRA operational purpose / security
Purpose
Provide network access and investigate abuse
Categories
Identifiers, Internet activity, Geolocation
Sources → Recipients
Wi-Fi portal → Guest Wi-Fi Portal
Retention: 90 days (draft — confirm with counsel)Sale/share: NoSensitive PI: No
Marketing email & SMS campaigns
Sales & Marketing · Consent
Purpose
Send offers and property updates to opted-in contacts
Categories
Identifiers, Commercial information, Inferences
Sources → Recipients
Website form, Check-out offer, CRM → Email ESP, SMS platform
Retention: Until opt-out + 24 months inactivitySale/share: YesSensitive PI: No
CCTV / premises security monitoring
Security / Engineering · CPRA security / Cal. Civ. Code § 1798.140(e)(2)
Purpose
Protect guests, staff, and property
Categories
Identifiers, Biometric information (limited), Audio/visual
Sources → Recipients
On-property cameras → Internal security store
Retention: 30 days unless incident holdSale/share: NoSensitive PI: Yes
Employee HR & payroll administration
Human Resources · Employment / Cal. Civ. Code § 1798.145(m) (limited)
Purpose
Hire, pay, and manage workforce
Categories
Identifiers, Employment information, Financial information
Sources → Recipients
HRIS, Payroll provider → HRIS, Payroll provider
Retention: Employment + 4 yearsSale/share: NoSensitive PI: Yes
Guest privacy request (DSAR) fulfillment
Privacy / Front Office · Cal. Civ. Code §§ 1798.105, 1798.110, 1798.120, 1798.130
Purpose
Verify and fulfill access, deletion, and opt-out requests
Categories
Identifiers, Commercial information, Internet activity
Sources → Recipients
Request portal, Email intake → Internal privacy workflow, Opera Cloud PMS
Retention: 24 months after closureSale/share: NoSensitive PI: No

Activity	Dept	Purpose / basis	PI categories	Sources	Recipients	Retention	Sale	SPI
Guest reservation & check-in	Front Office	Fulfill stays and communicate itinerary changes Contract performance / CPRA operational purpose	Identifiers, Commercial information, Internet activity	Booking engine, PMS, Front desk	Opera Cloud PMS, Email ESP	24 months after departure (draft)	No	No
Loyalty enrollment	Sales & Marketing	Manage membership benefits Consent	Identifiers, Commercial information	Website form	CRM platform	Until membership closed + 12 months	No	No
Payment authorization & folio settlement	Front Office / Accounting	Process deposits, incidentals, and final settlement Contract performance / Cal. Civ. Code § 1798.140(e)(1)	Identifiers, Commercial information, Financial information	PMS, Payment gateway	Payment gateway, Opera Cloud PMS	7 years (tax / chargeback window)	No	Yes
Guest Wi-Fi access logging	IT / Engineering	Provide network access and investigate abuse CPRA operational purpose / security	Identifiers, Internet activity, Geolocation	Wi-Fi portal	Guest Wi-Fi Portal	90 days (draft — confirm with counsel)	No	No
Marketing email & SMS campaigns	Sales & Marketing	Send offers and property updates to opted-in contacts Consent	Identifiers, Commercial information, Inferences	Website form, Check-out offer, CRM	Email ESP, SMS platform	Until opt-out + 24 months inactivity	Yes	No
CCTV / premises security monitoring	Security / Engineering	Protect guests, staff, and property CPRA security / Cal. Civ. Code § 1798.140(e)(2)	Identifiers, Biometric information (limited), Audio/visual	On-property cameras	Internal security store	30 days unless incident hold	No	Yes
Employee HR & payroll administration	Human Resources	Hire, pay, and manage workforce Employment / Cal. Civ. Code § 1798.145(m) (limited)	Identifiers, Employment information, Financial information	HRIS, Payroll provider	HRIS, Payroll provider	Employment + 4 years	No	Yes
Guest privacy request (DSAR) fulfillment	Privacy / Front Office	Verify and fulfill access, deletion, and opt-out requests Cal. Civ. Code §§ 1798.105, 1798.110, 1798.120, 1798.130	Identifiers, Commercial information, Internet activity	Request portal, Email intake	Internal privacy workflow, Opera Cloud PMS	24 months after closure	No	No

Excerpt only — full packs include additional activities, systems maps, and retention schedules. Sample · fictional property · not legal advice.

hotelcomply · CCPA / CPRA Audit Pack

Section V — Vendor DPA register

Bayview Sample Hotel · Page 3 of 3 · Section V excerpt

SAMPLE

Sample · fictional property · not legal advice

Service-provider and third-party inventory with DPA execution status, review dates, and sale/share flags — the register counsel asks for under Cal. Civ. Code § 1798.140(ag) (service provider) and related CPRA contracting expectations.

DPA on file

Gaps

Opera Cloud PMS
Service Provider · PMS
DPA
Executed: Nov 2, 2025Review: Nov 2, 2026Sale/share: No
Cloudbeds Booking
Service Provider · Booking engine
Missing
Executed: —Review: —Sale/share: No
DPA requested — awaiting countersignature
Guest Wi-Fi Portal
Service Provider · Network
Missing
Executed: —Review: —Sale/share: TBD
Confirm processor role vs. joint controller
Stripe Payments
Service Provider · Payments
DPA
Executed: Aug 14, 2025Review: Aug 14, 2026Sale/share: No
PCI SAQ on file (sample)
Mailchimp ESP
Service Provider · Email marketing
DPA
Executed: Sep 1, 2025Review: Sep 1, 2026Sale/share: No
Marketing consent flags synced weekly
Salesforce Service Cloud
Service Provider · CRM
DPA
Executed: Jun 20, 2025Review: Jun 20, 2026Sale/share: No
Google Analytics 4
Third Party · Analytics
DPA
Executed: Oct 5, 2025Review: Oct 5, 2026Sale/share: Yes
Sale/share analysis — GPC honored on sample site
ADP Workforce Now
Service Provider · HR / Payroll
DPA
Executed: Apr 12, 2025Review: Apr 12, 2026Sale/share: No
Twilio SMS
Service Provider · Guest messaging
Missing
Executed: —Review: —Sale/share: No
DPA gap — prioritize before campaign launch
Assa Abloy Visionline
Service Provider · Door locks / access
DPA
Executed: Dec 1, 2025Review: Dec 1, 2026Sale/share: No

Vendor	Role	Category	DPA	Executed	Review	Sale/share	Status	Notes
Opera Cloud PMS	Service Provider	PMS	On file	Nov 2, 2025	Nov 2, 2026	No	compliant	—
Cloudbeds Booking	Service Provider	Booking engine	Missing	—	—	No	needs review	DPA requested — awaiting countersignature
Guest Wi-Fi Portal	Service Provider	Network	Missing	—	—	TBD	needs review	Confirm processor role vs. joint controller
Stripe Payments	Service Provider	Payments	On file	Aug 14, 2025	Aug 14, 2026	No	compliant	PCI SAQ on file (sample)
Mailchimp ESP	Service Provider	Email marketing	On file	Sep 1, 2025	Sep 1, 2026	No	compliant	Marketing consent flags synced weekly
Salesforce Service Cloud	Service Provider	CRM	On file	Jun 20, 2025	Jun 20, 2026	No	compliant	—
Google Analytics 4	Third Party	Analytics	On file	Oct 5, 2025	Oct 5, 2026	Yes	needs review	Sale/share analysis — GPC honored on sample site
ADP Workforce Now	Service Provider	HR / Payroll	On file	Apr 12, 2025	Apr 12, 2026	No	compliant	—
Twilio SMS	Service Provider	Guest messaging	Missing	—	—	No	needs review	DPA gap — prioritize before campaign launch
Assa Abloy Visionline	Service Provider	Door locks / access	On file	Dec 1, 2025	Dec 1, 2026	No	compliant	—

Statutory anchor: Cal. Civ. Code § 1798.140(ag) (service provider) · sale/share analysis under §§ 1798.140(ad)–(ah). Sample · fictional property · not legal advice.

Ready when ownership asks where the records are.

$2,500 per property · scope confirmed on discovery

See fuller sample →