Redacted sample report

Hotel Vendor Privacy Risk Report

This sample shows how hotelcomply organizes vendor exposure, documentation status, ROPA impact, guest privacy request considerations, and practical follow-up.

HotelRedacted hotel group

Portfolio8 properties / 3 states

Vendors reviewed20

Source reviewMay 2026

Important notice

This redacted example demonstrates format and depth. It does not describe a real customer's full vendor stack and is not legal advice, a compliance determination, or a substitute for counsel review. Vendor practices and documentation change; current terms and customer-specific agreements must be verified.

Executive summary

Prioritize the vendors and evidence that need review first.

The sample review covers vendor category, likely guest or employee data exposure, documentation availability, guest privacy request considerations, ROPA impact, tracking relevance, and recommended follow-up.

Priority review11

Elevated exposure7

Standard review2

DPA verification6

Recommended actions

Five actions from the sample review.

Review DPA status for priority PMS, CRS, payment, analytics, CRM, and guest technology vendors.

Confirm account-level acceptance of data processing terms for analytics and advertising vendors.

Request documentation where current public or customer-specific terms are unavailable.

Map each vendor to the relevant reservation, payment, communications, marketing, and analytics ROPA activities.

Retain confirmed agreements, screenshots, vendor responses, and review notes as evidence.

Vendor priority ranking

Example review register

#	Vendor	Category	Exposure	Sample documentation note
1	Oracle Opera Cloud	PMS / CRS	Priority review	Public DPA located; customer execution should be verified
2	Sabre SynXis	PMS / CRS	Priority review	DPA available upon request
3	Shift4 Payments	Payments	Priority review	Public processing addendum located
4	Adyen	Payments	Priority review	DPA available upon request
5	Google Analytics (GA4)	Analytics	Priority review	Account portal acceptance requires verification
6	Meta Ads	Marketing	Priority review	Classification depends on configuration
7	HubSpot	Marketing / CRM	Priority review	Public DPA located; integrations require review
8	Cloudbeds	PMS / CRS	Priority review	Marketplace integrations require review
9	SevenRooms	Guest engagement	Priority review	Public DPA located
10	Canary Technologies	Guest technology	Priority review	DPA available upon request
11	Mews	PMS / CRS	Priority review	Public processing terms located
12-20	Stripe, Revinate, OTA channels, Medallia, Cendyn, TravelClick, Duetto, Mailchimp, Salesforce	Payments, marketing, CRM, distribution	Elevated or standard review	Verify terms against actual modules, configuration, and property agreements

Documentation notes reflect the sample's May 2026 source review and must not be treated as current vendor determinations.

Example findings

What a vendor finding contains

Oracle Opera Cloud

PMS and CRS systems may hold reservation details, stay history, preferences, folio information, payment tokens, and operational notes.

Verify accepted processing terms.
Document export, deletion, and anonymization paths.
Link the vendor to reservation and stay ROPA activities.

Google Analytics (GA4)

Analytics configuration may affect tracking, advertising, opt-out, privacy notice, and ROPA review.

Confirm account-level terms.
Record enabled advertising features.
Document relevant consent and opt-out behavior.

Revinate

Guest CRM and email functions may involve profiles, stay history, engagement, survey responses, and marketing preferences.

Confirm which modules the agreement covers.
Document guest export and deletion steps.
Map communications and marketing activities.

Compliance Package path

Turn the review into documented operating records.

The $2,500 per-property Compliance Package prepares the confirmed assessment, ROPA records, vendor inventory, guest privacy request procedures, data-flow map, and branded Compliance Pack. Portfolio pricing is confirmed during discovery.

Request a property snapshot