Feature · Guest book and GDPR

Your restaurant's guest book, and the GDPR request you can answer in a minute

Sooner or later a guest writes in asking what you hold about them, or asking you to forget them. When every guest is one row in one book, and the row opens a card with the answer on it, that e-mail stops being an afternoon's work.

Tell me when it opens

Your restaurant is responsible for its guests' data; Slotora processes it for you. These are the tools, not legal advice.

The book itself

Everyone who has booked, been booked by phone, or come in from your old system's file, once each.

Filter it the way you think

By tag — regular, VIP, corporate, your own — by how many visits, by when they last came, by no-shows, and by whether they said yes to hearing from you. Or search a name.

Export a list as CSV

The list you filtered goes out as a spreadsheet file: the regulars for a thank-you card, the corporate bookers before December. Exporting is for the owner or a manager.

A mailing list that is allowed

The marketing export holds only the guests who said yes. A name from an old file does not become a yes by being imported, and Slotora sends no marketing of its own.

A name opens the card

Click a guest in the book and their card opens: visits, no-shows, late cancellations, the allergies and notes your staff wrote. For the owner or a manager, the card also carries two more buttons.

Download this guest's data

One file with what Slotora holds about that person — their details and their bookings — to include in your reply to a subject access request, alongside anything you hold elsewhere and the information your privacy notice gives.

Erase this guest

For a guest who asks to be forgotten, when you have decided the request applies. One guest at a time, by a person with the authority to decide it.

The same card opens from any of the guest's bookings. A host-stand login sees the card without the guest's e-mail and phone, and without these two buttons.

What the ICO says you owe the guest

From the Information Commissioner's Office guidance for UK organisations, read on 16 October 2026:

A subject access request must be answered without undue delay and within one month of receiving it; the ICO allows up to two further months when a request is complex or the person has made several.
In most cases you cannot charge a fee for it.
It can arrive verbally or in writing, social media included, and the guest does not have to use any particular words or call it a subject access request.
The right to erasure is not absolute: it applies only in certain circumstances, such as when the data is no longer needed or the guest withdraws a consent you relied on. You also have one month to respond, and it too can be asked for verbally.

For a restaurant in Ireland the same rights come from the GDPR itself. Whether a particular request applies is your decision as the controller; if it is not clear-cut, ask someone who can advise on your case.

The request, start to finish

Tuesday morning: the message
A guest sends a direct message on social media: what do you have on me? It counts, even without the words “subject access”. Note the date; the month starts now.
Find them
The guest book, search the surname, check the phone number matches the person asking. Two Sarah Jameses are two cards; make sure you have the right one.
Download and send
Open the card, download the data, send it to the guest the way you would send anything private. Keep a note that you did.
If they then ask to be forgotten
Decide whether it applies — a booking for next week is a reason to wait until after it — and erase them from the same card.

Questions about the guest book

Who can export the guest book?

The owner and managers. A host-stand login works the floor and the guest cards without the export, the download or the erasure.

Does Slotora e-mail my guests a newsletter?

No. It keeps track of who said yes and gives you that list as a file; what you send, and with which tool, is yours.

Can the guest download their own data?

Not by themselves. The request comes to the restaurant, and the owner or a manager answers it from the card, because the restaurant is the controller.

Do allergy notes count as personal data?

Yes, and as health information they deserve care. On the card they are written by your staff — a guest who mentions one in the online booking's note has it on that booking only, until someone moves it across — and they are part of what the guest's download contains.

Sources

One book, from the first booking

We e-mail you once, when Slotora for restaurants opens in the UK or Ireland.