Best Practices for Tours and Activities: Policies and Processes

In our GDPR series, we explore the impact that these new regulations will have on tour and activity operators.

Best Practices for Tours and Activities GDPR 2018 Series:

Part 1: GDPR and the Travel Industry

Part 2: Data Collection and Privacy

Part 3: Marketing Consent

Part 4: Marketing Lists

Part 5: Policies and Processes

Part 6: Data Retention

Part 7: Workforce Data

Part 8: Privacy by Website Design

The recent GDPR laws that went into effect in May 2018 have sent many business owners into a tailspin, trying to figure out what they need to do in order to be in compliance. This is particularly true in the travel industry, since businesses both within the European Union and those who do business with European Union residents are going to need to accommodate these latest regulations.

Noting the significance of the GDPR, Rezdy has launched a blog series covering every topic that tour and activity operators will need to consider in regards to the new set of laws. Not only will tour and activity operators have to update their policies and processes moving forward, but they also need to evaluate those that are currently in existence.

What are Policies and Processes?

All existing and future policies and processes for your tour and activity company must be in compliance with the GDPR, which went into effect on May 25. In particular, your data protection policies must be reviewed in order to make sure that all of your customers have affirmatively consented to having their data collected and subsequently used by your business. Your process for collecting and utilizing data also must be in compliance. In most cases, you are going to have to adjust your existing policies and processes in order to accommodate the new regulations.

Best Practices for Creating Compliant Policies and Processes

Audit existing databases and be prepared to explain how it was collected and what you utilize it for. Any data that was collect without consent may need to be deleted in order to stay compliant with the GDPR. You may have to retroactively seek permission to continue to use the data — and this must be done with an opt-in agreement. You cannot assume that the client wants their data collected, rather they have to affirmatively select that option on their own accord.
Create a data protection policy that is GDPR compliant, and make sure that the policy is distributed to all customers at the time of booking. Your data protection policy needs to provide your travelers with confidence that you are not misusing or selling the personal data that you collect from them online.
Be transparent about your data collection and usage. Most customers have become accustomed to personalized promotions and opportunities. As long as your customers are aware that you will be using their data to customize their experience at your tour and activity company, they will be more likely to opt-in to your data collection program and allow you to utilize their personal information and data.

The GDPR laws may seem overwhelming, but you don’t necessarily have to do an overhaul of your entire tour and activity business. Continue to follow this Rezdy blog series in order to learn more about how GDPR will impact every aspect of your business, and how you can adjust in order to stay compliant with the new regulations.