Hospitality: safely destroying receipts, bookings and staff records
A restaurant, cafe or hotel runs on hospitality, but behind the scenes a pile of sensitive records builds up. Bookings with names and phone numbers, till receipts and daily statements, staff files for a rotating team of seasonal workers and CCTV footage of the premises. Each one is data that falls under the GDPR. This guide shows which hospitality records are in play, how long you keep them and how to destroy them safely.
Which records does a hospitality business hold?
Hospitality processes more personal data than many owners realise. An overview of what is in play, with the relevant period.
| Record | Retention period | Note |
|---|---|---|
| Till receipts and daily statements | 7 years (tax) | Often thermal paper |
| Bookings with name and details | Briefly, until handled | Personal data |
| Staff files, payroll | 7 years after employment | Many seasonal workers |
| Copy of ID document | 5 years | Especially sensitive |
| Supplier invoices | 7 years (tax) | Part of the records |
| CCTV footage | 4 weeks standard | Longer only on an incident |
| Allergy and guest preferences | While relevant | Sometimes health data |
The 7-year tax period and the staff side are explained in GDPR requirements for SMEs and destroying a personnel file.
The points to watch in hospitality
Thermal till receipts
Till receipts and card slips are often thermal paper. They contain transaction data and do not belong loose in the bin or with the waste paper. Read more about these media in thermal paper, receipts and boarding passes.
A lot of rotating staff
Hospitality works with seasonal, on-call and agency staff. That means many short-lived staff files with ID copies and payroll data. For the agency side there is a separate approach, see ID copies and payroll at the staffing agency.
CCTV footage
Many venues have cameras against theft. As a rule you keep footage 4 weeks, longer only on a concrete incident. Read how to record that in CCTV footage, retention and destruction.
How do you destroy hospitality records?
The practical approach is a collection in four steps.
- Collection point. Gather expired receipts, booking lists and old staff documents in a closed bin, away from the guest area.
- Check the period. Keep financial documents 7 years, ID copies 5 years and ordinary bookings briefly. The rest can go.
- Have it collected. Your material is collected and destroyed confidentially to DIN 66399 P-4 or P-5.
- Certificate. You receive a certificate of destruction for your GDPR file.
An annual clear-out, for example after the high season, keeps the records manageable. What it costs is in what does archive destruction cost.
Have your hospitality records destroyed?
We collect your receipts, booking lists and staff files and destroy them confidentially, with a certificate. No call-out charge within 20 km of Amsterdam, no contract.
Request a quoteFrequently asked questions
Do booking details fall under the GDPR?
Yes. A booking with a name, phone number or email is personal data. Do not keep booking lists longer than necessary and destroy them confidentially.
How long must I keep till receipts and daily statements?
As part of your financial records they fall under the 7-year tax retention obligation. After that they may be destroyed.
Can I just throw away staff files of seasonal workers?
No. Payroll data you keep 7 years, an ID copy 5 years and other documents 2 years after the employment ends. After that you destroy them confidentially.
How do I destroy thermal till receipts?
Thermal paper is shredded like ordinary paper. It is kept separate from the recycling stream due to the coating. We process it in the same collection.
Do I get a certificate for my records?
Yes. After every collection you receive a certificate of destruction with the date, quantity and DIN level for your GDPR file.
Conclusion
Hospitality processes more personal data than it seems, from bookings to staff files and CCTV footage. The rule is simple. Keep what is needed for tax or employment law and destroy the rest carefully. A fixed clear-out after the season, with a certificate as proof, keeps your venue GDPR-compliant without hassle.
Want your hospitality records collected? Request a quote via desnipperaar.nl or read how to have paper shredded. Within 5 minutes you have a fixed price.