RCM
New platform
Booking engine, channel manager, application, CRM or loyalty program.
HOTELS · TOURISM · BOOKING
Welcome guests.
Welcome guests.
Control their data.
A hotel, riad, agency or tourist operator receives data even before the arrival of the traveller: booking, preferences, composition of the stay, payment, special requests and exchanges with a platform. To the reception are added identity documents, access to rooms, video surveillance, Wi-Fi, catering, transport and loyalty.
ReservationsIDENTIFYPLATEFORMSMARKETING
Your activity,
its real flows.
The international chain is structuring. Direct site, online agency, channel manager, payment provider, CRM, headquarters, concierge and partners can act according to different roles. It is necessary to identify who decides on uses, who executes instructions and where the data is accessible.
RCM transforms this journey into mapping, retention rules, clauses, controls and procedures. Police, tourism, consumer or tax obligations are not audited in this mission unless expressly mentioned and intervened by the competent specialist.
Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.
WHEN TO COME
Triggers
Triggers
most common.
A mission may begin before a launch, during a negotiation or after a gap appears.
European customers
Campaigns, direct booking or European group involving GDPR and transfers.
On-site equipment
Wi-Fi, video surveillance, access control or connected services to qualify.
FROM THE FIELD TO EVIDENCE
A journey
A journey
in four stages.
Decisions and limits are made visible at each stage.
Follow the traveller
Search, reservation, preparation, reception, stay, departure and loyalty.
Identify the actors
Hotel, platform, agency, payment, headquarters, service provider and local partner.
Set the rules
Information, access, retention, sharing, contracts and transfers.
Check
Site, forms, receipt, suppliers, requests and incidents.
SECTORAL RISKS
What the documents
What the documents
Don't always show.
These situations are points of analysis, not automatic conclusions.
Identity copy
Excessive collection, too broad access or conservation without clear rules.
Sensitive preferences
Health, religion, nutrition or mobility may reveal specific information.
Multiple platforms
A modification or deletion must sometimes be coordinated between several systems.
Wi-Fi and video surveillance
These processing activities have purposes, information and durations distinct from the reservation.
Post-stay marketing
The commercial relationship does not allow all uses or all trackers.
Group transfers
Seat, support or foreign platform can access data from several countries.
OPERATIONAL CONTROLS
Measures that
Measures that
teams can apply.
Each check must have a responsible person, frequency and proportionate proof.
Map the stay
Data and actors from reservation to loyalty.
Limit documents
Justified collection, restricted access, protected storage and planned deletion.
Separate Purposes
Reservation, obligation, security, customization and marketing clearly distinguished.
Supervise the platforms
Roles, contracts, synchronizations, country, support and rights management.
Inform on site
Mentions adapted for reception, Wi-Fi, video surveillance and specific services.
Prepare requests
Multi-system search, verification, secure response and coordination with partners.
DELIVERY
What RCM
What RCM
Leave it to your teams.
The final scope depends on maturity, risks and elements already available.
Traveler’s route map
Collection points, systems, partners, uses and destinations.
Hotel register
Reservation, identity, stay, security, Wi-Fi, marketing and HR.
Information pack
Site, reservation, reception, Wi-Fi and video surveillance.
Platform review
OTA, channel manager, payment, CRM, support and service providers.
Conservation policy
Rules by data, purpose, system and event of departure.
Compliance plan
Operational priorities for management, reception, marketing and IT.
TWO FRAMES
GDPR and law 09-08,
GDPR and law 09-08,
I didn't confuse them.
The same activity may fall within both frameworks for different reasons.
GDPR
Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.
Law 09-08
Treatment in Morocco, rights, security and formalities of declaration or authorization.
International flows
Access, hosting, recipients, mechanism, context and additional measures.
Evidence
Contracts, registers, decisions, controls, training, incidents and actions followed.
INTERVENTION FORMATS
Start small.
Start small.
Maintain if necessary.
The amounts are confirmed after scoping; no fictitious pricing is published.
Starting point
Targeted interviews, review of available elements, major risks and sectoral roadmap.
Fixed price · after scopingPriority base
Agreed deliverables, corrections, review meeting and operational transfer to internal managers.
From — on estimateContinuous management
Volume, deadlines, meetings, controls, new projects and contract overruns.
Subscription · on quote
RESPONSIBILITIES AND LIMITS
Advise, structure
Advise, structure
and advance.
RCM provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.
- Penetration tests, forensic investigations and certifications are carried out by competent experts.
- Reserved legal consultations and litigation are directed to a lawyer.
- Sectoral regulations excluding data protection remain outside the scope unless expressly stated.
FREQUENTLY ASKED QUESTIONS
Specific responses.
Specific responses.
Contextualized decisions.
These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.
Can we keep a copy of the passport of all customers? −
The necessity, basis, useful data, access and duration must be analyzed precisely. Widespread operational practice alone does not constitute justification. RCM helps distinguish mandatory information, internal uses and copies that require special vigilance.
Who is responsible for the data collected by a booking platform? +
The roles depend on the goals and decisions of each actor. The platform can act for its own needs and transmit information necessary for the stay, while the hotel then decides on certain uses. The contract and actual background should be reviewed rather than applying a single qualification.
Can we use the guest's address to send post-stay promotions? +
The answer depends on the channel, the context, the relationship, the information given and the applicable law. The establishment must separate the messages necessary for the stay from the commercial campaigns, record the relevant choices and offer a simple way to object.
Is video surveillance part of the same processing as booking? +
No, it generally meets a distinct purpose, scope, recipients, duration and measures. It requires its own analysis, visible information and, where applicable, the applicable formalities. Access to images must be strictly controlled.
How do I handle a deletion request received via an OTA? +
It is necessary to identify the systems controlled by the hotel, the obligations preventing certain deletions, the data coming from the platform and the partners to contact. The response should explain what was done and what should be retained, with a record of the decision.
Does RCM cover all tourist and hotel obligations? +
No. RCM handles data protection within the agreed scope. Police rules, traveler records, taxation, classification, consumption or other sectoral obligations must be confirmed separately with the competent advice.
Your sector deserves A concrete scoping.
Present your tools, data, customers, suppliers, countries and deadlines. RCM will indicate the first useful perimeter.
Scoping the mission →