Data responsibilities
Define which party controls each purpose, which providers process information and which system remains authoritative.
Security and data protection
Guest convenience needs visible data boundaries.
FirstConnect is designed to coordinate hotel workflows while preserving guest choice, staff accountability and clearly defined responsibilities across connected providers.
Who controls guest-data decisions?
The hotel and its providers must define processing purposes, notices, access and retention in the applicable arrangements. FirstConnect’s workflow can support guest choice and staff oversight, but configuration alone does not establish legal compliance.
Operating principles
Decide what information moves, who sees it and who acts.
These are design and configuration principles. The active controls and provider responsibilities for a hotel must be confirmed in its agreed implementation.
Access control
Limit staff access according to role, property and operational responsibility.
Consent and preferences
Connect purpose-specific guest choices to eligible communication workflows.
Data minimisation
Request and display only information needed for the approved hotel process.
Workflow history
Retain relevant submissions, approvals, status changes and exceptions according to the agreed policy.
Retention and deletion
Configure retention and deletion responsibilities according to contract, legal basis and property policy.
Provider boundaries
Document PMS, messaging, payment, infrastructure and support providers actually used for an implementation.
Incident and request processes
Establish operating routes for security events and applicable guest data requests.
Scope boundaries
Make the implementation responsibilities explicit.
Property rules and staff checkpoints
Approval levels, access scope, communication eligibility and retention settings depend on property configuration.
Connected providers
Specific PMS, booking, messaging, payment and access connections are reviewed with the property before activation.
Website examples
Operational queues and metrics shown on this site are examples, not live hotel records or achieved results.
Security architecture, hosting, backups, incident procedures and assurance evidence require internal verification before publication as technical commitments.
Available resources
Read the published FirstConnect information.
A public DPA, subprocessor list, cookie policy, responsible-disclosure policy and dedicated security contact are not yet published. Request current materials during a pilot discussion.