Zum Hauptinhalt springen
Alle Artikel
OperationsJul 15, 2026

Which guest emails should a restaurant or hotel automate first?

The first guest emails a restaurant or hotel should automate are the booking confirmation and the reminder. They are service messages, so they can go to every guest who books without marketing consent, and they save staff from answering the same questions by phone. Next come the pre-arrival email, a post-visit feedback request, a lapsed-guest win-back, birthday or anniversary emails and, where you sell memberships, renewal notices.

The order matters for a legal reason too. Most of the later emails are marketing, and under the Privacy and Electronic Communications Regulations (PECR) a marketing email to an individual needs their consent or must meet the conditions of the soft opt-in.

What is the difference between a service message and a marketing email?

The ICO describes service messages as non-promotional messages sent for administrative or customer service purposes, such as confirming an appointment. A neutral tone does not settle the question by itself. If a service message contains promotional content, such as an upgrade offer or a discount for booking again, the ICO treats it as direct marketing even when promotion is not its main purpose.

For marketing emails to individuals, the ICO's guidance on direct marketing using electronic mail, updated in April 2026, says you need consent unless you meet every requirement of the products and services soft opt-in. You must have collected the person's details yourself while selling or negotiating to sell them something, you can only market your own similar products and services, and you must have given them a simple way to opt out when you collected their details and in every message since. In the ICO's own example, a restaurant that collects phone numbers when guests book a table on its website meets the first of those requirements.

Booking confirmations and reminders

A confirmation should arrive straight after booking and carry everything a guest needs to turn up: date, time, party size or room type, address, the cancellation policy, any deposit or card guarantee terms and a link to change or cancel. A reminder a day or two before arrival gives guests an easy way to cancel, which frees the table or room in time to resell it.

Keep both free of promotions. A line inviting guests to add a bottle of champagne turns the whole email into marketing, which then needs consent or the soft opt-in for every recipient.

What should a pre-arrival email include?

For hotels, the pre-arrival email is the next most useful automation: check-in times, parking, directions, any forms to complete and a way to tell you about dietary needs or the reason for the stay. Practical arrival information is service content. Selling spa treatments, dinner reservations or room upgrades in the same email is marketing, so either send that version only to guests you can market to, or put the sale in a separate email for that audience.

Should you automate post-visit feedback emails?

Yes, if someone reads the replies. A short request for feedback the morning after a visit catches problems while they can still be put right. The ICO's guidance says contacting people for genuine market research is not direct marketing, while research messages that include promotional material are. Keep the email about the visit: a feedback request that adds a discount for the next booking falls on the marketing side. Route poor scores to a manager so somebody replies personally.

When should you send a lapsed-guest email?

A win-back email goes to guests who used to come regularly and have stopped. Define lapse by each guest's normal pattern, so a monthly regular who has not visited for three months qualifies and a once-a-year guest does not; our guide to customer segmentation shows how to set that window. Keep it to one or two messages from a named person. Every win-back email is marketing, so the consent rules apply.

Birthday and anniversary emails

Birthday emails need a date of birth, or at least a day and month, collected for that purpose. If the email is all you use it for, ask only for the day and month. A birthday email with an offer is marketing, so send it only to guests who have agreed to hear from you or who fall within the soft opt-in.

Membership renewal and payment emails

For clubs, gyms and spas, renewal notices sit on the line between service and marketing. The ICO gives automatic renewal notices that are worded neutrally and do not encourage customers to renew as an example of messages that may not be direct marketing. A renewal email that pushes an upgrade or a discount for renewing early is marketing.

Failed payment emails work as service messages when they stick to the facts: what failed, what the member needs to do and by when. In the ICO's own example, a gym calls a member because their monthly payment has not worked, which is a service call; if the gym also uses the call to promote personal training, it becomes direct marketing.

How Tiquo automates guest emails

In Tiquo, booking notifications are switched on for each booking flow. The toggles cover the booking confirmation, an appointment reminder, a cancellation email and a follow-up email, and a confirmation can carry tickets and QR codes, a wallet card and a calendar attachment. Because a venue can run several booking flows, a public booking page and a members' booking link can have different notifications switched on.

Tiquo's marketing automations handle the rest. A workflow starts from a trigger such as a new customer, a completed booking, a product order or a period of inactivity, then sends emails from your existing templates, waits days or weeks between steps and branches on conditions such as spend level or booking activity. Pre-built flows cover a welcome series, booking follow-up, win-back and product follow-up, and each automation stays a draft until you set it live.

Campaign emails are built from templates with personalisation such as the customer's name and booking details, and can be sent straight away or scheduled up to 30 days ahead. Marketing emails go only to customers who have opted in, an unsubscribe updates the customer's consent setting automatically, and when several lists or segments are selected for one send, duplicates are removed. The marketing dashboard reports emails sent, open rate, click rate and unsubscribes.

For birthday and anniversary emails, customer profiles have a date of birth field, and a custom date parameter can hold an anniversary.

© 2026 Tiquo. "Tiquo" und das Tiquo-Logo sind eingetragene Marken von Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

Eine Plattform für Hotels, Spas, Kurse, Veranstaltungen und Restaurants.

Tiquo Ltd
London, Vereinigtes Königreich

LinkedInTop Performer Spring

Wir verwenden Cookies

Sie können Cookies für Analysen und Werbung akzeptieren oder ablehnen. Wenn Sie diesen Hinweis schließen, werden diese Cookies abgelehnt.

Mehr erfahren