Track and Trace for the hospitality sector – Your practical guide on how to achieve this and gain more engaged customers.
Download the full guidance document here or read below:
With just 10 days to prepare Pubs, Bars and Restaurants were told you could reopen from the 4th July subject to stringent social distancing between tables, clear and directional walkways to and from the toilets, regular cleaning and sanitising of toilets, hand basins etc. no live entertainment or live music (for risk of people singing or shouting and spreading vapour), no sitting at the bar area and limited people in the bar area waiting at any one time. However the most challenging potentially to face the industry was the need to ‘track and trace’ and hold customers data so outbreaks of Covid19 can be traced back, customers and staff informed and appropriate self-isolation of those affected to take place.
Now you’re a drink and food venue, not a data house, how do you capture and consistently capture and store such data, how will you brief staff, how will you deal with customers who simply won’t give you their data? Here’s a handy few tips on how to turn this challenge into an opportunity and emerge from lockdown and partial reopening for more engaged and informed data on your customers and visitors and some ideas on how to use this data most effectively.
Making it GDPR Compliant:
The Information Commissioner’s Office have provided some guidance for storing customer data for Track and Trace, but in many ways, these principles can apply to managing all data.
Be Transparent – be honest about how you will use the personal data. If you only intend to use them for Track and Trace, that’s fine, but you then can’t use it for any other purpose. If you want to use it for marketing or letting customers know about your offers, you will need to explain that upfront.
Whatever you do with the data, get consent – you will need the individual’s explicit permission to use the data if you intend to use it for marketing. So, you will need to prove that you have got this consent, should you be challenged later on.
If you are only using this for Track and Trace, in most instances, you will NOT need to get consent from the individual. This is because the technical legal basis for processing is legitimate interest.
The only exceptions are if you are an organisation where the data might be sensitive about the individual (what’s called “special category data” – health, religion, sexuality, etc). For example, a church running an event would be recommended to get consent, because the information collected could be reasonably identified to reveal the individual’s religion.
If you intend to use the data for different purposes (say, newsletters, and marketing offers mailing lists), you will need to get separate, explicit permission before you can use it for each of these reasons.
Only ask for what you need – you should only request information for the minimum of how you want to use it. In most instances, this might be Name and Email (and/or Phone Number); in relation to Track and Trace, you will probably need time of arrival or sitting. If you don’t need anything else, you shouldn’t ask for it.
Store it safely, and keep it only for as long as you need – Your customers are trusting you to keep the data secure, whether you are doing that digitally (via a secure database) or physically (with paper records locked away). It’s vital to do so. And that also extends to how long you keep the data for. If you are storing it for Covid purposes, you only need to store it for three weeks; make sure you delete it at that point.
What data do you need to capture? – For Covid Track and Trace, you will need to capture Name, Contact Details (Phone Number and/or Email address) and time of entry / sitting time.
How is it best to capture and store this data?
Ideally, you could capture this when the customer logs on to your web site, or phones up, to book; this will certainly speed up any queuing on entry, and means your team are capturing this information remotely, thereby reducing physical contact time.
Driving contact via digital would be preferable, as it makes it easier to explain how you intend you use the data, without your team having to explain this. But your staff will also need to be able to explain what the data will be used for.
What systems and software could help you store this data?
To do this physically, you will need a pad of paper and a pen, and a lockable drawer or locker. But digitally, you will need either a database linked to your web site booking system, or a spreadsheet.
How and when can you use this data?
You can use this data according to how you said you would use it when the customer gave you their information and consent. If you said you would add them to the newsletter, you can send them the newsletter. If they said yes to special offers, then it will be that. But you can’t send the newsletter to just a special offers customer.
In terms of Covid Track and Trace, you don’t need consent, but you can only use it for that purpose for as long as it is needed. Legally, you only need to keep this for three weeks (but you must keep it for that long).
How is it best to position it to customers that you need to capture this data?
For anything other than Covid, the legal basis for processing is consent. So the best way of positioning it is by explaining the benefits to them and what they will get in return, because if they don’t provide consent, then you can’t use it.
In terms of Covid Track and Trace, you don’t need permission, but it’s always better to explain why you are gathering information. The benefit for the customer is ensuring that you can keep your customers healthy and your establishment open, and that you are doing the right thing for the community. If they have a problem with that, then you can’t refuse them entry, but you arguably don’t want them as a customer!
For marketing, you can outline the benefits of what additional offers, products and services you can provide them. However, if they don’t want that, again you can’t prevent them from using your services; you can’t make marketing sign-up a perquisite for being a customer. The best thing to do is to give them the best possible customer service, to convince them to change their mind!
Briefing staff and ensuring consistent data capture
Clearly, capturing data consistently is vital at this time; if some of your team are only asking for email address, and others are capturing phone details, you won’t have a clear view about your customers’ interests and permissions. So, it will be important to agree, and to communicate to all your customer-facing teams:
What data you are capturing. This should be kept to a minimum, both for best practice and ease of consistency.
What you intend to do with it, and what the benefits are to the customer; this is especially important for gaining consent.
How regularly you intend to use the data; if you are going to send a monthly newsletter, you will need to have the right level of content to do this. Once you have committed to a customer about your regularity, it’s essential that you keep to it.
How long you will keep it for. Similarly, if you say you will only keep it for a month, you can’t then use it in three months’ time.
How you will share it. It is the individual’s responsibility, not yours, to inform the NHS Track and Trace team that they are displaying symptoms. However, if someone has done so, the Test and Trace team will contact you and ask for the details. You should make sure your team know to check they are genuine, so you don’t inadvertently share data with the wrong people. So you should make sure your teams have a method of checking this, whether this is phoning them back via the helpline, or asking for verification.
