2026 review · 9 platforms · restaurants, barbers & salons
Your customer data on booking platforms: who really controls it?
A review of the terms, privacy materials and data processing agreements of nine booking platforms used by restaurants, barbers and salons in Europe. It answers three questions:
- Who controls the customer relationship?
- Who may use customer data for independent commercial purposes?
- What changes when a booking tool also operates a consumer marketplace?
Get the full report
The 11-page PDF with the comparison, the sources and the 15-control checklist. Free, by email.
On its way.
We’ve sent the report to . Can’t wait? It’s right here.
Download the PDF (11 pages, 348 KB)We couldn’t send it just now.
Here it is directly. For the free platform check, write to hello@one-site.biz.
Download the PDF (11 pages, 348 KB)- Business-centred
- Dual role
- Marketplace-led
← You hold the relationshipThe platform holds one too →
The short answer
Ownership is not enough. The material question is whether the provider only processes merchant data on documented instructions, or also builds and controls an independent consumer relationship.
“You own your data” is not the test. The test is whether the platform only processes your customer data on your documented instructions, or also builds its own relationship with the same customer.
Phorest, ResDiary and Zenchef present the clearest business-centred models in the reviewed material.
Quandoo, Treatwell and Fresha play a dual role: processor for the data you hold, independent controller for their own marketplace or consumer functions.
Booksy, OpenTable and TheFork keep their own consumer relationship. TheFork describes itself and the restaurant as joint controllers for platform bookings.
The clause to insist on: contractual separation between your merchant data and the platform’s marketplace data — control 14 of 15.
Three data models
Some booking systems operate primarily as software infrastructure for the merchant. Others combine merchant software with a consumer marketplace. That difference decides whether the provider merely processes customer data, or also develops an independent data relationship with the same person.
01 Processor-first
The merchant controls the customer record; the platform acts primarily as processor.
02 Dual role
The platform is processor for merchant data, and controller for its separate consumer services.
03 Marketplace / joint
The platform relationship is central to acquisition or booking, and may involve joint control.
Finding The structural pattern
The more a booking platform behaves like a marketplace, the more likely it is to act as an independent controller for at least part of the consumer journey — even where the merchant still controls its own CRM record.
Nine platforms at a glance
Data governance architecture, not an overall product ranking.
| Platform | Segment | Merchant control | Independent platform use | Model |
|---|---|---|---|---|
| Phorest | Salon / barber | Very clear | Limited | Business-centred |
| ResDiary | Restaurant | Very clear | Mainly anonymised analysis | Business-centred |
| Zenchef | Restaurant | Expressly stated | Limited in reviewed positioning | Business-centred |
| Quandoo — restaurant database | Restaurant | Yes | Not within processor role | Dual |
| Treatwell | Salon / barber | Yes | Yes, in other roles | Dual |
| Fresha | Salon / barber | Uploaded merchant data | Yes — account and marketplace | Dual |
| Quandoo — marketplace | Restaurant | Restaurant retains its data | Separate consumer relationship | Dual |
| Booksy | Salon / barber | Business data | Yes, clearly | Platform + business |
| OpenTable | Restaurant | Restaurant-owned data | Yes, clearly | Platform + business |
| TheFork | Restaurant | Shared / role-specific | Yes, clearly | Marketplace / joint |
- “Business-centred”
- means the reviewed material places the merchant’s customer record primarily under the merchant’s control.
- “Dual”
- means the provider can be processor in one context and independent controller in another.
- “Platform + business”
- means the provider keeps its own consumer relationship alongside the merchant software.
- “Marketplace / joint”
- means the platform relationship is embedded directly in customer acquisition or booking.
Ownership is the wrong question
The critical concepts are the data subject, the controller and the processor. Those roles decide who sets the purposes and means of processing, and whether the vendor may reuse identifiable data for its own purposes.
- 01 Data subject
- The customer. The individual keeps statutory rights over their personal data.
- 02 Controller
- Determines why and how personal data is processed.
- 03 Processor
- Processes personal data on documented instructions from the controller.
Contract Do not stop at “the merchant owns the data.”
A stronger protection is to state that the provider may process merchant customer data solely on documented instructions, and may not process it for independent commercial purposes.
Provider shall process Customer Data solely on behalf of and according to the documented instructions of the Merchant and shall not process Customer Data for its own independent commercial purposes.
Why this matters: a platform can truthfully say that the merchant owns or controls its CRM data while also acting as controller for a separate marketplace account, behavioural profile or consumer service.
Software or marketplace
Processor-first
- Customer
- Business
- Software
In a processor-first architecture, the vendor is primarily infrastructure. The merchant controls the purpose of the processing, and the provider services that relationship.
Dual role / marketplace
- Marketplace
- Business
In a marketplace architecture, the same person can exist as the merchant’s customer and as the platform’s consumer user, at the same time.
Strategy Database control is not the same as relationship control
The issue is not necessarily “data theft”. The issue is whether the provider becomes a second owner of the customer interface, attention and demand access.
Platform by platform
What each platform’s own terms, privacy materials and data processing agreements said on the assessment date, grouped from the business-centred end of the spectrum to the marketplace-led end.
01 Phorest
- Merchant position
- Phorest states that the customer — the salon — has all right, title and interest in the Customer Data it inputs, including data relating to its own customers.
- GDPR role
- The reviewed GDPR material describes the salon as controller and Phorest as processor.
- Independent use
- Sharing customer data with certain third-party integrations is described as consent-dependent.
- Practical reading
- Customer → salon → Phorest. One of the clearest merchant-controlled models in the review.
02 ResDiary
- Merchant position
- ResDiary states that the venue is the controller of its customer data and describes itself as processor.
- Independent use
- The reviewed material refers to anonymised analysis for booking trends, user behaviour, product improvement and communications.
- Practical reading
- Guest → restaurant → ResDiary. The relationship is substantially more restaurant-centred than a consumer marketplace model.
Sources: ResDiary FAQ
03 Zenchef
- Merchant position
- Zenchef expressly markets the proposition that guest and reservation data belongs solely to the restaurant.
- CRM scope
- As described, the restaurant database can include identity, contact details, booking history, comments, preferences, favourite tables, dietary preferences and repeat visits.
- Practical reading
- The data is positioned as the restaurant’s CRM rather than as a platform-owned consumer graph.
Sources: Zenchef: guest insightsZenchef help centre: your customer database
04 Quandoo
- Processor role
- In the reviewed restaurant DPA, the restaurant is controller and Quandoo is processor.
- Restrictions
- Within that processor role, Quandoo is described as processing on the restaurant’s instructions and not using the data for its own purposes except where legally required.
- Marketplace role
- Quandoo also operates a consumer platform, so the restaurant database must be distinguished from Quandoo’s separate relationship with its own users.
- Termination
- The reviewed DPA version states that personal data is deleted within 30 days after the agreement ends.
Sources: Quandoo data processing agreement
05 Treatwell
- Role
- The reviewed privacy policy describes Treatwell as acting either as controller or as processor, depending on the context.
- Merchant processing
- In merchant-processing contexts, the salon is controller.
- Own relationship
- Treatwell becomes controller for its own website, app and marketplace user relationship.
Sources: Treatwell privacy policy
06 Fresha
- Merchant data
- For customer information uploaded by the merchant, the reviewed policy says Fresha does not use that data for its own purposes and the partner is controller.
- Own relationship
- Separately, Fresha can act as controller for account and marketplace functions, including consolidated booking history and consumer-facing profiles.
Sources: Fresha privacy policy
07 Booksy
- Merchant data
- Booksy processes business customer data on behalf of the business in certain product contexts.
- Own relationship
- Booksy acts as controller for Booksy consumers.
- Listed purposes
- The reviewed material lists purposes including Booksy marketing, direct marketing, profiling and grouping, demand analysis, analytics, statistics, product development and statistical models.
Sources: Booksy information obligation
08 OpenTable
- Merchant position
- OpenTable states that restaurants own restaurant-entered data and that guests own their data.
- Own relationship
- At the same time, OpenTable generally acts as controller for its consumer services.
- Listed purposes
- The reviewed policy lists service delivery, personalisation, communications, analytics, marketing, recommendations and improvement.
Sources: OpenTable privacy policyOpenTable data protection overview
09 TheFork
- Own role
- TheFork describes itself as controller for data collected through its service.
- Joint control
- It states that TheFork and the restaurant are joint controllers for personal data processed through platform and reservation-module bookings.
- Practical reading
- The clearest marketplace case in the reviewed material.
Sources: TheFork legal and privacy
Who owns the relationship
Data governance and demand ownership are related but different. A merchant may keep a CRM record and still depend on a marketplace for the customer’s next booking. That gives the marketplace continuing control over discovery, attention and repeat demand.
Direct / first-party
- Customer discovers your brand
- Books on your site
- Enters your CRM
- Comes back through your brand
The booking technology remains infrastructure behind the relationship.
Marketplace-mediated
- Customer discovers you on the marketplace
- Books
- Receives the service
- Goes back to the marketplace for the next booking
The merchant gets the customer, but the marketplace keeps access to the demand.
Relationship The Booking.com dynamic, applied to service bookings
The merchant can control its CRM record while the platform still controls an important part of discovery and repeat demand. That is a commercial dependency, not merely a GDPR issue.
Five questions to ask your booking platform
If a customer first books through the platform, can we fully export that customer and their booking history?
Can the platform market competing businesses to the same consumer based on marketplace behaviour?
Does leaving the platform end the provider’s relationship with that consumer, or only our merchant account?
Can the platform link the person’s activity across multiple merchants into a single profile?
Does our own website widget create a merchant-first booking, a platform account, or both?
15 controls for your contract
Tick what your current agreement guarantees. Anything left unticked is a question for your provider before you sign, or renew.
What it means in practice
Across the reviewed platforms, the clearest pattern is structural: software-first providers tend to preserve a cleaner controller-to-processor relationship, while marketplace-led providers tend to create an additional consumer relationship in which the platform acts as controller for its own purposes.
01 The business-centred end
Phorest, ResDiary and Zenchef stand out in the source material for clear language that places merchant customer or guest data under the business’s control. Their reviewed positioning is closest to a traditional software infrastructure model.
02 The dual-role middle
Quandoo, Treatwell and Fresha illustrate why role separation matters. The provider may be processor for merchant-controlled data while acting independently as controller for consumer-facing marketplace functions.
03 The marketplace-led end
Booksy, OpenTable and TheFork show the strategic importance of the platform’s own consumer relationship. The merchant can receive and use customer data while the platform keeps its own lawful relationship with the consumer — for marketplace, personalisation, analytics, recommendation or marketing purposes, depending on the platform and context.
Priority Control 14: separate merchant data from marketplace data
A supplier can keep a processor relationship for merchant data while creating a separate consumer relationship through a marketplace. The contract should define exactly where one data sphere ends and the other begins.
Bottom line Do not evaluate only the phrase “you own your customer data.”
Evaluate who controls each data flow, what independent purposes the provider reserves, what remains after termination, and whether the consumer relationship belongs to your brand, the marketplace, or both.
Frequently asked questions
Who owns customer data on a booking platform?
Under GDPR, “ownership” is the wrong test. Your customers keep statutory rights over their own personal data. What decides how that data may be used is the role each party plays: the controller decides why and how it is processed, and a processor may only process it on the controller’s documented instructions.
A platform can truthfully say that you own or control your CRM data while also acting as controller for a separate marketplace account, behavioural profile or consumer service built around the same person.
What is the difference between a data controller and a data processor?
A controller determines why and how personal data is processed. A processor processes personal data on documented instructions from the controller. For a booking platform, the useful question is whether it acts only as your processor, or also as an independent controller for its own purposes.
Does Fresha use my clients’ data for its own purposes?
For customer information uploaded by the business, the reviewed Fresha privacy policy says Fresha does not use that data for its own purposes and the partner is controller. Separately, Fresha can act as controller for account and marketplace functions, including consolidated booking history and consumer-facing profiles. That is why the review places Fresha in the dual-role group.
Is TheFork a joint controller with the restaurant?
According to TheFork’s legal material as reviewed, yes. TheFork describes itself as controller for data collected through its service, and states that TheFork and the restaurant are joint controllers for personal data processed through platform and reservation-module bookings. It is the clearest marketplace case in the review.
What does Booksy do with customer data?
Booksy processes business customer data on behalf of the business in certain product contexts, but acts as controller for Booksy consumers. The reviewed material lists purposes including Booksy marketing, direct marketing, profiling and grouping, demand analysis, analytics, statistics, product development and statistical models.
Does OpenTable own my guest data?
OpenTable states that restaurants own restaurant-entered data and that guests own their data. At the same time, OpenTable generally acts as controller for its consumer services, and its reviewed policy lists service delivery, personalisation, communications, analytics, marketing, recommendations and improvement among its purposes.
Which booking platforms keep customer data under the business’s control?
In the reviewed material, Phorest (salons and barbers), ResDiary and Zenchef (restaurants) present the clearest business-centred models: their documents place the merchant’s customer or guest data under the business’s control, with the platform acting as processor. Policies change, so re-check the current terms before you sign.
Is a booking marketplace taking my customers?
The issue is not necessarily data theft. It is whether the platform becomes a second owner of the customer interface, attention and demand access. A merchant can keep its CRM record and still depend on the marketplace for that customer’s next booking — a commercial dependency, not merely a GDPR issue.
What happens to my customer data when I leave a booking platform?
It depends on the contract. That is why the review recommends requiring a full export of your customer database, booking history, marketing consent status and transaction history, explicit retention rules after termination, and deletion obligations once the agreement ends. As one example, the reviewed Quandoo DPA version states that personal data is deleted within 30 days after the agreement ends.
Also ask whether leaving ends the platform’s relationship with your customers, or only your merchant account.
What should a booking platform contract include?
The review sets out 15 controls. The core of them: you are the sole controller of merchant customer data and the provider acts only as processor for it; no identifiable merchant customer data is used for the provider’s own marketing or to promote competing businesses; no cross-business profiling; full export rights; clear retention and deletion after termination; a current subprocessor list; rules for transfers outside the EEA; and contractual separation between merchant data and marketplace data.
Is “you own your customer data” enough?
No. Evaluate who controls each data flow, what independent purposes the provider reserves, what remains after termination, and whether the consumer relationship belongs to your brand, the marketplace, or both.
Sources and method
Prepared from platform terms, privacy materials and data processing agreement (DPA) findings compiled in the source review. Assessment date: 2 October 2026.
This is a structured synthesis of the reviewed material. It preserves the underlying findings and source framing rather than independently re-auditing every current contract term.
This page is information, not legal advice.
Represent one of these platforms and see something out of date? Write to hello@one-site.biz and we will review it.
Reviewed source set
- ResDiary
- ResDiary FAQ
- Treatwell
- Treatwell privacy policy
- Fresha
- Fresha privacy policy
- TheFork
- TheFork legal and privacy
Use For live vendor selection
Platform policies change. Re-check the current version date, controller and processor language, independent purposes, retention, subprocessors and data-export rights before you sign.