GDPR and Data Protection for a Farm Stay: Bookings, Cookies, Email Marketing and Booking/Airbnb Contracts

Data protection is no longer a concern only for large hotel chains and IT companies. The moment a farm stay in East Herzegovina takes its first reservation, sends a confirmation by email, or puts an inquiry form on a website, it becomes a controller of personal data in the legal sense. This brings concrete obligations, but also an opportunity to build guest trust — especially with visitors from the European Union, who are used to a high standard of privacy and expect it even on a rural holiday.

This guide explains how small households, winemakers and food producers in Trebinje, Bileća, Nevesinje, Gacko, Ljubinje, Berkovići and Istočni Mostar can bring their everyday operations into line with data-protection rules — without expensive lawyers or complex systems. The focus is on four things a farm stay does almost every day: handling reservations, cookies on the website, email communication, and cooperation with platforms such as Booking and Airbnb.

The new legal framework: the BiH law and the GDPR

In 2025, Bosnia and Herzegovina adopted a new Law on the Protection of Personal Data (published in the Official Gazette of BiH, No. 12/25), which is largely harmonized with the European General Data Protection Regulation — the GDPR. The law entered into force during 2025 and its full application began in the autumn of the same year. The supervisory body is the Personal Data Protection Agency of BiH (AZLP), which issues guidance and handles complaints.

Two layers of rules matter for a farm stay. The domestic law applies because the household is established in and processes data in BiH. The GDPR, on the other hand, can apply directly when you offer accommodation to guests located in the EU or monitor their behaviour (for example, through web analytics). That is why the most practical approach is to set up your operation to the higher, GDPR standard straight away — then you are compliant with both.

The core principles are the same in both instruments: data is collected for a clear and lawful purpose, kept to a minimum, retained only as long as genuinely necessary, and protected by appropriate technical and organizational measures. These principles are the frame for everything that follows.

Reservations: what is the legal basis

A common mistake is believing you need the guest's "consent" for every piece of data. You do not. For data that is necessary for the booking to function at all — first and last name, contact details, dates of stay, number of people — the legal basis is performance of a contract, not consent. Without that data the service cannot be provided, so consent is neither required nor appropriate.

Another frequent basis is a legal obligation. In Republika Srpska, hosts are required to register guests' stays (check-in and check-out) with the competent authorities, in line with tourism and residence rules. That processing is lawful because it is mandated by law — but data collected for registration must not be used for other purposes (such as marketing) without a separate basis.

In practice this means:

• Collect only what you truly need for the booking and the statutory registration.
• Do not ask for a copy of a whole document "just in case" if registration only requires part of the data.
• Define how long you keep the data — as a rule, for as long as accounting and tourism record-keeping obligations last — and after that, delete or anonymize it.

Cookies and the website

If the farm stay has a website, cookies are a separate story. The rule is simple. Essential, "strictly necessary" cookies — those the site cannot work without, such as the session or remembering the language — do not require consent. All others — web analytics, remarketing, embedded maps and social-media content — require the visitor's prior, active consent.

This means the cookie banner must:

1. Ask for consent before non-essential cookies load, not after.
2. Offer a "Reject" option just as easily as "Accept" — it is not acceptable for "Accept" to be a large button while rejection is hidden in fine-print settings.
3. Explain in plain language what is tracked and why.
4. Let the visitor change their choice later.

Alongside the banner come a Privacy Policy and a Cookie Policy, published in both Bosnian and English, because foreign guests visit too and have the right to understand how their data is handled.

Email marketing and consent

This is where small households most often go wrong. The email address you obtained to send a booking confirmation may not automatically be used to send newsletters and seasonal offers. Marketing communication requires a separate legal basis — as a rule, the guest's explicit consent or, in limited cases, a legitimate interest for similar services offered to existing guests.

A sound approach looks like this:

• At the booking stage, add a separate, optional field: "I would like to receive seasonal offers and news" — which is not pre-ticked.
• Keep a record of who gave consent and when, so you can prove it.
• Every marketing email must contain a clear unsubscribe link, and unsubscribes must be honoured immediately.
• Never buy or exchange lists of email addresses.

Guest rights and how to meet them

The law and the GDPR give guests a set of rights, and the household must make them available — usually free of charge and within a reasonable time, as a rule up to 30 days:

• The right of access — to learn what data is being processed about them.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure, also known as the "right to be forgotten".
• The right to object and to withdraw previously given consent.
• The right to data portability in a common, readable format.

In practice, it is enough to have one contact address (for example privacy@yourfarmstay.ba) and a simple procedure: confirm the requester's identity, locate the data, and respond. If an incident occurs — say a guest list leaks or a device with data is lost — the breach must be reported to the Agency without delay, as a rule within 72 hours, and noted internally.

Contracts with OTA platforms (Booking, Airbnb)

When a guest books through Booking or Airbnb, both you and the platform process their data. Legally, this is most often a relationship in which both the platform and the host are responsible for the data (a controller-to-controller relationship), not one in which the platform works purely "for you".

What this means for a farm stay:

• Read the platform's terms and privacy policy — they define who does what with the data and under which conditions data is transferred.
• Use guest data obtained through the platform only for that specific booking; do not move it into your marketing list without the guest's separate consent.
• If you use additional tools — property-management software, an online check-in system, or an email-sending tool — you need a data processing agreement (DPA) with each of them, because they process data on your behalf.
• Keep data secure: strong, distinct passwords, access limited to those who need it, and regular backups.

The key rule: use data collected for the booking and the statutory registration solely for those purposes. Everything else — newsletters, offers, analytics — requires a separate, demonstrable legal basis, most often consent that the guest can withdraw as easily as it was given.

Practical steps (checklist)

1. Write a short Privacy Policy (BS and EN) and publish it on the site and display it on the premises.
2. List what data you collect, why, where you store it and for how long — this is your record of processing activities.
3. Set up a proper cookie banner with an equally visible reject option.
4. Separate marketing consent from the booking itself and keep a consent log.
5. Add an unsubscribe link to every marketing email and honour opt-outs immediately.
6. Prepare a short procedure for guest requests (access, rectification, erasure) and a single contact address.
7. Review the Booking and Airbnb terms and sign a DPA with every tool you use.
8. Ensure technical measures: passwords, controlled access, backups, and a plan to report an incident within 72 hours.
9. For official guidance, contact the Personal Data Protection Agency of BiH, and for tourism questions the Ministry of Trade and Tourism of the Government of Republika Srpska.

Compliance is not a one-off task but a habit: collect less, explain clearly, store securely, and respect the guest's choice. A household that does this does not merely avoid a fine — it builds a reputation as a responsible host, an increasingly valuable advantage on the European holiday market.