GDPR-compliant email marketing for venues: a practical checklist

Why this matters for your venue

Most venues are sitting on a goldmine of foot traffic and doing almost nothing with it. Guests walk in, spend money, and walk out. You have no follow-up. You have no reason to come back. You have no relationship.

Email marketing fixes that. A well-timed email to a guest who visited three weeks ago can bring them back through the door. A birthday offer sent to a diner who gave you their details at login can generate a booking that would never have happened otherwise. Venues using Purple Engage see open rates above 40% on first-party data lists, compared to industry averages of around 21% for purchased or scraped lists. That difference is consent. When someone actively chooses to hear from you, they read what you send.

But here is the catch. Under GDPR, you cannot just collect email addresses and start sending. You need explicit, informed, freely given consent. And you need to be able to prove it. Get this wrong and you face fines of up to 20 million euros, or 4% of global annual turnover, whichever is higher.

The good news is that if you capture consent correctly at the point of Guest WiFi login, you are already most of the way there. That is exactly what Purple Engage is built to do.

The approach

Let us walk through the five pillars of GDPR-compliant email marketing for venues.

Pillar 1: Consent capture

GDPR requires that consent is freely given, specific, informed, and unambiguous. In plain English, that means your guest needs to actively tick a box - not a pre-ticked box, not a buried clause in your terms - to say yes, I want to receive marketing emails from you.

When a guest connects to your venue WiFi through Purple Engage, they see a captive portal - a splash page that loads before they get online. That page includes a clearly labelled opt-in checkbox. The wording matters. It should say something like: "I'd like to receive offers and news from The Crown Hotel. You can unsubscribe at any time." Short, clear, honest. No legalese.

The checkbox must be unticked by default. Ticking it is the guest's active choice. That is what makes it a conscious-choice opt-in - and that is the phrase we use at Purple because it captures exactly what GDPR demands.

Pillar 2: Consent records

Capturing consent is not enough. You need to be able to prove it. Under GDPR Article 7, if you are challenged by a guest or investigated by a regulator, you must demonstrate that consent was given. That means recording the timestamp of when consent was given, the source - in this case, the WiFi login portal - the exact wording the guest agreed to, and the version of your privacy policy that was in force at the time.

Purple Engage records all of this automatically. Every opt-in is timestamped, tagged to the venue, and stored against the guest profile. If the ICO ever investigates, you can pull the consent record in seconds.

Pillar 3: Data storage and security

Under GDPR, personal data - including email addresses - must be stored securely and, for UK and EU organisations, either within the UK or EU, or in a country that has an adequacy agreement with the UK or EU. Purple's infrastructure is ISO 27001 certified and GDPR-compliant. Data is stored in EU-based data centres. You do not need to worry about cross-border transfer issues when you use Purple Engage.

You also need to ensure that only authorised staff can access your guest data. Purple Engage uses role-based access controls, so your marketing manager can run campaigns without being able to export the full database.

Pillar 4: Opt-out mechanics

Every marketing email you send must include a clear, working unsubscribe link. Under GDPR, an opt-out request must be honoured promptly - the ICO guidance says within a reasonable time, and best practice is within 10 working days. In practice, Purple Engage processes unsubscribes automatically. When a guest clicks unsubscribe, they are added to your suppression list immediately. They will not receive another email from you. You do not need to manually manage this.

The suppression list is critical. It is not enough to delete someone from your active list. You need to keep a record that they opted out, so that if their email address is re-added later - say, through a data import - the system knows not to email them. Purple Engage maintains this suppression list automatically.

Pillar 5: Data retention and hygiene

GDPR's storage limitation principle says you should not keep personal data for longer than necessary. For email marketing, that means you need a data retention policy. A sensible approach for most venues is to review consent every 24 months. If a guest has not engaged with any of your emails in two years and has not visited your venue, their consent may no longer be meaningful. Send a re-consent email. If they do not respond, remove them from your active list.

This is not just a compliance exercise. It is also good marketing. A clean, engaged list will always outperform a large, stale one. Deliverability improves. Open rates improve. Revenue per send improves.

How to do it with your guest WiFi

The venues that get this right are building something that Mailchimp, Klaviyo, and HubSpot cannot give them: a list that builds itself from real guests who have made a conscious choice to hear from you. That is first-party data. And in a world where third-party cookies are disappearing and paid media costs are rising, first-party data is the most valuable marketing asset you can own.

Purple Engage captures conscious-choice opt-ins at WiFi login, timestamps every consent record, and handles unsubscribes automatically. GDPR compliance is built in - not bolted on.

For a deeper dive into how to segment this data, read our Email segmentation for venues: a practical guide.

What to send, and when

Once you have a compliant list, you need to send emails that drive revenue.

The welcome email Send this within 24 hours of opt-in. This is your highest-performing email. Open rates on welcome emails average 50% or above. Include a clear offer to drive a return visit.

The birthday offer If you collect dates of birth at login, automate a birthday email 14 days before the date. This drives high-value group bookings.

The re-engagement campaign Send an offer to guests who have not visited in 90 days. This turns one-time visitors into regulars.

Measuring what works

Do not just measure opens and clicks. Measure return visits and revenue.

Because Purple Engage tracks WiFi logins, you can see when a guest returns to your venue after receiving an email. This is true closed-loop attribution. You know exactly how much revenue your email marketing is driving.

Where to start

Your next steps are simple.

1. Audit your current consent capture process. Is your opt-in checkbox unticked by default? Is the wording specific to marketing emails?
2. Check your data storage. Where is your guest data held, and is it GDPR-compliant?
3. Test your unsubscribe flow. Click the unsubscribe link in one of your own emails and check that it works and that the opt-out is processed within 10 days.

Listen to our 10-minute briefing on this topic below.