GDPR & Compliance FAQ

Is CaptiFi GDPR compliant?

Yes. CaptiFi is fully GDPR compliant. We provide:

• Clear consent collection at the point of data capture
• Opt-in checkboxes for marketing communications
• Full audit trail of all consent records
• Data export capabilities
• Right to erasure (deletion) support
• Privacy policy integration on splash pages

Where is data stored?

Guest data is stored securely on EU-based servers (Hetzner data centres in Finland and Germany) with encryption at rest and in transit. Email delivery uses Amazon SES in the US; regional email delivery can be arranged on request.

Who owns the data?

You do. CaptiFi processes data on your behalf, but you are the data controller. You can export or delete data at any time.

How long is guest data retained?

Guest data is retained for as long as your account is active. You can anonymise or delete guest records at any time from the Guest Visits page. If you cancel your account, data is retained for 30 days to allow you to export it, then permanently deleted. Contact support if you'd like an automatic retention policy (e.g. auto-delete data older than 12 months) set up for your account.

Can guests request deletion of their data?

Yes. Under GDPR, guests have the right to request erasure of their personal data. If a guest contacts you with a deletion request, you can remove their data from the CaptiFi dashboard immediately. You should respond to such requests within 30 days as required by GDPR.

Can guests opt out?

Yes. Every marketing email includes an unsubscribe link, and mailbox providers such as Gmail, Apple Mail and Outlook also show their own Unsubscribe button at the top of the message. Either route opts the guest out in one click, with no form to complete.

An opt-out is honoured everywhere at once: the address stops receiving campaigns, automations and review requests, across every venue on your account, and it is added to your Suppressions list so nothing can email it again. Guests can also request data deletion by contacting you directly.

Do I need a privacy policy?

Yes. You should have a privacy policy that covers your use of guest WiFi data. CaptiFi provides a template you can customise, and it's linked directly on your splash page.

Do I need a cookie banner on my splash page?

The CaptiFi splash page uses only essential cookies required for the WiFi login to function — these do not require a cookie banner under GDPR. If you add third-party tracking (e.g. Facebook Pixel, Google Analytics) to your splash page, then yes, you would need a cookie consent mechanism. CaptiFi can help you configure this if needed.

What about cookie consent?

The CaptiFi splash page uses minimal cookies required for the WiFi login to function. Marketing cookies (if any) are only set with consent.

Can I delete a guest's data?

Yes. In the dashboard, go to My Venues → Guest Visits, select the guest(s), and use the Delete (GDPR) bulk action — this permanently removes all their data from CaptiFi. There's also Anonymise (GDPR) if you want to keep the anonymous visit statistics.

Do you share data with third parties?

CaptiFi never sells guest data. To run the service we use a small number of vetted sub-processors: Hetzner (hosting, EU), Amazon SES (email delivery, US), Stripe (payments) and Cloudflare (media storage, EU). Guest data is only sent to a marketing platform (such as Klaviyo or Mailchimp) when you connect one from the Integrations page. Beyond that, data is only accessible to you (the venue owner) through your CaptiFi dashboard.

What about data breaches?

CaptiFi has security measures including encryption, access controls, and regular security audits. In the unlikely event of a breach, we will notify affected customers within 72 hours as required by GDPR.

Am I the data controller or data processor?

You (the venue owner) are the data controller: you decide what data is collected and how it's used. CaptiFi acts as a data processor, handling the data on your behalf according to your instructions. Our Data Processing Agreement (DPA) is published at captifi.io/dpa.