Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Mews is a cloud hospitality platform that combines a property management system with a booking engine for hotels and accommodation providers. On a hotel website, the Mews booking widget collects reservation details and sets cookies to manage the booking session, while the wider platform processes guest personal data such as names, contact details, stay information, and payments. Booking cookies can be strictly necessary, but analytics and any marketing require consent.
Mews is a cloud based hospitality platform. It provides a property management system that hotels use to run operations and a booking engine that takes reservations directly on the hotel website. Because it sits at the centre of the guest relationship, it processes a significant amount of personal and payment data.
On the website, the Mews booking widget sets cookies to keep the reservation session and processes the visitor IP and device information. In the platform, it stores guest profiles, contact details, stay history, and payment information. The booking session cookies are typically necessary to complete a reservation the guest started, while analytics and marketing cookies are not.
Guest data and payment details are personal data under the GDPR, and the booking cookies fall under the ePrivacy Directive. The hotel is usually the controller and Mews the processor, so a data processing agreement is essential. Payment data brings additional security duties, and special care is needed if any sensitive information is collected.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Processing a booking relies on the contract with the guest, so it does not need consent, and the cookies strictly necessary to complete that booking are exempt. Consent is required for analytics, for marketing emails beyond the booking, and for any non essential cookies the booking page loads. Keep these purposes clearly separated.
Mews is a European company and hosts its platform in the European Union, which limits transfers for the core service. However, payment and communication sub processors may sit outside the EEA, so review the sub processor list and ensure any such transfers rely on Standard Contractual Clauses or the EU US Data Privacy Framework.
Sign the Mews data processing agreement, set the lawful basis for bookings and marketing, gate non essential cookies on the booking page behind consent, and review the sub processor list. Set retention for guest profiles, secure payment data, and describe Mews in your privacy notice and cookie policy.
Websites using Mews must obtain user consent under GDPR regulations.
DPIA considerations
Mews handles guest personal data and payment information at scale. Assess the controller and processor split, the lawful basis for bookings and marketing, the payment sub processors, retention of guest profiles, and any transfers outside the EEA.
Sample consent text
We use Mews to manage bookings. Cookies needed to complete your reservation are strictly necessary, while any analytics or marketing cookies run only after you accept them.
Third-party domains contacted
mews.comapp.mews.comcdn.mews.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mews_session | Functional | Session | Strictly necessary cookie that keeps the booking in progress during the reservation. |
| mews_distributor | Functional | 1 year | Remembers booking engine configuration and language preferences for the visitor. |
| mews_analytics | Analytics | 1 year | Measures booking funnel performance, a non essential cookie that requires consent. |
Mews uses cookies for user preferences — inform visitors with a consent banner.
The Mews booking widget sets a session cookie to keep the reservation in progress and may set a configuration cookie. These can be strictly necessary, while any analytics cookies that measure the booking funnel are not and require consent.
Not for the cookies strictly necessary to complete a booking the guest started. You do need consent for analytics, marketing emails beyond the reservation, and any non essential cookies on the booking page.
Processing a reservation relies on the contract with the guest under Article 6(1)(b) of the GDPR. Analytics and marketing rely on consent, and the hotel is the controller while Mews is the processor.
Mews hosts its platform in the European Union, so the core service stays in the region. Some payment or communication sub processors may be outside the EEA, in which case transfers rely on Standard Contractual Clauses or the EU US Data Privacy Framework.
Given the volume of guest and payment data, a DPIA is worth considering, especially for large properties. Cover the data categories, the payment sub processors, retention of guest profiles, and security.
Sign the data processing agreement, set the lawful basis for bookings and marketing, gate non essential booking page cookies behind consent, and secure payment data. Review the sub processor list and set retention for guest records.
Alternatives include Cloudbeds, Apaleo, and other property management systems and booking engines. Compare where each hosts data and how it handles guest and payment information.
List the Mews booking cookies, mark the strictly necessary ones, and place any analytics cookies in the analytics category. Name Mews as a processor in your privacy notice and note the EU hosting and any sub processor transfers.