The Contact page or form on your website is an obvious data collection point. You are asking people to supply their personal data in order to solicit a response from you.
The Lawful Reason to use to enable the processing such an enquiry is worth considering because there are options.
Let us start by thinking about what the purpose of the processing is.
It is to enable people to ask you a question.
You give them options for how they might contact you. Not all of them involve the processing of personal data.
For example, they could telephone you and ask a question. If your telephone system doesn’t log the incoming call number, there is no exchange of personal data. However if you use a modern IP telephony system, it does record the inbound telephone number where it is available.
If the question is simple enough and doesn’t need to involve the use of personal data, for example,
“What time does your restaurant close tonight?”
There doesn’t need to be processing of personal data if you’re talking to an anonymous person on the telephone.
Any sort of website form is going to involve the collection of personal data. How else are you going to respond to the enquirer? At the very least you need an email address, postal address or a telephone number, even if you don’t ask for a name directly. This is all personal data.
You don’t know what has caused people to use a contact form or what sort of question the enquirer might ask. The question could be simple or it could require a more complicated answer involving a direct conversation. You don’t know what might be involved in processing the personal data in order to provide an answer.
So how can you ask for Consent?
You need to make it clear to which purposes the data you collect will be put. If you don’t know how you’re going to respond to the question, you can’t ask for Consent because you can’t be specific about the subsequent processing. It is just not appropriate. Think about it. If someone contacts you to ask a question, they are expecting and anticipating an answer. You asking for consent to provide it sounds stupid.
If the question is an obvious invitation to provide a price or a quote, you can choose your Lawful Reason as the fulfilment of a contract or the activity leading to the creation of a contract. This lawful reason is initiated by the data subject inviting you to provide them with “pre contract” information. In the case of your hotel this might be price, availability and so on.
If this was an enquiry form dedicated to a sales page, soliciting enquiries about the possibility of bookings, you could state that in your privacy notice.
However this is a general enquiry form. You don’t know what the question is going to be. There is a Lawful reason for processing to cover this.
Use Legitimate Interest. It is quite reasonable for you to follow up a question with a response. You won’t be surprising the enquirer. In asking their question they have voluntarily created a relationship between themselves and your business. This relationship might only last for as long as it takes you to provide an answer, but even for that short period, it exists.
Your use of the collected personal data must only be in the context of the stated purpose. You can’t move it on to a marketing list for example. You would need to ask for consent to do that.
The only problem you have with Legitimate Interest is that you might have to complete a Legitimate Interest Assessment and Balancing Test before you can complete the Privacy Notice to accompany your online Contact form. For a simple process such as a general contact form conducting the LIA ought to be straightforward enough. Indeed it might be a suitable basis for you to use as a familiarisation and training exercise for your Project Team.
Once the documentation is completed and your claim of Legitimate Interest is justified and recorded, you can use it.