Bookings by phone, WhatsApp or email: what to tell guests first, what data to ask for and a confirmation template (2026)

Updated: 10 November 2026

Many bookings at a small property arrive by phone call, WhatsApp or email. They are still distance contracts with rules: what to tell the guest first, when to confirm in writing and which data not to ask for. This guide sums up EU law, the rules in Spain, Portugal and Italy and the official PCI SSC FAQs, checked on 10 November 2026. It is not legal advice.

The short answer

The essentials:

Before the guest says «yes», give the total price including taxes, what is included, how and when to pay, the cancellation policy and who you are (Directive 2011/83/EU, Art. 6(1)).
Afterwards, always send the confirmation on a medium the guest can keep, such as an email (Art. 8(7)).
If you call the guest to offer a booking, in Spain and Portugal the guest is bound only once they accept in writing; in Italy the law requires this for any contract by phone.
Do not ask for card numbers by email, WhatsApp or SMS without protection: under PCI SSC FAQ 1310, if you use those channels for card data, the channel and your systems must meet PCI DSS.
Ask only for the data you need for the booking (GDPR, Art. 5(1)(c)).

What to tell the guest before closing the booking

Directive 2011/83/EU (Art. 6(1)) lists the pre-contract information. For a property, in practice:

Room or unit type, dates, number of guests and board (room only, breakfast…).
Trading name, address and contact details of the property.
Total price including taxes and any extra charges, or how they are calculated if unknown in advance.
How and when payment is made (at the property, deposit, prepayment) and the cancellation policy with dates and amounts.
That there is no 14-day right of withdrawal for accommodation with set dates: see our guide /right-of-withdrawal-hotel-booking-14-days.
By phone or in a short message (Art. 8(4): a medium with limited space or time) the key points are enough before closing; the rest can follow, for example in the confirmation.

Phone offers: when written confirmation is required

Art. 8(6) of the Directive lets each country decide whether a phone offer must be confirmed in writing:

Spain (Art. 98 of the General Consumer Protection Act, per the official Consumo Responde service): if the business calls the consumer, it must confirm the offer in writing on a durable medium and the consumer is bound only once they accept by signing or in writing (paper, email, fax or SMS).
Portugal (Decree-Law 24/2014, Art. 5(7)): the consumer is bound only after signing the offer or sending written consent; this does not apply if the consumer made the first phone contact.
Italy (Consumer Code, Art. 51(6)): for any distance contract by phone, the trader confirms the offer and the consumer is bound only after signing it or accepting it in writing.
Greece: we could not confirm in the official text whether this option applies. If in doubt, ask for written acceptance.
If the guest calls you (the usual case for a hotel), in Spain and Portugal this rule does not apply, but the contract confirmation (Art. 8(7)) still does.

The written confirmation

Art. 8(7) requires confirming the contract on a «durable medium» within a reasonable time and at the latest before the service starts:

Durable medium (Art. 2(10)): something the guest can store and consult later unchanged. An email with the booking details is the simplest way.
Whether a WhatsApp message counts as a durable medium: not confirmed. If you book over WhatsApp, also send the confirmation by email.
Portugal sets 5 days to confirm, and no repeat is needed if the information was already given on a durable medium (DL 24/2014, Art. 6).
The confirmation should repeat the pre-contract information: if it differs from what you said on the phone, expect complaints.

What data to ask for and what not to

The GDPR (Art. 5(1)(c)) requires data that is «adequate, relevant and limited to what is necessary»:

Ask for: lead guest name, dates, number of guests, an email or phone number and any special requests the guest wants to share.
Do not ask in advance for ID or passport copies, date of birth or data you do not need to book: guest registration follows each country's rules, usually on arrival.
Do not ask for or accept the card number, expiry date or security code by email, WhatsApp, SMS or chat without protection (PCI SSC FAQs 1310 and 1085). If someone sends it, do not copy it elsewhere and delete it.
If you need a guarantee or deposit, use a secure payment link from your payment provider: see /hotel-card-guarantee-no-show-fee-pay-at-property-2026.

Confirmation template

Copy and adapt (subject: «Your booking confirmation no. …»):

Property: trading name, address, phone and email.
Booking no. …, in the name of …; arrival …, departure … (nights: …); guests: …; room: …; board: ….
Total price: … € including VAT. Tourist tax: … (if any, say whether it is paid separately at the property).
Payment: how and when (for example, «at the property on arrival»). Deposit: … or «no deposit».
Cancellation: free until … at … h; after that, … . There is no 14-day right of withdrawal because this is accommodation for set dates.
Check-in and check-out times, and how to reach you on the day of arrival.
If the offer was made by phone at the property's initiative: «To confirm, please reply to this email with “I accept”».
A short data protection notice and a link to your privacy policy.

How iQuota helps

Bookings that come through iQuota do not ask for card details: the traveller pays at the property, and the connector asks the AI assistant to show the price, payment terms and cancellation policy and get the traveller's confirmation before booking. 0% commission. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details and terms, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Is a phone booking valid with nothing in writing?

EU law requires you to send a confirmation on a durable medium afterwards. If you made the call to offer it, in Spain and Portugal the guest is bound only after accepting in writing; in Italy, for any phone contract.

Can I ask for a card number on WhatsApp?

PCI DSS does not ban the channel itself, but it must be protected and your systems fall within its scope (FAQ 1310). For a small hotel a secure payment link is simpler.

Is a WhatsApp message enough as confirmation?

It is not confirmed that it counts as a durable medium. Also send an email.

How long do I have to confirm?

A reasonable time and at the latest before arrival (Art. 8(7)). In Portugal, 5 days.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά