Guest WiFi Compliance Made Simple
CaptiFi asks for marketing consent separately from getting online, records each guest's answer with the time they signed in, and has tools for erasure requests, with retention policies configured on request. Your venue stays the data controller, the tools come with every plan, and you keep guest WiFi on its own VLAN or guest network in your controller.
What is GDPR Compliance & Security?
GDPR Compliance and Security builds the consent step into every WiFi login. The marketing question is asked separately from getting online, each guest's answer is stored with the time they signed in, and deletion tools answer erasure requests. Guest WiFi stays on its own VLAN or guest network in your controller. It is for every venue that captures personal data over guest WiFi in the UK or EU. Included on every plan, Lite included.
55%
Of Guests' Devices Sign In (Sep 2026)
Under 2 hours
Average Support Reply
29+
Integrations Included
99.9%
Platform Uptime
Sign-in rate: CaptiFi venue data, UniFi venues, September 2026
The Problem
Guest WiFi creates data protection obligations that most venues aren't equipped to handle. Collecting emails without proper consent, storing data without retention policies, and mixing guest traffic with business networks are all compliance risks.
The CaptiFi Solution
CaptiFi builds the consent step into every WiFi login. The marketing question is asked separately from getting online, each guest's yes or no is stored on their visit record with the time they signed in, and deletion and anonymisation tools answer erasure requests, with retention policies configured on request. Keeping guest traffic apart from your business network is a setting in your own controller.
Key Benefits
Marketing consent asked separately from getting online in every login flow
Guest data deletion and anonymisation tools, with retention policies configured on request
Guest WiFi kept on its own VLAN or guest network in your controller
Each guest's marketing answer recorded with the time they signed in
See it in your dashboard
Opt-outs handled for you, on the record
When a guest texts STOP they are excluded instantly, and the opt-out list keeps the record: who opted out, from which venue and when. If anyone ever asks how you handle consent withdrawal, the answer is already on screen.
- Instant, automatic opt-outs
- Full record of who withdrew and when
Consent captured at the moment of login
This is what guests see on their phone: the questions your splash page asks, and the marketing question, asked separately from getting online. CaptiFi stores that consent with a time stamp, which is the audit trail GDPR expects you to have.
- A clear consent question at login
- Time-stamped record kept automatically
You are the controller, CaptiFi is the processor
| Area | CaptiFi handles | You handle |
|---|---|---|
| Consent capture | Separate WiFi terms and marketing opt-in, nothing pre-accepted, each guest's answer stored with the time they signed in | Decide what to ask for and what you will use it for |
| Privacy notice | A template you can adapt, linked from the splash page | Publish your own notice and keep it accurate |
| Unsubscribe | One-click link in every email, STOP on every SMS, applied across all your venues and added to suppressions | Nothing; it runs itself |
| Access and erasure requests | Export all (CSV) on Guest Visits, one row per guest with return visits not repeated, as a starting point for an access request; Delete (GDPR) and Anonymise (GDPR) bulk actions on Guest Visits | Respond within the one month the law allows |
| Hosting and security | Hetzner data centres in Finland and Germany, encryption at rest and in transit, access controls and access logging | Keep dashboard logins to the people who need them |
| Breach notification | You are notified without undue delay, as the data processing agreement sets out | Notify your regulator within 72 hours and guests where required |
| Sub-processors | Hetzner (hosting, EU), Amazon SES (email, US), Stripe (payments), Cloudflare (media, EU); marketing platforms only when you connect one | List them in your notice |
This page describes how the product works. It is not legal advice; your lawful basis and privacy notice remain yours, and a data protection adviser can confirm them for your venue.
How to run GDPR-compliant guest WiFi with CaptiFi
Keep terms and marketing consent separate
In the splash builder the WiFi terms and the marketing opt-in are separate choices with nothing pre-accepted. Link your privacy policy from the page; CaptiFi provides a template you can adapt.
Collect only what you will use
Switch on the fields you need and leave the rest off. Every extra required field lowers completion and widens what you hold.
Let unsubscribes run themselves
Every email carries a one-click unsubscribe and every SMS honours STOP. An opt-out applies across every venue on the account and goes on your suppressions list automatically.
Answer requests from the dashboard
Export all (CSV) on the Guest Visits page downloads every guest at the venue, one row per guest with return visits not repeated, so the guest's row is the starting point for an access request, not the full record. Use Delete (GDPR) and Anonymise (GDPR) on the same page to answer an erasure request within the one month the law allows.
Is guest WiFi data capture GDPR compliant?
It can be, and the mechanics decide it. Under GDPR a venue can make WiFi access conditional on accepting the network terms, but marketing needs a separate, freely given consent that is recorded and revocable. CaptiFi's splash page asks the two questions separately with nothing pre-accepted, stores the marketing answer against the guest with an audit trail, sends only to guests who said yes, and turns every unsubscribe or STOP into an account-wide suppression. Guest data sits on EU servers and the venue can export, anonymise or delete it from the dashboard.
Does a splash page need a cookie banner?
Not for the sign-in. The page uses only the essential cookies the login needs, which do not require a banner. Returning guests are recognised by their device; no tracking cookie is set. Adding a third-party pixel or analytics script changes that and needs its own consent mechanism.
CaptiFi is a guest WiFi marketing and captive portal platform for restaurants, bars, pubs, cafes, hotels, gyms, salons, retail and short-term rentals, built by CaptiFi Ltd in the UK and sold in GBP, USD, EUR, CAD, AUD and NZD to venues worldwide.
GDPR and guest WiFi questions answered
Is collecting emails through guest WiFi legal under GDPR?
Who owns the data and who is the controller?
Where is guest data stored?
How do guests unsubscribe or withdraw consent?
Can a guest ask to be deleted?
Do I need a cookie banner on the splash page?
Is this legal advice?
GDPR consent, unsubscribe and data export on every plan, Essentials included
Consent capture, unsubscribe handling and data export are part of every plan, Essentials included.
What Our Customers Say
CaptiFi completely changed my business. Before, every guest was a one-time booki...
CaptiFi completely changed my business. Before, every guest was a one-time booking. Now I have a direct line to thousands of people who've stayed in the plane. I can offer them return deals, send updates about new features, and keep them engaged. My repeat booking rate went from almost zero to 35%. It's been incredible.
Johnny Palmer
Owner, PytchAir Boeing 727 Airbnb
Ready to turn your guest WiFi into revenue?
Start your 30-day free trial today. Hardware included (refundable deposit), no setup costs, cancel anytime.