These is no difference offline vs online in this context. You almost certainly had a legitimate interest in remembering your guest’s preferences, but retaining

These is no difference offline vs online in this context. You almost certainly had a legitimate interest in remembering your guest’s preferences, but retaining only the necessary amount of personal information is key, and sharing it with other firms is more restricted- an example of where this could be legal is in sharing warning of violent guests.