Visitor Management collects only the details you need to welcome a guest, and you decide per office how long those details are kept. This article lists which visitor data deskbird processes, what you can configure, what is fixed, and who can see the data, so your data protection team has the facts for its review. It describes how the product works and is not legal advice.
- What visitor data deskbird collects
- Consent and your own privacy notice
- Set how long visitor data is kept
- What happens when visitor data is anonymized
- Who can see visitor data
- What notifications contain
- FAQs
1. What visitor data deskbird collects
Every visitor has four standard fields: Email, First name, Last name and Company. These fields can't be turned off, and you can't add custom fields. If you need to share or collect more information, use the instructions and documents of your visit types.
Which fields are required depends on where the visitor is added:
| Where the visitor is added | Required | Optional |
|---|---|---|
| A host or receptionist creates a visit | At least one of email, first name or last name. The email is needed to send the invitation. | The remaining fields |
| The visitor opens the Visitor portal for the first time | First name and last name. The email is shown but can't be changed. | Company |
| A walk-in visitor registers at the Visitors kiosk | First name and last name | Company and host. If the visitor skips the host, the office's Default host is notified. |
deskbird does not collect:
- visitor photos (badges, the kiosk and the Visitor portal are text only),
- ID document data, such as ID type, number or scans,
- any identity verification. Visitors confirm their own details in the Visitor portal.
Pre-registered visitors check in at the kiosk with the visitor code from their invitation email or Visitor portal. The code is only used to find the visitor's visit. The QR code shown on a kiosk screen during setup is used to pair the device, not to identify visitors.
2. Consent and your own privacy notice
The first time a visitor opens their Visitor portal, they confirm their details and tick a consent checkbox for the privacy policy and data processing.
- The checkbox is required. Visitors can't continue without it.
- The wording is fixed. It is shown in the language the visitor selects in the portal.
- The checkbox links to the deskbird Privacy Policy. This link can't be replaced with a link to your own policy.
To give visitors your own privacy notice (for example, the information you provide under Art. 13 GDPR), add it as a document to your visit types. You need the Global administrator role for this.
- Go to Admin > Visits: Visit types and open a visit type.
- In the Documents section, click + Add.
- Choose Preview only to upload your notice as a PDF for visitors to read, or Requires signature to write it in the editor and have visitors sign it.
- Repeat for every visit type your offices use.
Visitors then see your notice in the Documents tab of their Visitor portal and at the kiosk during check-in. For details on both document types, see Document signing.
⚠️ Important: Invitation emails don't contain a link to a privacy notice, and you can't add one. Your notice reaches visitors through the Visitor portal and the kiosk only. Visitors who register as walk-ins at the kiosk see it during check-in.
3. Set how long visitor data is kept
By default, visitor data is kept without a time limit (Unlimited). You can set a retention period per office, after which deskbird anonymizes the visitor data of each visit automatically.
Before you start:
- You need the Global administrator role.
- Your company needs Visitors Plus (see Feature Availability).
To set the retention period:
- Go to Admin > Visits: Settings.
- Click the ⚙️ gear icon next to the office.
- Under Visitor data privacy, choose Unlimited, 30 days, 90 days or 180 days.
- Save your changes.
- Repeat for every office where you run Visitor Management.
The period is counted separately for each visit, from the visit's end time. A later visit by the same person doesn't extend it. For example, with 30 days, a visit that ended 40 days ago is anonymized, while the same visitor's visit from 5 days ago stays fully visible.
💡 Changing the period: A new period also applies to existing visits. If you shorten it, for example from Unlimited to 30 days, all visits that ended more than 30 days ago are anonymized within a day. The change doesn't take effect the moment you save it.
4. What happens when visitor data is anonymized
Once a visit's retention period has passed, deskbird anonymizes it automatically. Nobody needs to start or confirm this. The visit is then marked as anonymized and shows no visitor.
| Removed | Kept |
|---|---|
|
|
The visitor suggestions offered when someone creates a visit are cleaned up separately, based on when the visitor was last added to a visit at that office.
Whether anonymization meets your deletion obligations is for your data protection officer to assess. This article describes what the product does, not how to classify it legally.
5. Who can see visitor data
Access to visitor data depends on the role and, for receptionists, on the office they are assigned to.
| Role | Which visits they see | What they can do |
|---|---|---|
| Host (the person who created or organizes the visit) | Only their own visits, including the visitor's name, email, company, visit times, documents, visitor code and status | Create and manage their own visits |
| Office administrator | Only the visits they created or organize, like a host. Being an Office administrator doesn't give access to all visits at an office. | Create and manage their own visits |
| Visitor receptionist | All visits at the offices they are assigned to, with the same visitor details | Check visitors in and out, edit visitor details, print badges and export visits |
| Global administrator | All visits in all offices | Everything a receptionist can do, plus the Visits settings (including Visitor data privacy) and visit types |
The visitor dashboard, the list of visitors on site and the export are available to Visitor receptionists and Global administrators only. To give an Office administrator access to all visits at their office, also add them as a Visitor receptionist. Visitor receptionists are assigned per office in Admin > Visits: Settings (see Receptionist role and visitor dashboard).
⚠️ Important: Permissions apply to whole visits, not to single fields. You can't hide a field, such as the visitor's email, from hosts.
6. What notifications contain
Emails to visitors (invitation, update, reminder and cancellation) contain:
- your company name and logo,
- the visit title, date and time,
- the visitor's first and last name and their visitor code,
- the host's first and last name and email,
- the office name and address,
- the instructions of the visit type,
- the link to the Visitor portal.
Update emails can also list the titles of documents that were added to the visit.
Notifications to hosts (Microsoft Teams and email, for example when a visitor checks in or at the end of a visit) contain the visit title, date and time, the location and, for each visitor, the name, email, company and check-in or check-out time.
What you can adjust: your company name and logo, the instructions and documents of each visit type, and whether visitors are notified when a visit is saved or deleted. The email and Teams templates themselves can't be edited. For all notification types, see Notifications and reminders.
7. FAQs
No. The checkbox is required, its wording is fixed and it always links to the deskbird Privacy Policy. To give visitors your own privacy notice, add it as a document to your visit types (see Consent and your own privacy notice).
No. Invitation emails can't include a link to a privacy notice. Add your notice as a visit-type document instead. Visitors see it in their Visitor portal, which the invitation email links to, and at the kiosk.
No. The four standard fields (email, first name, last name and company) can't be turned off, and custom fields aren't available. You can add information for visitors through visit-type instructions, and ask visitors to confirm or sign something through visit-type documents.
No. deskbird doesn't capture photos, doesn't collect ID data and doesn't verify a visitor's identity. Printed badges show text only.
It is anonymized. The visitor's name, email and company are removed from each visit, while the visit itself (date, host, check-in times and so on) is kept. See What happens when visitor data is anonymized.
No. Hosts see all visitor details of their own visits. Permissions can't be set per field. Hosts never see visits of other hosts.
No. Office administrators see only the visits they created or organize, like any host. To give them access to all visits at an office, including the visitor dashboard and the export, add them as a Visitor receptionist for that office in Admin > Visits: Settings.
Visitor receptionists and Global administrators can open the visit on the Visits page and use Edit visitor (pen icon) to change the name, email or company. For details, see Receptionist role and visitor dashboard.
Visitor Management runs on the same deskbird platform as the rest of your deskbird account. For questions about hosting, subprocessors or your data processing agreement, contact your Customer Success Manager.