When an operating agreement ends, the owner needs enough information to continue managing the property, while the outgoing operator must follow contract terms and data-protection duties. “Give us everything” is too vague; “delete everything” can also destroy records the owner or lawfully responsible controller needs. The exit plan should define data, format, timing, ownership, support and secure deletion before notice is served.
At Feathers Hospitality, these routines should connect with the Feathers Hospitality approach, its operating platform and contact with the team.
At a glance
- Confirm the request and availability before promising.
- Assign an owner, channel and next step.
- Record only necessary information and review the process.
Separate operational records from personal data
List reporting outputs, finance, reservations, guest communications, maintenance, supplier, asset, staff and compliance information. For each category, identify who controls it, who processes it, where it sits and what the contract says about access or return. These categories can have different retention and lawful-access rules.
Do not assume the owner owns every dataset simply because it concerns the property. Conversely, do not assume an operator may withhold an owner’s agreed management reports. Contract language, privacy roles and applicable law need to be reviewed together.
Define the continuing access the owner needs
Specify reports, dashboards, raw exports, dictionaries, schedules and supporting records needed for audit, future operation and open commitments. Include date range, fields, file formats, delivery schedule and secure transfer method. A PDF summary may not support a new operator’s reconciliation or trend analysis.
Ask for a sample export before exit to confirm that data is readable and complete. Identify proprietary software dependencies, licence restrictions and encryption keys that need a controlled transition. Do not ask for access credentials belonging to the outgoing operator or unrelated clients.
Set privacy and retention instructions
Map data-controller and processor roles for each activity. Under GDPR, processor contracts include terms about return or deletion of personal data at the controller’s choice, subject to legal retention requirements. Decide the choice, scope, deadline, backup treatment and proof of deletion with the data-protection lead.
A property sale or operator change does not automatically make every transfer lawful. Confirm the new party’s role, lawful basis, transparency and safeguards before guest or staff data moves. EDPB guidance and the signed processing agreement should inform the process; obtain legal advice for the specific arrangement.
Protect continuity while access changes
Create a transition calendar for reporting, bookings, supplier payments, open complaints, maintenance and future arrivals. Agree a period for questions and reconciliation, with named contacts and response targets. Avoid removing system access before the incoming team has tested its own accounts and integrations.
Use least-privilege temporary access, logging and a clear expiry date. Keep the outgoing operator’s access only as long as the agreement and purpose allow. At every stage, verify who can see or change guest records and financial data.
Reconcile records and open issues
Compare exported totals with source reports and inventory. Document missing periods, corrections, unresolved disputes, pending refunds, incidents and tasks that remain open. A handover certificate should state what was transferred and which items remain subject to a decision, without implying that the data is error-free.
Agree how late corrections will be delivered and who approves them. Preserve an audit trail of versions and acknowledgements. Store the exit pack in a controlled repository accessible to the owner and incoming operator as authorised.
Close the relationship securely
After the agreed transfer, revoke credentials, recover keys and devices, close integrations and receive confirmation of deletion or continued retention where required. Track exceptions with a legal basis, owner and review date. Avoid keeping data indefinitely “just in case.”
Review whether the exit clause worked and update future operating agreements with clearer export, transition support and deletion provisions. UK ICO and EU EDPB guidance address privacy processing; business reports, intellectual property and commercial records also require explicit contract treatment.
Frequently asked questions
How can a team confirm the request was handled?
Check the record, confirm with the responsible team and, where appropriate, ask the person whether the response was useful. A closed status is not a substitute for verification.
What if there is no immediate solution?
Explain what can be confirmed, identify who will review the issue and agree a realistic update time. Do not promise an outcome before it is validated.