Centralize the guest-facing check-in flow and the underlying data model; decentralize the actual filing. That’s the single rule that resolves most of the confusion multi-country property management companies run into: every national guest-registration system authenticates as the individual operator or property, not as a head-office account, so a portfolio spanning several countries needs per-property credential management, submission receipts kept as legal proof, and country-specific retention policies — not one uniform process copied across every border.
This guide covers portfolio-scale operations specifically. If you’re adding a second country to a smaller operation for the first time, our guide on running properties across multiple countries covers that earlier stage; this one picks up once you’re managing credentials, receipts, staff roles, and retention across a real portfolio.
Why doesn’t one process work across countries?
The instinct at portfolio scale is to standardize everything — one check-in flow, one filing cadence, one retention policy, applied identically everywhere. That instinct breaks on contact with how these systems are actually built: each country’s guest-registration system was built independently, by a different authority, with its own authentication model, deadline, and data requirements. A single “compliance process” document can describe the outcome you want in every country, but the actual mechanics of filing have to be per-country by construction, not by choice.
Who legally holds the reporting credentials?
This is the detail that trips up centralization plans built without checking it first: most systems issue credentials at the property or establishment level, not the organization level.
- Czechia’s UbyPort issues access per accommodation facility.
- Italy’s Alloggiati Web requires per-structure credentials and a WSKEY specific to that property.
- Croatia’s eVisitor credentials are issued by the local tourist board per property, tied to that property’s categorization.
Head office can absolutely hold and manage all of these credentials centrally in one system — but the system needs to know which credential belongs to which property, and use the right one for each submission. Treating credentials as one shared organizational secret rather than per-property records is the most common way multi-country portfolios get a submission rejected or, worse, submitted under the wrong property’s identity.
What counts as proof that a report was actually filed?
A prepared report is not the same thing as a filed one, and at portfolio scale the difference matters enormously during an inspection. The artifact that actually protects you is the submission receipt — the confirmation the government system itself returns once a report is accepted, timestamped and tied to that specific property and guest. Keep the machine-readable receipt, not just a human record that “someone filed it.”
How long must guest records be kept?
Retention periods vary by country far more than most portfolio compliance policies account for:
| Country | Typical retention |
|---|---|
| France | 6 months |
| Germany, Slovenia | 1 year |
| Spain | 3 years |
| Slovakia (tax records) | 5 years |
| Czechia | 6 years |
| Austria | 7 years |
A single company-wide retention policy set to the shortest period risks deleting records a longer-retention country still legally requires; a policy set to the longest period keeps data in short-retention countries well past when it should be deleted, which is its own GDPR minimization problem. Retention has to be tracked per property’s country, not set once for the whole portfolio.
What do fines look like at portfolio scale?
Per-violation fines that look manageable for a single property compound quickly across a portfolio:
- Spain: €601–30,000 per missing report.
- Croatia: €660–6,600 per violation.
- Italy: fines tied to the CIN registration requirement up to €8,000, alongside separate Alloggiati Web reporting duties.
- Czechia: up to 50,000 Kč per violation.
- Poland: proposed fines up to PLN 50,000 under the draft short-term rental register law.
Multiply any of these by the number of properties in a country where a systemic gap goes unnoticed, and a compliance oversight that would be a rounding error for one host becomes a material liability for a portfolio.
What should head office own versus property-level staff?
A workable split: head office owns the platform, the data model, the credential vault, and the aggregate compliance visibility across the whole portfolio. Property-level staff (or an automated system acting on their behalf) owns the guest-facing check-in itself and any submission step that’s legally bound to an on-the-ground identity. Trying to centralize the parts that are legally required to stay local — like Slovakia’s eID-bound submission — creates compliance risk rather than removing it.
How Best Guest helps
One account, properties organized per country, each property’s rules — credentials, deadlines, retention — applied automatically rather than configured by hand. Filing is automated where an official system accepts application-level credentials, like Czechia’s UbyPort; where a system legally binds submission to the operator’s own identity, like Slovakia’s, Best Guest prepares the report ready to file rather than overstating what can be automated. Every submission generates a receipt kept alongside the guest record for exactly as long as that property’s country requires. See our solutions for property managers for how this applies to a multi-country portfolio specifically, or the developer API if you’re integrating this into your own platform.
Frequently asked questions
Can head office file guest registration reports for all properties from one login?
Operationally, yes — a good platform gives head office a single dashboard. But the underlying government systems almost always authenticate as the individual property or operator, not as a head-office account, so the platform needs to store and use each property's own credentials correctly behind that single login, and log exactly which property's credentials were used for which submission.
Do we need local staff to handle police reporting in every country?
Only where submission is legally bound to the operator's own personal identity — Slovakia's slovensko.sk reporting flow, for instance, is tied to the operator's own eID, which limits how much of that specific submission can be delegated or automated by a third party. Where a system accepts application-level credentials instead (like Czechia's UbyPort), no local staff member needs to be involved in the submission itself.
What should we archive to survive a government inspection?
Three things, per property: the guest register itself, the submission receipts proving each report was actually filed (not just prepared), and the source documents the register was built from. Keep all three for the longest retention period that applies to that property's country — Austria's 7 years is the longest in this comparison.
Does GDPR conflict with keeping guest records for years?
No — Article 6(1)(c) of GDPR provides the legal basis precisely for processing required by another legal obligation, which is exactly what national guest-registration retention rules are. The GDPR-compliant approach is to keep only the data each country's law actually requires, for exactly as long as that law requires it, not to minimize retention below what the law demands or extend it beyond that out of caution.
Sources
Verified against
Informational only
This page is provided for general information and is not legal or tax advice. Rates, deadlines and exemptions are set by law and municipal ordinances and can change — always verify current requirements with your municipality or a qualified advisor.