The data stored in a company's CRM belongs to the company, as long as it is collected and stored according to the terms of the DPMR. Whether it concerns customers or suppliers.
We can distinguish 2 categories of data that a hotel can be confronted with:
First-party data
These data belong to the company and are collected by means of a newsletter, a contact form or the check-in for example. They can include purchase history, customer interactions, contact details etc.
The CRM consists of first-party datas that belong to the company.
Third-party data
This is data that does not belong to you at all, but with which you interact. This is for example the case for advertising on social networks, you have access to targeting criteria based on information that you do not have, you only use it. If the guest interacts directly with the hotel and gives you their personal data, then this data will become first-party data and will belong to you.