You are the controller, not your software
Under Article 4 of the GDPR, the controller is whoever decides why and how personal data is processed. For a reservation taken at your venue, that is you. Your booking platform is a processor: it holds the data and acts on your instructions, which is why it must give you a data processing agreement under Article 28.
This matters practically. A guest exercising their rights writes to you, not to your software vendor, and the deadline to answer is one month under Article 12(3). If your platform cannot let you find, export or delete one guest’s records quickly, that is your compliance problem, not theirs.
What a booking record may contain
Data minimisation (Article 5(1)(c)) says you collect what is adequate, relevant and limited to what is necessary. For a table booking that is realistically a name, a contact method, the party size, the time, and whatever the guest volunteered.
Allergies and dietary requirements deserve care. Health data is a special category under Article 9 and normally prohibited unless an exception applies, most usefully the guest’s explicit consent. In practice a guest telling you about a nut allergy so you do not kill them is giving that consent, but it means the note exists to serve the meal, not to be analysed later or kept for years.
Free-text notes are where venues get into trouble. "Difficult, complained last time" is personal data the guest can ask to see under the Article 15 right of access. Write notes you would be comfortable reading aloud to the person they are about.
Deciding when to delete
There is no GDPR retention period for restaurant bookings, because the GDPR does not set periods. It requires you to set one and be able to justify it (Article 5(1)(e)).
The workable approach is to separate purposes. Operational booking records serve the booking and a reasonable window afterwards for disputes and no-show history. Accounting records for deposits and prepayments are kept for whatever your national tax law requires, which is longer and is a legal obligation rather than your choice. Marketing contacts last as long as the consent does.
Write the periods down, even briefly. An authority asking about retention is really asking whether you ever thought about it.
A booking is not consent to market
The most common mistake is treating everyone who ever booked as a mailing list. Taking a reservation gives you a lawful basis to contact that guest about that reservation. It does not give you one to send them a Sunday-lunch promotion.
Marketing email is governed by the ePrivacy Directive as implemented in your country, which generally requires prior consent, with a narrow soft-opt-in for your own similar products to existing customers, always with an easy unsubscribe. If you are unsure whether your list has consent, the honest position is that it does not.