Each user independently gives permission to collect this data?
As far as I understand, no. This may be legally justified: Information about purchases and orders belongs not only to the buyer, but also to the seller of the product or service.
All information of the user has a hotel and a booking platform. Booking platform has information about many users. That is why the security in such case is very important.