"I'm very glad that they've never scanned any of my credit cards, nor any of my ID documents, and if it's left up to me, they never will"
I'd like to think that's the case for me too, but one can never be sure just who runs that hotel you booked. Is a sub-brand or sub-sub-brand or recent acquisition of some global brand? In my case, it's quite unlikely. The only hotels I've been booked into in the last 10 years have been for business and booked through my employer so they should only have my name and my employers details, possibly my mobile phone number (also provided by my employer)