The GDPR law defines that all processing of personal data needs to be acknowledged by the data subject itself, escpecially in this case.
Since Bookings has no double opt-in feature, you are not in compliance with the law.
There is ofcourse an opt-out feature, but this only applies to people who's data you have already processed. Without a double opt-in there is no lawful processing possible, and as soon as somebody fills in name, last name and e-mail there is processing of some sort.
