GDPR and loyalty programmes: what your business has to comply with

First things first

This article is a general guide for small businesses, not legal advice. If you have questions about your specific case, ask your accountant or a data protection professional. Your country’s data protection authority usually publishes free guides for small businesses.

Ask only for what you need

This is the principle of data minimisation: collect only the data essential for what you’re going to do. For a loyalty card, a name and an email or phone number to identify the customer and recover their card is usually enough. Birthday only if you’re going to send greetings, and make it optional. Asking for an ID number, address or full date of birth for a free coffee is excessive.

Two different permissions

This is where the most common mistake happens. They are two different things and should be kept separate:

• Using their data for the card: stamps, rewards, notifications about their own programme. The customer must be informed with a clear privacy policy before signing up.
• Sending them offers and advertising: this needs separate consent, a box the customer ticks themselves that isn’t pre-ticked. If they don’t tick it, they can still have their card, but don’t send them promotions.

Letting customers have the card without accepting advertising matters: making one conditional on the other is frowned upon.

Inform clearly

At sign-up, the customer must know who is responsible for their data (your business), what it’s used for, how long it’s kept and how to exercise their rights. A short text on the form with a link to the full policy is the norm.

Their rights

Your customers can ask you at any time to see their data, correct it, delete it or object to its use for advertising. You have to respond within one month. In practice, with a digital card this is easy: you find the customer and correct or delete their profile.

How long to keep it

While the customer uses the card, keeping it makes sense. If someone hasn’t appeared for a long time, it’s reasonable to set a period and delete or anonymise their data. Decide on a period and put it in your privacy policy.

If you use an external platform

When a company stores your customers’ data for you, it acts as a data processor, and you need a contract that governs this. Also check where the data is stored and what security measures are in place.

At Fidelizando your customers’ name, email and phone number are stored encrypted in the database, sign-up asks for acceptance of the privacy policy and, separately, permission to receive offers. You can export your customers whenever you want. It’s explained in our privacy policy.

Quick checklist

• Ask only for a name and one contact; the rest optional.
• A separate, unticked box for offers.
• Privacy policy visible before sign-up.
• Respond to customer requests within a month.
• Set a period to delete customers who don’t return.
• A contract with the platform that stores the data.

Frequently asked questions