Loyalty cards and GDPR: what a shop owner needs to know

The scene always comes at the same moment: the customer has scanned the QR, the add screen is in front of them, and they look up. “What exactly do you keep?” If you hesitate, they don't add the card. The good news is that the answer fits in one sentence, provided you have prepared it.

On Digikart, a loyalty card contains a card identifier, which says nothing about its holder, a balance of stamps or points, and the dates of visits. If you count in points based on the amount spent, the amount of each visit is recorded with it, and it shows up in your statistics and in your export. Added to that are the wallet used, Apple or Google, and, once the card is installed, the device's registration with the notification service. Three fields can be added, and only if the customer fills them in themselves: their first name, their phone number (to be recognised at a till without a scanner) and their date of birth, which only appears if you have turned on the birthday reward. Each one is marked “optional” on the sign-up screen. No banking data is collected, and the detail of the items purchased is never recorded: even when connected to a till, only the receipt reference and its amount come through.

The comparison with large retailers sheds light on the subject. The CNIL (the French data protection authority) points out that in a loyalty programme, the barcode of a purchased product, combined with the customer's identifying information, becomes personal data that the customer can request. A stamp card does not go that far: it counts visits and, at most, their amount, never the contents of the basket. The less you collect, the less you have to explain, keep and protect.

The GDPR requires every processing of data to rest on a legal basis, chosen from those it provides for. The term is scary, the reality much less so: for a loyalty card, the most natural basis is performance of a contract. The CNIL accepts the contract as a basis provided the processing is objectively necessary to perform it, and that is the case here: the customer asked for the card, you promise them a reward after ten visits, and counting their visits is necessary to keep that promise. There is no box to tick for that. The optional fields fall outside this framework: the phone number and the date of birth are not used for counting, they rest on what the customer agrees to give, and they can ask you to remove them without losing their card.

What changes in nature is everything that goes beyond the programme. Sending a commercial message that has nothing to do with the card is direct marketing. The CNIL is clear on this point for electronic contact details: you must obtain the customer's consent, and keep proof of it. Renting out or sharing your file with a partner follows the same logic, and is even more serious.

The practical rule fits in one line. Everything that serves the card (counting, letting them know a reward is ready, reminding them of a balance) travels with the card. Anything about something else deserves a question put to the customer, separately, and a record of their answer.

This is the easiest obligation to meet and the one most often forgotten. The CNIL states in black and white that you must provide “an information notice on each collection form”, and the example it gives is exactly ours: the loyalty card application slip left on the shop counter.

With a Wallet card, that counter has become the sign-up page that opens after the QR is scanned. This page does not display your notice for you: it remains your responsibility, on the poster next to the till and on your website. The notice must say who you are, why you collect this information, on what basis, who has access to it, how long you keep it, that the fields are optional, how the customer can exercise their rights, with a contact address, and that they can lodge a complaint with the CNIL. Nine lines, not nine pages.

In practice: a few lines on your counter poster, the same on your website if you have one, and a sentence your employees know how to say. It is not a lawyer's contract, it is a text the customer must be able to read in ten seconds with their phone in one hand.

The GDPR sets no universal retention period. The CNIL points out that it is up to whoever is responsible for the file to set one according to the purpose of the processing, that is, what the data is used for. It does still give a benchmark. For data about a customer used for direct marketing, its reference framework sets retention for the duration of the commercial relationship, then for three years from the end of that relationship. And its fact sheet for shop owners uses the same period for customer relations: plan to delete information when your customers have been inactive for a long time, three years from the end of the commercial relationship.

For a loyalty card, the end of the commercial relationship is the last visit. A customer who has not come back in three years no longer has any reason to be in your dashboard. The period is yours to decide, but you must set one and stick to it: a period that is written down and respected is better than a file that never empties.

Doing it takes five minutes once a year. In Digikart, your customer list shows the date of the last visit: you spot the inactive ones and delete them. Deleting erases the record, the balance and the visit history, and removes the device's registration with the notification service. Two useful clarifications: the card already installed stays visible on the customer's phone, because neither Apple nor Google lets you remove it remotely, but it can no longer be scanned and no longer updates; and if you are connected to a till, the payment lines are kept for the accounts, no longer pointing to anyone once the record is deleted.

Two rights stand out because they are the ones customers actually use. The right of access: knowing what you hold about them. The right to erasure: asking for it to disappear. The CNIL states that you must reply as quickly as possible, and within one month at most, a period that can be extended to three months for a complex request, provided you inform the person within the first month.

Replying is not just a matter of copying out the contents of the record. The CNIL lists what the reply must contain: the purposes of the processing, the categories of data concerned, the recipients, the retention period, the person's other rights and their right to lodge a complaint with the CNIL. It also specifies that you cannot simply tell the customer that you hold the data they provided themselves.

Finally, there is one confusion worth knowing about, because it happens often. A customer who deletes the card from their Wallet has removed the card from their phone, not their line from your file. If they want erasure, they have to ask you, and you are the one who deletes it. You may as well tell them when they add the card.

A Wallet card can display a message on its holder's phone. No SMS, no email, no number to know: the message goes through the card itself. It is very handy, and that is precisely where things go wrong.

The channel is not the issue, the content is. “Your reward is ready” concerns the card the customer asked for. “Big clearance sale on Saturday” is advertising. Between the two, the tolerance is thin, and one notification too many does not end in a complaint: it ends in a deleted card, which is far worse for you.

The customer stays in control on their side: they can turn off this card's notifications in their phone settings, or remove the card. Tell them, it reassures more than it scares people off. On the tool side, our terms and conditions state it clearly: the shop owner is solely responsible for the content of the notifications they send.

This is the obligation that surprises small businesses the most. The CNIL is explicit: keeping a record of processing activities applies to all organisations, public or private, whatever their size, as soon as they process personal data. A neighbourhood shop with a loyalty card is included.

There is a lighter regime below 250 employees: the only processing that has to appear in it is processing that is not occasional, processing that may present a risk to people, and processing that involves sensitive data. The CNIL actually cites customer management as an example of non-occasional processing. So your loyalty file goes in.

In practice, it is a table. One line per processing activity, with its purpose, the people concerned, the categories of data, the recipients, the retention period and the security measures. The CNIL provides a template designed for micro, small and medium-sized businesses. Nobody will ask you for it, until the day someone does.

The split is easy to remember. The tool hosts, encrypts and secures. You decide what you collect, what you tell your customers, what you send and what you keep. Software cannot be compliant on your behalf, because half of the decisions are yours.

What Digikart does on its side is set out on the privacy policy page: servers hosted in France by OVH, no data sold to third parties, no advertising cookies or third-party tracking, passwords never stored in plain text, encrypted communications, daily backups. A shop owner can delete their account and their data from their account area.

What falls to you is in our terms and conditions, article 8: informing your end customers about the processing of their data and obtaining the required consents. This is not a way of passing the buck, it is the reality on the ground. You are the one facing the customer, you are the one who chooses the reward, the message and the retention period. The rest of the practical questions are covered in the FAQ.