GDPR
GDPR, the General Data Protection Regulation, is the EU law that sets how businesses collect, use and keep personal data. A loyalty program collects names, email addresses and visit history, so a café, salon or restaurant that runs one has to follow it.
What GDPR is
GDPR (Regulation (EU) 2016/679) has applied in every EU country since 25 May 2018. It gives people rights over their data, such as seeing it, correcting it and having it deleted, and it asks businesses to collect only what they need, say why they collect it and keep it safe. The business that runs the loyalty program is the controller of its customers' data. A software provider that stores the data on its behalf is a processor, and the two sign a data processing agreement.
How it works for a café, salon or restaurant
- A café asks for a name and an email address at signup, and for a birthday only if it really sends birthday rewards.
- A salon sends offers only to clients who agreed to receive marketing messages.
- A restaurant that changes loyalty provider exports its customer list first and makes sure the old copy is deleted.
Rewardly is GDPR compliant, hosts the data in the EU, offers a data processing agreement and never sells or shares customer data. When a business sends messages, customers without marketing consent are left out automatically.
What to watch
Keep membership and marketing consent apart: joining a loyalty card is not agreement to receive offers. Write a short privacy notice that says what you collect and why, and answer requests to see or delete data promptly, because the law gives one month. Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, but for a small business the bigger risk is losing its customers' trust. This page explains the basics and is not legal advice.