A loyalty program collects names, contact details and a record of when someone visits you. In Europe that is personal data, and running the program makes you a data controller with real obligations. The good news: for a small venue the duties are modest and mostly common sense.

This is a practical summary, not legal advice. For anything unusual — health data at a clinic, children's data, large-scale profiling — talk to a data-protection lawyer.

You are the controller, your software is the processor

You decide why the data is collected and what happens to it, which makes you the controller. Your loyalty platform acts on your instructions, which makes it a processor. You should have a data processing agreement with them. If a provider cannot produce one, that is a serious answer.

Separate the two consents

This is the mistake that causes the most trouble. Joining a loyalty program and agreeing to receive marketing are two different things, and they need two different choices.

  • Running the program — awarding stamps, tracking visits, issuing the card — is generally performance of a contract. They asked for a loyalty card; you are providing it.
  • Marketing messages need consent, freely given, specific and unbundled. A pre-ticked box is not consent. Making membership conditional on accepting marketing is not consent either.

In practice: one tick box, not pre-ticked, clearly worded, and the card works whether or not they tick it.

Collect only what you use

Data minimisation is a legal principle and also just good sense. If you never run a birthday campaign, do not collect birthdays. Each field you add is one more thing to justify, secure and eventually delete.

Tell people what is happening

At the point of joining, in plain language: who you are, what you collect, why, how long you keep it, who else sees it, and how to opt out or be deleted. A short notice with a link to the full policy is fine — it does not need to be a wall of text on the form itself.

Be able to honour the rights

Members can ask to see their data, correct it, take it elsewhere, or have it erased, and you generally have a month to respond. Practically this means your system needs two buttons: export this customer, and delete this customer. Check yours has them before you need them.

Note that erasure is not absolute — you can keep what you are legally required to keep, such as transaction records for tax.

Do not keep it forever

Set a retention rule and apply it. A common approach is to delete members who have not visited in two or three years, after a final message offering them the chance to stay. Keeping a list of people who stopped visiting in 2019 has no business value and is pure liability.

Keep it secure, and know what to do if it leaks

Strong passwords, access only for staff who need it, and a provider that stores data in the EU. If there is a breach that risks people's rights, you generally have 72 hours to notify your supervisory authority. Know who yours is before something happens.

A short checklist

  1. Data processing agreement with your provider.
  2. Marketing consent separate, unticked, and not required to join.
  3. Privacy notice linked from the join form.
  4. Only the fields you actually use.
  5. Export and delete available per customer.
  6. A written retention period, actually enforced.
  7. Unsubscribe in every marketing message.

Loyalito is built in Europe with these defaults in place — see our privacy notice for how we handle the processor side.