Yes, a small Belgian shop can run a loyalty club in line with the GDPR, provided it collects only useful data and has a legal basis for each purpose. For the card itself, the contract is in principle enough; for promotional messages, provide for the customer’s consent.
It is less complicated than it sounds. This guide goes through which data to ask for, which legal basis fits each use, what to tell members and how to handle a deletion request. A ten-point checklist closes the article.
What data does a loyalty club really ask for?
The basic rule of the GDPR is minimisation: you don’t collect more than you need. For a stamp card, that is surprisingly little.
To make the card work, you generally need:
- A first name, so the team can greet the customer and check that the right card is being scanned.
- An e-mail address, to recover the card if the phone is replaced and to let them know a reward is waiting.
- The stamp history, that is when a stamp was added and when a reward was used. Without that, there is no card.
What you normally shouldn’t ask for: national register number, postal address, phone number, gender, date of birth. Every extra field is data you must justify, protect and mention. A shorter form is also quicker at the counter: more customers sign up.
Which legal basis for which use?
The GDPR asks you to choose a legal basis for each purpose. For a loyalty club, two come up often.
| Purpose | Usual legal basis | Note |
|---|---|---|
| Making the card work (stamps, rewards) | Contract (art. 6, 1, b) | The customer asked for the card |
| Promotional messages, news | Consent, to be collected separately | Optional box, not pre-ticked |
| Internal statistics on visits | Legitimate interest or contract, as the case may be | Keep it modest and transparent |
For promotional e-mails and messages, the Belgian rules on electronic communication come on top of the GDPR and in principle require prior consent, with limited exceptions. The safest approach is to treat any promotional notification, including on an Apple Wallet or Google Wallet card, like an e-mail: send it only to customers who said yes.
What do you tell members?
Articles 13 and 14 of the GDPR require clear information. For a small club, a short privacy policy is enough, reachable from the sign-up. It states:
- who you are and how to contact you,
- which data you collect and why,
- on what basis (contract, consent),
- how long you keep it,
- who you share it with, for example your card provider,
- the customer’s rights: access, rectification, deletion, withdrawal of consent, complaint to the APD/GBA.
Write it in plain English, and in French and Dutch if you also serve French- or Dutch-speaking customers.
How do you handle a deletion request?
A customer can ask for their data to be erased. In principle you must reply within one month (art. 12 of the GDPR). In practice:
- Check who is asking, for example from the e-mail address linked to the card.
- Delete the card and the associated data, or anonymise what must be kept for a legal reason.
- Confirm in writing to the customer.
Also set a default retention period. A simple rule, such as deleting cards with no activity for two years, is easier to defend than keeping everything indefinitely.
What about the card provider?
You are the controller: you decide why and how the data is used. The digital card provider is a processor, and the GDPR (art. 28) requires a written contract with them. Check where the data is hosted, how it is protected, whether you can export it and what happens at the end of the contract. In the event of a personal data breach, the controller must in principle notify the APD/GBA within 72 hours (art. 33): your processor must therefore tell you without delay.
Ten-point checklist
- I only ask for first name and e-mail, unless I have a specific need.
- The card rests on the contract, not on forced consent.
- Promotional messages sit behind a separate, optional, not pre-ticked box.
- I have a short privacy policy, in my customers’ languages.
- I have a processing agreement with my provider.
- I know where the data is hosted.
- I have a retention period and I stick to it.
- I know how to handle an access or deletion request within a month.
- My team knows not to copy the customer list into a personal spreadsheet.
- I know that in the event of a breach, I must react fast and notify the APD/GBA if necessary.
In short
A loyalty club is compatible with the GDPR: little data, a clear legal basis per use, the customer’s consent for promotion and a contract with your provider. To understand what the card costs, read what a digital loyalty card costs, or go back to the home page. When you send notifications, also see how to avoid annoying your customers with push messages.