Controller or processor?
- The controller decides why and how personal data is used. For a loyalty programme, that is the shop: it chooses to run a card, which reward to offer, which messages to send.
- The processor carries out the work for the controller: storing the data, issuing the cards, sending the messages. It may not use the data for its own purposes.
Article 28 of the GDPR requires a written contract between the two, the data processing agreement (DPA). It sets out what the processor does, its security measures, the sub-processors it uses (hosting, e-mail) and what happens to the data when the contract ends.
Why does it matter for a shop?
As controller, the shop remains responsible towards its customers. It must choose a processor that offers sufficient guarantees and have a DPA in place. Customers who want to see or erase their data address the shop, and the processor helps it answer.
How does Fidelia handle it?
For your customers’ data, Fidelia acts as your processor under a data processing agreement that is part of the terms you accept at signup. The data is hosted in the EU. Fidelia uses it only to run your cards and send the messages you ask for; you can export it to CSV and erase any customer, which voids their cards in both wallets.