Yes, a small business in Sweden can run a loyalty club (kundklubb) under GDPR, as long as it collects only the data it needs and has a legal basis for each purpose. For the card itself, contract is usually enough, while marketing e-mails need consent under section 19 of the Marketing Practices Act (marknadsföringslagen), unless the existing-customer exception applies.
It sounds more complicated than it is. This guide covers what to ask for, which legal basis fits which purpose, what you must tell members and how to handle deletion. At the end there is a ten-point checklist you can work through over a coffee.
What data does a loyalty club actually need?
The basic rule in GDPR is data minimisation: you may not collect more than you need for what you are doing. For a stamp card or punch card (klippkort), that turns out to be very little.
To run the card you usually need:
- First name, so staff can greet the customer and see that the right card is being scanned.
- E-mail address, so the customer can get the card back after changing phones and be told when a reward is waiting.
- Stamp history, meaning when the card got a stamp and when a reward was claimed. Without it there is no card.
What you normally do not need: personal identity number (personnummer), home address, phone number, gender or date of birth. Every extra field is something you must justify, protect and explain. A shorter form is also quicker to fill in at the counter, so more customers actually join.
Which legal basis applies to what?
GDPR requires a legal basis for every processing of personal data. IMY lists six: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. For a loyalty club, three are relevant in practice.
IMY points out that consent is often not the most appropriate basis and that you should consider the others first. Many small businesses do the opposite and ask for consent to everything. The problem is that consent must be freely given and can be withdrawn at any time. If a customer withdrew consent to the card itself, the card would stop working, so the consent was never really free. Contract fits the core of the loyalty club better: the customer joins to collect stamps, and you process the data needed to deliver that.
| Purpose | Data | Legal basis |
|---|---|---|
| Running the stamp card | First name, e-mail, stamps | Contract, art. 6(1)(b) |
| Telling a member a reward is waiting | E-mail or a notice on the pass | Contract, art. 6(1)(b) |
| Newsletters and offers | Consent, art. 6(1)(a), or the exception in MFL section 19 | |
| Anonymous visit statistics | Stamp history without names | Often legitimate interests, art. 6(1)(f) |
| Bookkeeping of sales | Receipts, not the loyalty club | Legal obligation, art. 6(1)(c) |
Treat the table as a starting point, not a final answer. What matters is that you have thought through each purpose and can explain why that basis fits.
What are the rules for marketing by e-mail and push?
Two sets of rules meet here. GDPR governs how you handle the data, and the Marketing Practices Act governs when you may send advertising by electronic mail to private individuals.
Under section 19 of the Marketing Practices Act, you may only send marketing by e-mail to a natural person who has consented in advance. There is an exception for existing customers. It applies only if all of these conditions are met:
- You obtained the e-mail address when selling a product or service to the customer.
- You are marketing your own similar products or services.
- The customer has not objected to the address being used this way.
- The customer was clearly offered a simple, free way to say no when the address was collected, and gets the same option in every message.
The exception sounds convenient, but for a loyalty club where people join via a QR code without necessarily buying anything at that moment, it is not always met. The simple route is an optional tick box on the form that is not pre-ticked. That gives you consent that is easy to show.
Whatever the basis, section 20 requires every marketing e-mail to contain a valid address the recipient can use to ask for the mailings to stop. In practice, that means a working unsubscribe link.
Lock-screen notifications through Apple Wallet or Google Wallet are not explicitly mentioned in the law, and it is not obvious how they should be assessed. The safest approach is to treat campaigns and news there the same way as e-mail: only for those who ticked the box.
What must you tell members?
Article 13 of GDPR requires you to inform customers when the data is collected, meaning directly on or next to the form. The information must be concise and easy to understand. Among other things it should cover:
- who is responsible, with the business’s name and contact details,
- the purposes the data is used for and the legal basis for each,
- who receives access, for example the digital card provider,
- how long the data is kept, or how you decide that,
- that the customer has the right to access, correct and erase their data, object to direct marketing and withdraw consent at any time,
- that the customer can complain to IMY.
One sentence by the form plus a link to a full privacy notice works well. Write in plain language, without legal detours. If most of your customers speak Swedish, write it in Swedish and offer an English version.
Who is the controller and who is the processor?
You, running the salon, café or shop, are the controller. You decide why the data is collected and what it is used for. The digital card provider is the processor: it processes the data on your behalf and according to your instructions.
Article 28 requires a written contract between you, a data processing agreement (personuppgiftsbiträdesavtal). It must state, among other things, that the processor only handles the data on your instructions, protects it, helps you when customers exercise their rights and deletes or returns the data when the relationship ends. Always ask for the agreement before you start, and check where the data is stored. Storage inside the EU keeps things simpler.
How do you handle deletion and objections?
Article 17 gives customers the right to have their data erased, for example when it is no longer needed, when consent is withdrawn or when the customer objects. For a loyalty club, that means you should be able to remove a member completely, quickly and without fuss. An e-mail from the customer saying they want to leave should be enough.
Article 21 gives customers the right to object to direct marketing, and that right is unconditional. If someone says no to advertising, you cannot weigh that against your interest in sending it. The data may no longer be used for that purpose. The card itself can keep working, because it rests on the contract.
Also set a retention rule. GDPR says data must not be kept longer than necessary but gives no fixed period. A reasonable rule might be to remove cards that have not been used for two years. Put the rule in your privacy notice and add a reminder to your calendar.
Checklist: GDPR for your loyalty club
- The form asks only for what the card needs, usually first name and e-mail.
- You have written down the purpose and legal basis for each piece of data.
- The card itself rests on contract, not consent.
- News and offers require an optional tick box that is not pre-ticked.
- Every marketing e-mail has a working unsubscribe link.
- The article 13 information is visible by the form, with a link to your privacy notice.
- You have a written data processing agreement with the card provider.
- You know where the data is stored and which staff see what.
- You can delete a member completely in a few minutes.
- You have a retention rule and follow it.
How does Fidelia handle this?
If you use Fidelia, much of the list is already in place, but responsibility for the loyalty club remains yours. Here is how it works:
- Short form. The customer scans the QR code and enters first name and e-mail, the data needed for the card to work. The card then goes into Apple Wallet or Google Wallet.
- One optional tick box. The form has a single box for news from your shop. Campaign e-mails and lock-screen messages reach only those who ticked it, while notices that a reward is waiting reach everyone.
- Unsubscribe. Every e-mail has a one-click unsubscribe link, and the card keeps working afterwards. There is no open-tracking pixel.
- Delete customer. When you delete a customer, name and e-mail are removed at once and the card in their wallet is voided. The anonymous stamp history stays for statistics.
- Limited access. Staff see only first names. Owners and managers see e-mails and history.
- EU hosting and DPA. Data is stored in the EU, in Frankfurt. Fidelia is the processor, and the data processing agreement is part of the terms. You can read it on the data processing agreement page. Fidelia never sells data or uses card holders’ data for its own marketing.
For more on how a digital card works in practice, see the complete guide to digital loyalty cards or how to run a loyalty club without an app. Prices are on the pricing page.
The short version
A loyalty club and GDPR fit together well. Ask for little, let the card rest on contract, ask for a clear yes to news, tell people what you do and delete when someone asks. Do that and you have covered most of what matters, and your customers can trust that their data is handled with respect.