Loyalty card GDPR: what data protection law asks of a small shop

Loyalty card GDPR: who is responsible for customer data?

For loyalty card GDPR questions, the first step is working out who decides what happens to the data. As a rule it is the business offering the card: it is the data controller, must respect the principles in Article 5 of Regulation (EU) 2016/679, the GDPR, and must be able to show that it does. The provider of the software that hosts the cards usually acts as a processor, under a contract that, as the Italian authority (the Garante) points out, must meet Article 28.

With Iterum, the notice customers open from their own card names the shop as controller and FIDUS S.R.L. as processor, providing the platform. Customers do not have to tick any box to get the card: by adding or creating it they accept the card Terms and confirm they have read the notice, while extra rewards and offers are a separate, optional choice, «Yes, I want them» or «No, thanks». Fidus is an independent controller only for consents to Iterum news given in the past: Iterum no longer collects them.

This guide summarises official sources for people running a small business, with Italian sources because Iterum serves Italian shops. It is not legal advice: for your own case, ask a privacy adviser or your accountant. Outside Italy, check your own national rules and authority.

What data should a loyalty card ask for?

The data minimisation principle in Article 5 of the GDPR asks for data that is adequate, relevant and limited to what is needed. For loyalty cards the Garante had already spelled this out in its general provision of 24 February 2005: for loyalty purposes alone, only the data needed to grant the card’s benefits may be processed, meaning the data that identifies the cardholder and, where really needed, the total amount spent, without details of individual products.

For a stamp card the essential data is often a single fact: that this card has collected these visits, such as the breakfasts on a loyalty card for cafés or the haircuts on a loyalty card for barbershops. A name, email or phone number can help staff recognise the customer or recover the card after a phone change; a date of birth only makes sense if you genuinely offer a birthday reward. Ideas for choosing the reward are in the guide to loyalty card reward ideas.

Do customers need to consent to a loyalty card?

For the card itself, normally not. Article 6 of the GDPR provides several legal bases besides consent, including performance of a contract and legitimate interests. In 2005 the Garante wrote that processing for loyalty purposes in the strict sense is necessary to perform the contract with the customer and that, in that case, it is not correct to ask for consent.

Consent is needed instead for what goes beyond the card: profiling and marketing. The 2005 provision requires specific, informed and separate consent for each of these purposes, and states that joining the scheme cannot be made conditional on that consent. The Garante’s summary of controllers’ duties adds, under Article 7 of the GDPR, that consent must be distinguishable from other requests, can be withdrawn and is never implied: no pre-ticked boxes.

In the Iterum card notice, running the card rests on performance of the card contract, whose Terms the customer accepts by adding or creating the card, with no box to tick, while the shop’s offers are a separate, optional consent: the card asks «Would you like extra rewards and offers from …?» and the customer answers «Yes, I want them» or «No, thanks», with nothing pre-selected. Refusing does not stop anyone from using the card, and under 14 the question is never asked. Iterum no longer collects consent to its own news. Since 17 October 2026 the notice also states where the customer came from, that is a friend’s invite («Bring a friend») or a shop promoter’s QR, and lists referral rewards among the purposes, on the same legal bases as the card; when the staff read the card, they only see the short name of whoever invited the customer.

What to write in a loyalty card privacy notice

The notice must be given before the data is collected, in clear and plain language. According to the Garante’s summary of controllers’ duties, which covers Articles 12 and 13 of the GDPR, it must state at least the points in the list below.

The 2005 provision adds a very practical detail for anyone working a counter: it is not correct to push customers to join without time to read the notice, for instance by asking for a quick signature while they queue at the till. A QR code customers can open at their own pace, at the table or at home, helps: tips on where to display it are in the guide to the QR code loyalty card.

• Who the controller is and how to contact them, plus the data protection officer if there is one
• The purposes and the legal basis for each, keeping the card separate from marketing
• Who receives the data, for example the software provider as processor
• How long you keep it, or the criteria you use to decide
• The customer’s rights and the right to complain to the supervisory authority
• Any transfers to countries outside the EU and the safeguards used

How long should loyalty card data be kept?

The GDPR does not set a number of months: the storage limitation principle asks you to keep data only as long as the purpose requires. For loyalty cards the most specific reference is still the Garante’s 2005 provision: details of purchases by identifiable customers may be kept for at most 12 months for profiling and 24 months for marketing; when the card is withdrawn, expires or is returned, data kept for administrative purposes should not be held for more than three months, unless the law requires it.

Read it with two caveats: the provision covers, in general terms, the cards of large retailers, and it predates the GDPR, since it refers to the old Italian privacy code. It remains, however, the most concrete guidance the Garante has given on loyalty cards, and it is worth bearing in mind when you choose the period to write in your notice.

In the Iterum card notice the period is 24 months from the last use of the card; after that the data is deleted or anonymised automatically, the card is deactivated and the shop’s totals keep visits, points and rewards without the customer’s name.

A customer asks for their data or for deletion: what to do

Access, rectification, erasure, restriction, portability and objection are rights set out in Articles 15–22 of the GDPR. According to the Garante’s summary, the controller must make them easy to exercise and reply within one month, extendable to three months for complex cases, always giving an answer within the first month, even when refusing.

In practice, decide beforehand who in the shop handles requests and where the data sits. On every Iterum plan the activation flow lists privacy tools for customer requests, data export and retention, together with each customer’s profile and their consents. Customers, for their part, can remove their name, date of birth, email and phone from their own card.

Offers to loyalty card customers: when can you send them?

A loyalty card does not, on its own, give you the right to send offers. Marketing needs the specific consent described above, collected separately from the card and withdrawable at any time; for email, text and other automated messages the 2005 provision also pointed to the specific rules on unsolicited communications.

With Iterum the shop’s messages reach only customers who have answered «Yes, I want them» to extra rewards and offers, within the plan’s monthly limits, and customers can turn them off with one tap on their own card. If you want to contact customers again, say in the notice what you will send and how often, so customers know what they are agreeing to.

To see the notice, the sign-up and the choice about extra rewards and offers from the customer’s side before inviting anyone, you can set up the card and start the 7-day free trial: you pay €0 today, a payment card is required and, unless you cancel, the selected plan continues after the trial.

Loyalty card privacy checklist before launch

Six steps for a small business, for paper and digital cards alike. The scheme’s terms and the question of prize operations are covered in the guide to loyalty scheme rules in Italy.

1. List the data you ask for and why

   Keep only what the card needs; make name and contact details optional if the reward can be given without them.

2. Prepare the privacy notice

   Controller, purposes, legal bases, recipients, retention, rights and the right to complain, readable before joining.

3. Separate the consents

   One box for each marketing or profiling purpose, never pre-ticked, and the card works without any tick.

4. Choose and state the retention period

   Say how long you keep the data and what happens when a customer stops using the card.

5. Check the contract with your provider

   If software runs the cards for you, the relationship must be set up as Article 28 of the GDPR requires.

6. Decide who answers requests

   A name and an email address for access and deletion requests, with a reply within one month.

Sources and method

Sources consulted on 11 October 2026: Garante per la protezione dei dati personali, «Fidelity card e garanzie per i consumatori. Le regole del Garante per i programmi di fidelizzazione», general provision of 24 February 2005, doc. web 1103045; Garante, «Doveri - Come trattare correttamente i dati», doc. web 8981258, for Articles 5, 6, 7, 12, 13, 15–22 and 28 of the GDPR (both in Italian; English renderings are ours). The official text of Regulation (EU) 2016/679 on EUR-Lex could not be reached from our system on the day of the check; the article references follow the Garante’s summary.

The information about Iterum comes from the notice customers open from their own card (version informativa_cliente_v4 as of 4 November 2026, marked as provisional) and, as of 4 November 2026, the sign-up page and the card profile, the Iterum overview page and the activation flow; see also Iterum’s privacy notice. This guide is not legal advice and does not certify that any scheme complies.