You can offer a digital stamp card and build data protection into the setup. With Treubar, guests collect stamps in their wallet without an extra app or email address; here is what gets stored and what to prepare before launch.
What data does a digital stamp card use?
Treubar asks guests for their first name, last name and date of birth once. All three fields are required. It also records stamp counts, stamp and redemption times, location and the team member for staff scans. Technical card, device and browser identifiers support card recognition and wallet updates.
The stamp card does not collect email addresses, home addresses, purchased products or spending amounts. Date of birth helps distinguish guests with the same name and supports birthday greetings if you use that feature from Pro. The stamp history also shows when someone visited, so the card contains personal data.
The principle in Article 5 is straightforward: use only the data needed for each purpose. Do not add private notes or health information to a guest’s display name.
Four steps to prepare for launch
- Define the purpose and legal basis. Set out how you will use the card and its data. Assess whether the required fields are necessary for your programme. Treat additional marketing as a separate purpose.
- Inform guests when they join. Make your privacy notice available where guests enter their details. Cover the controller and contact details, purposes, legal bases, recipients, international transfers, retention periods or criteria, and guests’ rights.
- Document data processing. Your business controls the loyalty programme; Treubar processes card data on your behalf. The data processing agreement (DPA) forms part of the service contract and describes the data, safeguards and providers.
- Assign responsibility for requests and access. Decide who handles access, correction and deletion requests, and when data is no longer needed. Give each team member their own login and remove access when they leave.
This gives your team a clear routine and your customers a clear explanation. Treubar’s privacy policy also covers processing for which Treubar is responsible, such as business accounts and technical server logs.
EU hosting and wallet providers
Treubar’s database is hosted in the EU. Treubar does not sell guest data or use it to build advertising profiles of its own. A loyalty card in Apple Wallet and Google Wallet needs no additional Treubar account for guests.
Apple and Google work differently. For Apple Wallet updates, Apple receives a device identifier and a notification without content. Treubar does not send Apple the name or stamp count through that process. Google stores the wallet object, including the name, stamp count, design and message text, as soon as a guest selects Google Wallet, even if they do not then save the card.
EU hosting therefore does not mean every service involved processes data exclusively in the EU. Annexes 1 and 3 of the DPA detail the data flows, including Google Fonts on guest pages and possible US transfers.
Keep collecting stamps separate from marketing
Adding a stamp card is not blanket consent to advertising. Before sending push campaigns or birthday greetings, establish which consents you need and keep a record of them. Under the DPA, your business is responsible for obtaining them.
From Pro, audience groups and automations can use visit behaviour or birthdays to select recipients. This is profiling for your marketing and needs to be explained in your privacy notice. State the right to object to marketing clearly and separately, and honour objections when sending messages. See the FAQ for further answers.
Frequently asked questions
Is a stamp card without email automatically GDPR-compliant?
No. Names, dates of birth and identifiable stamp records are personal data too. What matters is a suitable purpose, a valid legal basis, clear information and a process for looking after the data.
Does collecting stamps always require consent?
Not every use of data requires consent. The legal basis depends on the purpose and design of your programme. Processing necessary to provide a contracted service may rely on contract performance; assess additional marketing separately.
Is paper simpler for data protection?
An anonymous paper card with no link to a person does not process personal data. A digital card gives you wallet convenience and a recorded stamp count. The comparison between paper and digital helps you choose.
Prepare your wallet stamp card
Create your card, review the DPA and prepare your privacy notice before issuing cards to guests. Start free with Treubar, with up to 20 customer passes on the Free plan and no Treubar app or Treubar account for your guests. The wallet requirements still apply.