GDPR
The General Data Protection Regulation, or GDPR, is the European legal framework for processing personal data. This can include information linked to an identifiable person through a customer card.
Published
What it means for your shop
Start with your actual workflow: what information do you need, what do you use it for and who can access it? A name is clearly personal data. A card identifier counts too if it allows a person to be identified. So digital collecting is personal data processing, even when customers only show a code at the counter.
The GDPR, particularly Articles 4 to 6 (German consolidated text), sets out definitions, principles and legal bases. In practice, these include a clear purpose, limiting information to what is needed, understandable information and appropriate protection. You must be able to demonstrate compliance with the principles. Consent is one possible legal basis; each activity needs the basis that fits it.
An everyday example
You want to find a customer’s card and later run a marketing campaign. These are two different uses, and each gets its own look. Note which step serves which purpose instead of grouping everything under “customer loyalty”. That also makes it easy to answer customers’ questions clearly.
At Treubar
The privacy policy explains how Treubar processes data. The DPA governs processing on your business’s behalf. Each party’s role depends on the particular activity, and both documents set this out clearly. Your own purposes, such as a marketing campaign, are yours to assess.