A loyalty card is personal data: a first name, dated visits, spending habits. In Switzerland, the revised Federal Act on Data Protection (nLPD, in force since September 2023) governs this collection; for your customers in the European Union, it's the GDPR. At Fidelyz, these lines are written by our lawyer: here's what your business needs to know, without the jargon. (This article is informational; it does not replace legal advice on your particular situation.)
Yes, your loyalty card does "profiling"
Counting the visits of a person identified by their first name in order to grant them perks is a processing of personal data, and analyzing their visit habits amounts to profiling within the meaning of the nLPD. It is not forbidden: it is regulated. The difference between a compliant program and a risky one comes down to four simple obligations.
The 4 obligations that matter for a business
1. Inform, at the moment of collection
Your customer must know, at sign-up, what you collect and why: counting their visits for the loyalty program. In practice: a clear notice on the sign-up page, with a link to a readable privacy policy. It's built in by default on Fidelyz sign-up pages.
2. Minimize: collect only what's needed
A first name is enough to stamp. Email or phone are only justified if you actually use them: that's why they're options the merchant turns on, not required fields. The less you collect, the less risk you carry.
3. Know where the data is, and who accesses it
You must be able to answer "where is your customers' data stored?" At Fidelyz: hosting in Europe, access limited to the merchant (and their staff via a restricted scan access, without the customer list). If your provider can't answer that question in one sentence, change providers.
4. Return and erase, on request
Your customers have a right of access and erasure: you must be able to delete a record. And you, the merchant, have a right that protects you: getting YOUR customer list back. At Fidelyz, the one-click CSV export is contractual: if you leave, your data leaves with you. Beware of platforms where this question has no written answer.
Swiss data-consciousness, a competitive edge
In Switzerland, your customers pay attention to their data, and that's an opportunity: a business that states "your data stays between us, visit counting only, never resold" stands out immediately from the big platforms. Compliance isn't an administrative burden — it's a trust argument, exactly like your hygiene or the freshness of your products.
The 5-point checklist
- Clear notice at sign-up (purpose: loyalty, visit counting).
- Minimal collection: first name first, the rest only if useful.
- Controlled hosting and access (Europe, restricted access).
- A customer record can be deleted on request.
- Return of YOUR customer list written in black and white in the contract.
These five points are the foundation of Fidelyz: terms written by a lawyer, a customer list you own, and a card built for local businesses like beauty salons, where trust is the whole relationship.