Who Owns Your Loyalty Program's Customer Data? How to Export It

The customer list in your loyalty program is yours. Under GDPR, the business that issues the card is the data controller (the one who decides why the data is collected), and the loyalty tool is only a processor (the software that stores and handles it for you, on your instructions). That split decides who may export, delete or reuse your customers' details. The catch is the contract: a tool's terms can still put your customers into its own app, pool them with other shops or keep the list when you leave, so read the three checks below before you sign.

Most pages on this are written for data teams at big brands: ownership models, governance boards, AI audits. This one is for the owner of a few shops who's about to sign a yearly plan, and whose business partner just asked, "and who owns the customer list, us or them?" Your customer insights are only worth having if the list behind them is yours to keep, so that's where we start. Nothing here is legal advice; the articles of the law are named so you can check the wording yourself.

#Who owns the customer data in a loyalty program?

You do, in the sense that matters. GDPR doesn't use the word "own". It asks who decides why and how personal data is used. That's the controller, and when you issue a loyalty card, that's you. The company that runs the software is a processor: it may handle the data only on your documented instructions (Article 28). The same article says the processor must have a contract with you that sets out what it does with the data, and that when the service ends it deletes or returns the data, at your choice.

So the question to put to a loyalty tool isn't "who owns the data". It's "where is your data processing agreement, and what does it say?" A DPA is the contract Article 28 asks for. Ask for it before you sign, not after, and look for the three sentences below in it.

Here is what Passtastic's data processing agreement says, so you have something to compare against (last updated 1 October 2026): "We process your customers' data only on your instructions." "We will not use your customers' data for our own purposes." "We do not sell it, and we do not share it with other merchants." It applies to every account automatically, and the privacy policy at passtastic.io/privacy-policy lists what is collected and who processes it. Any vendor can be asked for the same three sentences in writing; send your partner those two pages (the DPA and the privacy policy) and ask the other vendors for theirs.

One trade-off before you go further. A processor contract never moves the legal duty off you. Article 5 says the controller "shall be responsible for, and be able to demonstrate compliance". The tool keeps the data safe; you're still the one who decided to collect it, and the one a customer will write to.

#What can a loyalty tool do with your list? Three things to check

Ownership on paper is settled by the contract. Ownership in practice is settled by three things that are easy to miss in a terms page.

1. 1A consumer app or directory. If the tool has its own app or website for shoppers, check whether your customers are shown other businesses in it, and whether you can switch that off. You don't want your regulars joining your card and finding the café across the street on the next screen. With Passtastic there's no app of ours for them to open: the card sits in Apple Wallet or Google Wallet, and no app is needed on either end.
2. 2Pooled or shared data. Coalition programs, where several brands share one card, give the weakest ownership, because the network holds the members. Even outside coalitions, read whether the vendor may "aggregate" your customers' data, analyse it across businesses or train AI models on it. Those words mean your list feeds something that isn't your card.
3. 3What happens when you leave. Can you export everything, any time, without asking? And when you cancel, is the data deleted, kept, or kept and used? Passtastic, for example, doesn't delete your customers' data automatically when a subscription ends; you can export it while the account is active, and if you want it removed you email and it's removed without undue delay. Its DPA names no fixed number of days for that, so if a deadline matters to you, ask for one in writing. Whatever the answer, get it in writing before you have 2,000 people on a card.

Three questions to send a vendor, copied as they are:

“

1. Can I export all my customers' details myself, at any time, without contacting you?

2. Do you use, share or show my customers' data for anything other than running my card? Please point me to the clause.

3. When I cancel, what happens to the data, how do I have it deleted, and within how many days?

“

A vendor that answers all three in two lines each is one you can work with.

If you're weighing a card against building your own loyalty app, note that an app doesn't change this question. Your developer or app platform is a processor too, with the same contract to sign.

#What does a wallet loyalty card actually collect?

Less than people fear, and only what you ask for. When you set up a wallet loyalty card, you choose which details the sign-up form asks for: first name, last name, email, phone, birthday and address, plus your own questions on Multi-Location and up. Any field you switch on is required; with data collection off there's no form at all, and the customer goes straight to adding the card. Customers agree to your privacy policy during sign-up.

From then on the card records the loyalty activity itself: visits, stamps or points, progress toward a reward, which card they have and whether it's in their wallet. Apple or Google also issues a wallet push token for each installed card (the technical ID that lets the card update on that phone), which Passtastic's privacy policy says is used solely to deliver card updates.

How much of this will you hold? Across 265 Passtastic businesses with at least 10 members (the last 12 months), the median business signed up 30 customers in its first month. So after four weeks you'll typically have thirty customer records. That's small, and it's still personal data from day one.

The data minimisation rule in plain words: ask only for what you'll use. If you'll never send a birthday treat, don't ask for the birthday. A café group doesn't need a postal address. The more a field says about a person (a birthday, a home address), the stronger your reason for asking has to be.

What the list is for, once it's yours: knowing who's new, who's a regular, and who's gone quiet. Passtastic's Customers page builds those groups for you on every plan, new members and everyone who hasn't been back in 30 days included, and you can message a group, add a stamp or points, or leave a note from the same page. The numbers worth watching are the plain ones: how many people came back, how many are still active, and how many cards are ready to redeem. If that last number stays near zero, it usually means the card is too hard to fill, not that the customers are lazy.

A sign-up sentence you can adapt for your privacy policy or the counter sign, written for a café called Bean & Bridge (an example, not legal wording): "We use your name and phone number to run your Bean & Bridge card and to tell you about rewards and offers here. We don't share them with anyone else. Ask us at any time to see, change or delete them."

#GDPR basics for a small shop, in five lines

The law is long. For a loyalty card, five lines cover most of what you have to do, each with the article behind it:

Does this apply to a one-shop café? Yes. Article 3 sets the scope by where the business is established, and names no size or turnover threshold. In the UK the same rules continue as UK GDPR, and the ICO publishes guidance written for small organisations and sole traders. In the US, California's CCPA applies to businesses with over $25 million in revenue, or that buy, sell or share the personal information of 100,000 or more California residents or households, among other thresholds, so most independent shops sit outside it; check your own state's rule. Wherever you are, treat "delete me" as a request you honour: it costs you nothing and keeps the goodwill.

The fines exist (up to 20 million euros or 4% of worldwide turnover for the serious tier), but for a shop the realistic risk isn't a fine. It's a regular who feels tricked, and tells people.

#How to export your customer list

In Passtastic the export is two clicks, and it's on every plan, Single Location included. You need the Editor role or higher.

1. 1Open Customers in the sidebar.
2. 2If you want part of the list, filter by card or by status (active customers only, for example).
3. 3Click Download customers, top right next to the search bar.

The file downloads as passusers_YYYY-MM-DD.csv and opens in Excel, Google Sheets or Numbers. Each row is one card: name, first name, last name, email, phone, card name and type, status, created date, expiry date, and any custom fields such as birthday. A customer with two cards appears on two rows; the Person Key column carries the same value on both, so sort the sheet by that column to see each person's cards together.

That CSV is also what Article 20 means by "a structured, commonly used and machine-readable format". If you move to another tool, this is the file. If one customer asks for their own data, never send them the full export, because it holds everyone on the card: open their record on the Customers page and send what it holds, or keep only their rows (the ones with their Person Key) in a copy of the CSV before you send it.

Two ways to skip the file. On Multi-Location and up, Zapier can send each new sign-up, stamp or reward to the tools you already use, and the API and webhooks do the same for a custom setup. On Single Location you export by hand. Either way, think before you paste the list into a newsletter tool: your sign-up policy told people what you'd use their details for, and a weekly email may not have been on it. If it wasn't, ask first. The wallet notification is the channel they did sign up for; here is what a wallet notification can send.

#What to do when a customer says "delete my data"

Erase them, without undue delay, and within a month at the latest (the law allows two more months for complicated requests, which yours won't be). That's Article 17 and Article 12(3). For a shop this is rarely more than one conversation, a few clicks and typing DELETE.

In Passtastic the request can start on the customer's side. From their "My details" page they verify a six-digit email code and ask for deletion. Nothing is deleted yet; they're flagged "Deletion requested" in your Customers list, and you choose:

• Erase: opens Delete permanently for that customer and ends their sessions. Only Admins and Owners can do this.
• Dismiss: clears the flag with nothing deleted, for a request made by mistake or settled another way. Editors and above can do this.

To delete by hand: open Customers, open the customer, choose Delete permanently from the ⋯ menu, pick this card only or the person and all their cards, type DELETE and click Delete forever. To clear several at once, an Admin or Owner ticks the rows in Customers and clicks Delete permanently in the bar that appears. There's no undo either way. It erases the profile, visits, points and scan history; a few records stay without personal details (message logs without the text, payment records without the email).

One thing the law can't change: the card stays on the customer's phone. Apple and Google don't let a provider remove a pass from a device, so it stops working and moves to the expired section instead. If they ask, tell them it no longer works and they can remove it themselves.

For duplicates and members who may come back, use Mark inactive instead. It blocks perks at the scanner, keeps the history and balance, and can be reversed. Save Delete permanently for the real request, and for members you'll never message again.

#Who on your team can see and export the list?

A list is only as private as the newest member of staff. Passtastic has four roles, and the two questions that matter for data are who can export and who can erase:

Which plan you're on decides how far a role reaches. Single Location (one shop) includes 2 team members and Multi-Location (up to 3 shops) 5; on both, every Editor sees and can export the whole list, all shops included, so give the Editor role only to people you'd hand the list to. Groups & Brands (up to 10 shops, 20 team members) is the plan that can limit a Viewer or Editor to selected shops; a restricted Viewer can't see customer emails or phone numbers and can't export. So three cafés fit Multi-Location, with one list shared by every Editor; if you run one card across every location and want each manager to see only their own shop, that's Groups & Brands, with Admin kept for head office.

Admins and Owners also see the Changes log: every stamp, point, note or balance change made from the dashboard, with the name of the person who made it. Editors and Viewers see the entries without names. It's the answer to "who added 40 points to Tom's card on Tuesday".

#What happens to the data when you leave or switch tools?

Export first, then decide. Under Article 28 the processor deletes or returns the data at your choice when the service ends, so the two things to settle are which of the two you want and by when. Neither Article 28 nor Passtastic's DPA sets a number of days, so a date is something you agree with the vendor.

With Passtastic, cancelling the subscription keeps the account and the data; nothing is deleted automatically, you can come back, and an emailed request has it removed without undue delay. Deleting the account is the other path: it removes the organisation, the cards, the messages and the customer records, passes in wallets stop working, and only the Owner can do it. The help guide's first instruction is to export the customer list before you do.

Going the other way, into a new tool, is a file too. Passtastic imports a CSV or Excel sheet of up to 10,000 rows, matches first name, last name, email, phone and a balance column, and asks you to confirm you have a genuine relationship with these people and may message them about their card. Importing doesn't put a card on anyone's phone: each customer taps their own invite link, and anyone matched by email or phone is updated, not duplicated.

Plans start at €39 a month for one location and €99 a month for up to three, free to start for 14 days with no card needed; what each plan costs is on the pricing page, and export is on all of them.

#Three shops, three questions

• Niamh runs three cafés in Dublin. Her partner's question was ownership. Her answer is the DPA: processor, no other use, removed on request. She sends the three questions to two vendors and signs with the one that answers.
• Ines's nail salon, Lacquer Lane, asks for birthdays. She sends a birthday treat, so the field earns its place. She switches off the address field, which she never used, and the form is one line shorter.
• Pedal Post, a bike shop, gets its first "delete my data" email. The customer had already requested it from the card; the owner clicks Erase, replies "done", and the whole thing took four minutes, not a month.

The data is a side effect of a card that works. Your customers lent it to you for the card; keep it where you can take it with you, and the ownership question is settled before anyone asks it.

“

When they saw that they don't have to install an app or accept layers of security and permissions — it's just connected with my account and nothing more — we got very good feedback from this point of view.

“

Alex, Owner of Rewind

Read their story →