Loyalty cards and KVKK: a short guide for shops

A loyalty card collects a customer's name and sometimes a phone number, so Türkiye's Personal Data Protection Law (KVKK) applies. The good news: with a well-built programme there is little for you to do, and most of it comes built in.

This article is general information, not legal advice. Talk to a lawyer about your own situation.

Who does what

• Your shop is the data controller. You decide why and how customer data is used.
• Stampul is the data processor. It processes data on your behalf, only to run the card, under a data processing agreement.

1. Collect little

A stamp card needs only a first name. A phone number should be optional and used only to restore a lost card. Don't ask for a birth date, an address or an ID number. Less data, less risk.

2. Show the privacy notice

When customers join, they must see what data is processed, by whom and why (KVKK article 10). This is a notice, not a checkbox. Stampul's join page includes it.

3. Get separate consent for offers

Stamp and reward notifications (“Stamp added! 6/10”) are transactional and need no consent. Offers and discounts are commercial electronic messages, so:

• there must be a separate, unticked consent box;
• the card must work for customers who don't tick it;
• to send SMS you must be registered with İYS (the message management system).

In Stampul, offers only reach customers who consented. The system enforces this; it isn't left to staff.

4. Don't keep data longer than needed

Data from cards that haven't been used for a long time should be deleted or anonymised. Stampul's periods are in the retention policy.

5. Make customers' rights easy

Customers may ask to see, correct or delete their data, and must get an answer within 30 days. In Stampul, customers can download their data and delete their card themselves.

Do I need to register with VERBİS?

Many small businesses are exempt from VERBİS registration, but the Personal Data Protection Board sets the thresholds and they can change. Check the current ones on the Board's site.

See our privacy page for details.