What does GDPR mean for a café or restaurant loyalty programme?

A paper card with no name on it rarely raises data protection questions. Once you collect names and email addresses or store visits per person, the General Data Protection Regulation (GDPR, an EU law) applies, and email advertising falls under German competition law too. It sounds worse than it is, because a clean sign-up form covers most of it. This guide covers Germany and the EU as of November 2026. Advertising rules in particular differ between EU countries, and this isn't advice on your specific case. If something depends on your setup, ask your state data protection authority or your chamber of commerce (IHK).

Does a loyalty programme need guest consent under GDPR?

To run the card, usually no. For email advertising in Germany, usually yes. A guest who joins your programme enters an agreement with you, so the data you need for it can rest on Article 6(1)(b) GDPR (performing a contract). Advertising is different. In 2008, Germany's Federal Court of Justice (BGH) ruled on a large rewards programme that signing the membership form and giving an address isn't consent to email or SMS advertising (BGH, VIII ZR 348/06). The ruling predates GDPR, but the duty to get prior express consent is still in section 7 of the Unfair Competition Act (UWG).

This table separates what often gets lumped together:

When can you email offers without consent in Germany?

Only under the narrow exception in section 7(3) UWG, and all four conditions must be met together:

1. You got the address from the customer in connection with selling goods or a service.
2. You advertise your own similar goods or services.
3. The customer hasn't objected.
4. When collecting the address and in every email, you clearly say the customer can object at any time, at no cost beyond basic transmission charges.

With a stamp card, even the first condition is shaky, because guests often sign up separately from any purchase, and we found no ruling on this exact case. Our advice: don't rely on the exception, and ask for consent. It costs you one checkbox and saves the argument. The guidance from Germany's data protection authorities (the DSK) says consent is generally needed when the section 7(3) conditions aren't met.

What must consent look like?

Consent must be voluntary, clearly worded, separate from other text and given by an active step, under Article 7 GDPR and Recital 32. In the rewards card case, the BGH required a separate declaration, such as an extra signature or its own box. On cookies, the EU Court of Justice ruled that a pre-ticked box isn't valid consent (C-673/17, Planet49). Treat marketing checkboxes the same way.

The authorities also expect guests to learn which channel you'll use, what you'll advertise and who is sending it. "I'd like to get news" is too thin.

Adapt it to your business, and in Germany write it in German. Don't make the card depend on the box. Article 7(4) GDPR says that when judging whether consent is freely given, utmost account must be taken of whether a service is tied to consent it doesn't need. Opinions differ on how strictly to read this rule, and you avoid the debate when the card works without the tick.

Is double opt-in mandatory, and what should you keep?

No law uses the term, but German authorities consider double opt-in necessary for electronic consent. It means the guest confirms the address through a link or code sent by email. That's section 3.3 of the DSK guidance. You have to be able to prove consent (Article 7(1) GDPR), and a stored IP address isn't enough.

Two points from the guidance that are often missed. Consent doesn't expire just because time passes, but the authorities recommend renewing it if unused for more than two years. And after a withdrawal, you still need to be able to prove the earlier consent, within the regular three-year limitation period. This is the authorities' reading rather than a statute, but it's the standard the people checking on you would apply.

What must your privacy notice say?

The required content is in Article 13 GDPR, and guests must get it when they sign up, not later. For your card, that means:

• Who is responsible, with full company name, address and email
• What data you use, why and on what legal basis
• Who receives the data, such as your technical provider
• Whether data goes to countries outside the EU
• How long you keep it
• Guests' rights: access, deletion, complaint to the authority, withdrawal
• The right to object to direct marketing, set apart from other information (Article 21(4) GDPR)

Can you analyse stamp data to target offers?

Totals across your programme raise fewer questions than profiles of individual guests. The German authorities draw a line. Marketing sent without selection, or using rough criteria like postcode, usually passes the balancing test. Automated selection that builds detailed profiles or predicts behaviour requires explicit consent in their view, and pointing to the right to object isn't enough (guidance, section 1.3.2).

No source says exactly where a simple rule such as "anyone away for 30 days gets an extra stamp next visit" falls for a café. A rule inside the programme with no marketing message is different from a marketing profile. If in doubt, ask your state authority and describe the programme openly in your privacy notice.

What else counts as advertising? Review requests and Wallet messages

A request for a review can be advertising too. In 2018, the BGH treated a satisfaction survey in an invoice email as advertising, even though the invoice itself wasn't (VI ZR 225/17). So without consent, keep review requests and offers out of your "new stamp" emails.

We found no ruling on messages shown on a Wallet card. Section 7 UWG refers to electronic mail, and whether a Wallet notification counts is open. So treat an offer on a Wallet card like an advertising email and get consent first. A plain stamp notice is part of the programme.

How long can you keep data, and from what age?

The law sets no fixed period. Under Article 5(1)(e) GDPR, you may keep data only as long as the purpose requires. So set your own period, such as deleting after a long stretch without a visit, and put it in your privacy notice. On age, Article 8 GDPR sets 16 as the limit for consent to online services offered directly to children, and member states may lower it. A minimum age of 16 in your terms is the simple answer.

What happens if you get it wrong?

For breaches of the consent rules, Article 83(5) GDPR sets a ceiling of 20 million euros or 4 percent of worldwide annual turnover. That ceiling applies to all companies and isn't a typical figure for a café, and authorities must stay proportionate. In Germany, unwanted marketing emails can also lead to injunctions, as the case above shows.

What does a sign-up like this look like in practice?

With the NFCeez digital stamp card, sign-up works like this: guests tap the stamp card on your Smart Page, or use the sign-up link or the QR code at the counter. They enter their first name, last name and email and confirm the address with a code sent by email. Then they accept your terms, from age 16. News and offers are a separate, optional choice. At the end, the card sits in Apple Wallet or Google Wallet.

An offer on the Wallet card only reaches guests who agreed, at most once a week and only on days you're open. Guests can delete their card themselves at any time, and cards unused for 24 months are deleted automatically. NFCeez creates the terms and privacy notice for the card from what the system really does, and you publish them for your business.

The limit: those texts carry your name, and the responsibility stays with you, so read both once. If something depends on your case, your state data protection authority is the right place to ask. The digital stamp card page shows what the card looks like.

Your next step

Open your sign-up form today and check three things. Is the marketing box empty and separate? Does the card work without the tick? Is the privacy notice right there? See our guide to planning a loyalty programme for the bigger picture.