Personal information protection
Updated September 30, 2026
In one sentence
Personal information protection means the rules on what a business can collect, use and keep about a person who can be identified. For example their name, phone number or visit history.
What personal information is
The European data protection regulation, the GDPR, defines it this way: any information about an identified person or one who can be identified. For a loyalty card, that’s first name, phone number, email, birthday and visit history.
Principles that come back from country to country
Laws differ, but the same ideas come back, in Europe as in Canada. Tell people what you collect and why. Get their consent, or have another basis the law provides. Keep only what you need, and protect it. And let everyone see, correct or have their data deleted.
For your card
Only ask for what you use. A phone number is enough to recognize a customer. A birthday, only if you send a birthday offer. The card is built to help you meet privacy laws: separate consents, a ready-made privacy policy, an incident log.
At sign-up, a pet store asks for a first name and phone number. The pet’s name and birthday are offered separately, optional, to receive a small gift on that date.
Sources
- European Union, GDPR, Article 4, definitions (EUR-Lex) (opens in a new tab)eur-lex.europa.eu
- European Commission, rules for business and organisations (opens in a new tab)commission.europa.eu
- Office of the Privacy Commissioner of Canada, PIPEDA in brief (opens in a new tab)priv.gc.ca
General information, not legal advice. Rules differ from one country to another and change over time: for your situation, consult a legal professional.
See your business’s card
Send us your logo: we prepare a preview of your card and show it to you on video.