Customer data and GDPR

How long details are kept (Store details → Keeping customer data)

• Choose 12, 24, 36, 60 or 84 months without a visit. Default: 36 months (3 years).
• Every day, early in the morning, a customer with no order, visit or booking for that long is erased: name, phone, email, addresses, points.
• Names, phones, emails, addresses and gift notes are removed from older orders and reservations. Sales, totals and VAT stay for the books.
• The addresses of a newsletter's recipients are blanked 12 months after sending. Unsubscribe keeps working.
• The privacy text of your ordering page states these periods.

Offer emails: double opt-in

A tick is not enough. When a customer ticks "I want offers" at checkout or in their account, or staff switch on Agrees to receive offer emails on their card, a confirmation email goes out. The customer gets newsletters only after pressing Yes, send me offers on the link's page. So:

• staff can switch consent off, but not on by themselves; someone who unsubscribed only comes back by confirming themselves,
• a new email address means a new confirmation,
• nobody else can sign a customer up with another address,
• at most one confirmation email goes out per customer and address every 10 minutes.

Newsletters go only to those who confirmed, and every email has Unsubscribe. See Customers, points and stamps.

The customer account is safe

• An order without signing in (or a booking, or a platform order) never changes the name or email of an existing customer card. It joins a card found by phone only when that card has no email or the same one.
• A phone and email typed without signing in count as unproved, until the customer signs in with the code they get there. The code proves the email (or phone) is theirs.
• The order tracking page shows points and balance only to the signed-in customer.

Download and erase: on the customer's card, Download their data downloads what you keep about them, and Erase customer deletes it for good. Past orders stay in your sales, without their details. Erasing goes into the Security log.