Push messages to customers: what the GDPR and German law require

A message right on your regulars’ lock screen is a powerful tool. That’s exactly why clear rules apply. This guide explains what wallet notifications are, how they differ from app push, SMS, email and WhatsApp, what generally applies in Germany and the EU, and how to write messages that don’t annoy.

Not legal advice: this text gives a general overview to the best of our knowledge. It does not replace advice from a lawyer or your data protection adviser. For your specific case, such as special promotions or prize draws, please get advice.

What are wallet notifications?

A wallet notification is a short message attached to a card in Apple Wallet or Google Wallet that appears on the lock screen. The guest needs no app: they have simply added your business’s loyalty card to their wallet. When you attach a message to the card, the phone displays it, much like an app’s push notification.

Technically this runs through Apple and Google: to update the card, its contents are sent to Apple or Google. How the card gets into the wallet is explained in Loyalty card in Apple and Google Wallet.

The same basic principle applies to every channel: advertising only with consent. The difference lies in the effort for the guest and where the message arrives.

Push messages and the GDPR: what is generally allowed?

In short: promotional messages to customers need prior, freely given and provable consent that can be withdrawn at any time. This follows from two sets of rules that apply side by side.

General Data Protection Regulation (GDPR)

Processing customer data such as first names, visits or a device identifier needs a legal basis (Art. 6 GDPR). For promotional messages, consent is the usual route. The full text of the GDPR sets these requirements, among others:

• Freely given and unambiguous (Art. 4(11)): the guest has to actively agree. A pre-ticked box or silence is not enough (Recital 32).
• Not bundled (Art. 7(4)): the stamp card should work without agreeing to advertising.
• Provable (Art. 7(1)): you must be able to show that and how someone consented.
• Withdrawable at any time (Art. 7(3)): withdrawing must be as easy as giving consent.
• Objection to direct marketing (Art. 21(2) and (3)): once someone objects, promotional messages to them are off limits.
• Informed (Art. 13): the guest must know who processes their data and why, usually through a privacy notice.

German Act against Unfair Competition (UWG)

In Germany, Section 7 UWG (German text) covers unreasonable nuisance. Under it, advertising is not allowed when it is recognisable that the recipient doesn’t want it. For advertising by electronic mail, such as email or SMS, the law generally requires prior express consent. Whether a wallet notification is treated the same way legally has, as far as we can tell, not been conclusively settled. The safe route is to treat it like an email: advertising only with express consent.

Who is responsible?

As the business, you are the controller of your guests’ data. A provider like Stempelkarl processes it only on your behalf (processing under Art. 28 GDPR). Your guests’ questions about their data therefore come to you first.

How does consent work in practice?

The best moment to ask is when the guest adds the card: they have a reason to join in and can see what they are agreeing to. This is how Stempelkarl handles it:

• A separate box, not pre-ticked: when adding the card the guest sees: “Yes, [your business name] may send news and offers to my card. I can withdraw this at any time.”
• The card works without it: anyone who leaves the box empty collects stamps as usual but gets no promotional messages.
• Documented: the time, wording version and language of the consent are stored.
• Birthday only with consent: day and month are only stored together with the consent, used solely for the birthday greeting and deleted when consent is withdrawn.
• Transparency before every send: the dashboard shows how many guests in a group will get the message and how many have not consented.

Your consent rate is the most important number for your reach. Feel free to explain at the till what the guest gets out of it, such as a birthday greeting or a heads-up when their reward is waiting.

How often can you reach customers by push?

The law doesn’t set a number. But every message too many costs trust, and anyone who feels pestered unsubscribes or deletes the card. Firm limits keep you from being tempted in the first place.

• At most one promotional message per guest in 24 hours, across all campaigns and automations combined.
• Never at night: automatic messages only go out between 9:00 and 20:00.
• Short: at most 40 characters for the title and 150 for the text, so nothing gets cut off.
• In the guest’s language: messages can be written in German, English, Spanish and French; each guest gets the version in their language, otherwise the base text.

A rule of thumb for yourself: only send a message when you have a real reason, and rather once every two weeks than every day.

Unsubscribing and deletion

Unsubscribing has to be easy, or the consent is worth little. The back of every card carries an “Unsubscribe from offers” link. One tap is enough: the guest gets no more advertising and their stamp card keeps working. If a guest asks at the counter, your team can also withdraw the consent in the dashboard.

Unsubscribing is not the same as deletion. Regardless of consent, your guests can ask for their data to be erased under Art. 17 GDPR, subject to the conditions set out there. Decide in advance who in your team takes such requests and how quickly they are handled.

Where is the data stored?

Stempelkarl’s servers are in a data centre in Frankfurt am Main, Germany. A data processing agreement is in place with the hosting provider. To keep the card on the phone up to date and deliver messages, card contents are sent to Apple or Google, and for Apple also a device identifier and a push token. That is part of every wallet card and belongs in your privacy notice.

Good and annoying messages: examples

Good messages have an occasion and a benefit for the guest. Annoying ones only say that you want sales.

How well-timed messages bring back guests who have stayed away is covered in Win back regulars. More ideas that need no messages at all are in Customer retention ideas.

You can try Stempelkarl free for 30 days. Prices and frequently asked questions are on the home page.