Your customer list is personal data — handling it properly

Saudi Arabia's Personal Data Protection Law applies to anyone handling the personal data of individuals. A phone number attached to a purchase is personal data, which means most shops are covered.

This is general information, not legal advice. Confirm your obligations with a qualified adviser. What follows is the practical shape of it for a small or mid-sized shop.

What counts as personal data in a shop

• Phone numbers collected for receipts or loyalty
• Names, if you record them
• Email addresses
• Delivery addresses
• Purchase history linked to any of the above
• Staff records — employees are data subjects too

The principles that matter day to day

Collect for a stated purpose. Tell the customer why. "To send your receipt" is a purpose. Collecting it "in case we need it" is not.

Do not use it for something else without asking. A number collected to send a receipt is not automatically consent to send marketing. This is the single most common mistake, and it is the one customers notice.

Collect the minimum. If you only need a phone number, do not also ask for a date of birth because the field exists.

Keep it accurate, and correct it when a customer tells you it is wrong.

Do not keep it forever. Decide a retention period and apply it.

Keep it secure. Access limited to staff who need it. SeePOS security questions.

Honour the customer's rights — to know what you hold, to have it corrected, and to have it deleted.

Marketing consent, done properly

Two questions at the counter, not one:

1. "Shall I send your receipt to WhatsApp?" — the receipt purpose
2. "Would you also like to hear about offers?" — a separate, optional consent

Record the answer to the second. When someone opts out, honour it immediately and permanently.

This costs three seconds and it removes an entire category of problem. It also produces a better marketing list: people who said yes actually want to hear from you, which is why messages to that list perform better.

Deletion requests

A customer can ask you to delete their data. You need:

• A way to receive the request — an email address or a page
• A way to find everything you hold about them
• A way to delete it
• A record that you did

Note the tension with your ZATCA obligations:tax records must be retained for the period regulation requires, and a deletion request does not override a legal retention obligation. In practice this usually means the transactional record is retained as required while the marketing profile and contact details are removed. Confirm the treatment with your adviser.

Wameed provides adata deletion request page for exactly this, and ourprivacy policy states what we hold and why.

Your POS vendor's role

If your POS holds your customer data, the vendor is processing personal data on your behalf. You should know:

• What they do with it, and whether they use it for anything beyond providing the service
• Where it is stored and who can access it
• What happens to it when you leave
• Their breach notification process
• Whether there is a data processing agreement

A vendor who cannot answer these is a risk you are carrying without knowing it. SeePOS security questions.

Practical steps for a shop this week

1. Write down what you collect and why. One page. Most shops have never done this and are surprised by the list.
2. Add the second question for marketing consent at the counter.
3. Set a retention period for marketing contact data and apply it.
4. Check who can export your customer list in your POS, and narrow it. Seeroles and permissions.
5. Publish a short privacy notice — what you collect, why, how long, and how to ask for deletion.
6. Know how you would handle a deletion request before you receive one.

The commercial point

Handling this well is not only compliance. A customer who trusts you with their number gives you a better one, answers your messages, and does not block you.

The shops with the most valuable customer lists are the ones that asked honestly and used them sparingly.