What your customers should be able to read

Your loyalty programme is a promise you make to a customer, and Belgian law reads it as a contract: the customer has to be able to find out how they earn points, what happens to those points, and what you keep about them. Nobody expects a bakery to keep a lawyer for this, and every shop on Puntjes would end up writing the same two documents about the same platform. So here they are, ready to fill in.

---

What to do with them

1. Copy both templates into one page on your own website. One page is enough; give it a heading per document.
2. Replace every {placeholder}. Each template lists its own underneath.
3. Publish the page and copy its address.
4. Paste that address into Where your customers can read your rules, in your vendor settings in the admin portal. Puntjes then puts one line at the bottom of every email your customers get from you: How {your shop} handles your data, linking to your page. Leave the field empty and we add nothing, so there is never a link that goes nowhere.
5. Put the same address on the back of the wallet card, in Extra information, if you want a customer to find it from the card itself.

---

Template 1: the rules of your loyalty programme

The loyalty programme of {your shop}

Last changed on {date}.

Who runs this programme. {Your legal name}, {your address}, enterprise number {your enterprise number}. Questions about the programme go to {your email address}.

How you join. You join by asking for a card at the counter, or by giving us your details when we ask. Joining is free, and you can stop whenever you like by telling us.

How you earn points. You earn points on what you buy at {your shop}. What a purchase is worth in points is shown at the counter and can change; a change only ever applies to purchases made after it. We can also give points as a gift, for example on your birthday.

What points are. Points are not money. They cannot be paid out, sold, or given to another person, and they have no value outside this programme. You can only spend them at {your shop}; they are not valid at any other shop, even one that also uses Puntjes.

When points expire. Points expire {number of months} months after you earn them. (If your points never expire, replace this whole paragraph with: Points do not expire.)

What you can get for them. The rewards, and what each one costs in points, are shown at the counter and in the app. We can add or remove rewards, and change what a reward costs. A change never takes away points you have already spent, and a reward you have already claimed stays valid until the date on it.

Emails. We only email you about gifts and offers if you told us we could. Every one of those emails has an unsubscribe link at the bottom. Click it, press the button on the page that opens, and you are off the list; you never have to log in or fill anything in. You can also tell us at the counter. Emails about your card itself, such as the one with your card in it, are not advertising and are sent because you joined.

Children. A child under 13 cannot give us permission to send them advertising email. If you are under 13, a parent has to arrange that.

When we change these rules. If we change anything that matters to you, we tell you at least {number of days} days beforehand, at the counter and by email if we have your address. If you do not want the new rules, tell us before they start and we will close your card and, if you ask, settle whatever you had saved under the old rules.

If we stop the programme. We tell you at least {number of days} days beforehand, and you keep the right to spend your points until the last day.

Which law applies. Belgian law. Nothing in these rules takes away a right you have as a consumer under Belgian law.

The placeholders in this one: your shop name, your legal name, your address, your enterprise number, your email address, the date, the number of months before points expire, and the number of days of notice before a change.

---

Template 2: what you keep about your customers

What {your shop} keeps about you

Last changed on {date}.

Who is responsible. {Your legal name}, {your address}, enterprise number {your enterprise number}. Questions, or a request about your data, go to {your email address}.

What we keep. Your name, the way we can reach you (email address, and your phone number if you gave it), your date of birth if you gave it, your loyalty card number, everything you bought from us that earned points, your points and what you spent them on, and whether you said yes to receiving email from us.

Why we keep it. To run the loyalty programme you joined, which is the agreement between us. We keep what we have to keep for our bookkeeping because the law says so. We only send you advertising email if you said yes, and you can take that back at any time.

That we look at what you buy. We do. We use what you bought to decide who gets which offer: who gets a birthday gift, who has not been in for a while, which offer suits which group of customers. That is profiling, and you can tell us to stop doing it for advertising. Say so at {your email address} and we stop, with no reason needed.

Who else sees it. Puntjes (Puntjes BV) runs the software for us and processes your data on our instructions only, as our processor. What Puntjes may and may not do, and which other companies work for Puntjes, is in the processor agreement at {DPA address}. We do not sell your data to anybody.

How long we keep it. As long as you are in the programme. Ask us to erase you and your name, email address, phone number, date of birth and card number go; the points and the list of what was earned and spent stay without your name, because our bookkeeping needs it. If you asked to stop getting email, we keep your email address on a stop list, so it can never be picked up again by accident.

What you can ask us. To see everything we keep about you, to get a copy of it in a file you can take elsewhere, to correct what is wrong, to erase you, and to stop the advertising. Write to {your email address}. We answer within one month, and it costs you nothing.

If you are not happy with our answer. You can complain to the Belgian data protection authority, the Gegevensbeschermingsautoriteit: {its address and email, from its own website}.

The placeholders in this one: your shop name, your legal name, your address, your enterprise number, your email address, the date, the address of the Puntjes processor agreement, and the contact details of the Gegevensbeschermingsautoriteit, which you copy from its own website so they are current when you publish.

---

Why each of those paragraphs is there

Not every line is obvious, so here is what each of the less obvious ones is doing.

The paragraph	What it is for
Points are not money	Stops a customer reading a points balance as a claim on cash, and stops the programme reading as a payment service.
A change only applies to later purchases	A term letting you change the deal for what a customer has already earned is one a Belgian court can strike out.
Notice before a change, and a way out	The same reason. A change clause survives when the customer is told in time and can leave.
The emails paragraph	Advertising email needs permission and an unsubscribe route in every message. Puntjes puts the link in for you; the paragraph is what tells the customer it is there.
Children	Belgian law puts the age at 13 for a child agreeing to this on their own. Puntjes refuses to record permission for a customer whose date of birth says under 13.
That we look at what you buy	This is the one people forget. Deciding who gets which offer from what someone bought is profiling, and the customer has to be told plainly and told they can refuse.
Who else sees it	Names Puntjes as your processor rather than as another business that got your customer list.
What you can ask us	The rights only work if the customer knows they have them. The month and "costs you nothing" are the law's own limits.

---

What Puntjes does, so you do not have to promise it

Some of what these templates say is true because the platform makes it true, and you can rely on it.

• Every advertising email carries an unsubscribe link. It opens a page with one button, and pressing it is enough. No login, and nothing to fill in.
• A customer whose date of birth says under 13 cannot be given permission to receive advertising email. The portal and the API both refuse it.
• Anonymising a customer removes their name, email address, phone number, date of birth and card numbers, and keeps the points and the history without a name.
• Your customers are yours. Puntjes never emails them on its own account and never sells anything to them.
• Your data can leave with you at any time. See Export your workspace.