Store Customers’ Personal Data: How to Collect, Protect, and Delete It

A store may collect customers’ personal data for a specific lawful purpose: to fulfil an order, deliver goods, run a loyalty program, or send marketing they have agreed to receive. For each purpose, the owner must determine the legal basis, the data needed, the retention period, and who will have access. Customers must be told these terms when their data is collected. A phone number provided for delivery does not, by itself, authorize marketing messages.

The entrepreneur or company that decides why and how to use the customer database is responsible for it. Before collecting data, the owner must approve data-handling rules, prepare a notice for customers, set up employee access, and enter into agreements with contractors. The store must then protect the data, keep a record of processing operations, respond to customer requests, and promptly delete information for which there is no longer a lawful basis.

What customer information counts as personal data

Personal data is information that can identify a particular person. For a store, this includes a name, phone number, email address, delivery address, date of birth, and purchase history linked to a customer card. A card number can also be personal data if the store can identify its owner.

The law applies to electronic databases and structured paper filing systems. Customer questionnaires kept in a folder, a spreadsheet of phone numbers, records in an accounting program, and a mailing list all need protection. Processing is not limited to collection: viewing, copying, transferring, storing, and deleting are also operations involving personal data.

List every place where the store keeps this information. Check the website, accounting program, email, work messaging apps, spreadsheets, paper questionnaires, mailing-list files, and backups. For each location, record who has access and why.

Set a purpose and legal basis for each set of data

Article 11 of Law No. 2297-VI sets out several legal bases for processing. For a store, the most commonly relevant are the customer’s consent, entering into and performing a contract, and fulfilling a legal obligation. Legitimate interest may also be a basis, but only if the person’s rights and freedoms do not override that interest. Simply wanting to keep contacts for future sales is not enough.

Collect only what is needed. An online store may require only information necessary to enter into and perform an electronic contract. For example, for delivery to a pickup branch, do not make a home address mandatory if it is not needed for that order. For an ordinary discount card, do not collect a passport copy without a separate, justified need and legal basis.

Hypothetical example: a store keeps 2,000 questionnaires with eight fields each, but only five fields are needed for the stated purpose. After review and removal of the unnecessary fields, it will eliminate 2,000 × 3 = 6,000 values. This reduces the amount of information employees could accidentally copy or disclose. The five fields in this example are the choice of a particular store, not a requirement set by law.

Explain the terms to customers before collecting data

When a customer provides data directly, the store must tell them the terms at the time of collection. If the store obtained the data from another source, the general deadline for giving notice is 30 working days from collection, except where the law provides otherwise. However, receiving someone else’s contact list does not create a lawful basis to use it.

The notice must explain:

• who controls the data: the company name or sole proprietor’s details, registered location, and contact for requests;
• exactly what information the store collects;
• the purposes and legal bases for processing it;
• who receives the data, such as a named carrier or mailing service;
• what rights the customer has and how to exercise them.

It is also useful to explain the retention periods or the criteria used to set them. On the website, place the notice next to the form and provide access to the full privacy policy. For a paper questionnaire, prepare text for the customer to read before filling it out. Keep proof that the store provided this information: it is needed throughout the processing period.

The privacy policy describes the store’s rules. Consent records the customer’s voluntary permission for specified processing. If data is necessary to fulfil an order, state the relevant contractual basis. Arrange a proper legal basis separately for additional purposes.

How to document consent

Consent must be voluntary and informed. The law allows consent in writing or in another form that makes it possible to conclude that permission was given. Prior written consent, including electronic consent, is required for marketing sent using phone numbers or other network identifiers.

In a subscription form, use a separate unticked box with specific wording: who will send marketing, to which contact, and through which channel. The customer must tick it themselves. If the store uses a checkbox during registration in an e-commerce system as consent to data processing, the system must not allow that processing before the box is ticked.

Keep the consent text and its version, date, method of consent, and information linking it to a particular customer. The Standard Procedure for Personal Data Processing requires proof of consent to be kept for the duration of processing. If the store changes the purpose to one incompatible with the original purpose, it must obtain consent for the new purpose unless the law provides otherwise.

Keep marketing separate from order updates

Use messages about an order being ready or its delivery time to fulfil the order. For promotions, new products, and promo codes, create a separate list of customers with valid marketing consent. Do not add advertising to a service message without checking that there is an appropriate legal basis.

Article 10 of the Law “On Electronic Commerce” provides for the possibility of sending a commercial message without consent if recipients can opt out of subsequent messages. However, the store must also comply with Article 120 of the Law “On Electronic Communications” and Article 14-3 of the Law “On Advertising”: they prohibit spam and require prior consent for advertising using phone numbers or other network identifiers. Therefore, do not treat the option to unsubscribe as permission to send marketing to the entire order database.

Include a simple, free way to opt out in every marketing message. Format a commercial electronic message so the customer can clearly recognize it as advertising, and provide direct, easy access to the seller’s details under Article 7 of the Law “On Electronic Commerce.” The terms of a discount, gift, or other incentive must be accessible and unambiguous. If a message includes a price, state whether taxes are included and, if delivery is involved, state its cost as well. After a customer opts out, stop sending marketing to their contact details through every service the store uses.

Set rules for employees and contractors

A data controller is the sole proprietor or company that determines the purpose of processing, which data is processed, and the procedures for handling it. A processor is a contractor that processes data on the controller’s behalf. For example, a service the store instructs to send marketing may be a processor. A carrier or payment service may have its own processing purposes, so its role must be determined based on what it actually does and the contract.

Before work begins, the owner must approve internal data-processing procedures. These must specify the purposes and legal bases for processing; the categories of customers whose data the store processes; the data involved; collection and recording methods; retention periods and conditions; employee and customer access; terms of transfer and a list of third parties; correction and deletion; security; and operation logs. Assign a responsible person for each task: who responds to customers, who changes a record, who monitors contractors, and who revokes access.

• Prepare customer notices and consent forms for the relevant purposes.
• Keep a list of employees with access and specify what data each person needs for their job.
• Obtain written confidentiality undertakings from those employees before granting access.
• Sign a written agreement with each processor: it may process data only for the purpose and within the scope specified in the agreement.
• Prepare a procedure for responding to requests and a plan for data loss or unauthorized access.

In contractor agreements, it is also practical to specify employee access, security, incident notifications, engagement of other service providers, and how data will be returned or destroyed when the work ends. Before transferring data to a carrier or another recipient, the owner must identify the legal basis for that specific transfer: the customer’s consent or a situation in which transfer without consent is provided for by law. The store must ensure the prescribed level of protection, and the recipient must take steps in advance to comply with the Law. If a third party refuses to accept the relevant obligations or cannot fulfil them, the store must not give it access. Transfer only the information needed: a carrier handling one delivery does not need the customer’s entire purchase history.

A sole proprietor is personally responsible for protecting the data they control. The Law expressly requires controllers and processors whose processing must be notified to the Ukrainian Parliament Commissioner for Human Rights to designate a responsible person or unit. Other stores organize this work through the people who process the data or employees appointed for the purpose. Assigning technical tasks to an administrator does not release the owner from their duties.

Protect the database, paper forms, and copies

The Law requires data to be protected against accidental loss, destruction, unlawful processing, and unauthorized access. The store determines the specific organizational and technical measures based on its operations. A practical starting point is to give each employee a separate account, grant access based on their duties, secure devices, control copying, and keep backups with restricted access.

Store paper questionnaires so customers and outsiders cannot read them. Do not leave contact lists by the cash register. Train employees to handle data and repeat the training. On the day an employee leaves or moves to a role that does not involve data, revoke their access and transfer documents and storage media to another employee. The duty of confidentiality continues after employment ends.

Operations that must be logged

Under clause 3.11 of the Standard Procedure, the store must log the collection, modification, viewing, transfer or copying, deletion, and destruction of data. The store must record the date, time, and source of collection; information about modification, viewing, and transfer or copying; the date and time of deletion or destruction; and the employee who carried out the operation. For modification, viewing, transfer, deletion, and destruction, it must also record the purpose and legal basis. If the store processes data in an automated system, the system must automatically log this information.

The owner and administrator must check that the log covers all required operations, including viewing and exporting contacts. An ordinary sales report does not prove this. Operation logs must be retained for one year after the end of the year in which the operations took place, unless the law provides otherwise.

Hypothetical example: an employee viewed a customer’s data on February 12, 2026. Under the general rule, the record of that view must be kept throughout 2027. The end of that retention period does not determine the retention period for the customer card itself: its own purpose and legal basis apply.

How long to keep data and how to delete it

There is no single retention period. Data that can identify a person may be kept no longer than necessary for the lawful purpose. Set separate periods or clear criteria for orders, the loyalty program, marketing contacts, consent records, and accounting documents.

Data must be deleted or destroyed, among other cases, when the period specified by consent or law ends, or the legal relationship ends, unless the law provides otherwise. Data collected unlawfully must also be deleted or destroyed. If consent was the sole legal basis, the store must stop the relevant processing when the consent is withdrawn.

Withdrawing marketing consent does not cancel the obligation to retain records required by law. For those records, the accountant must identify the specific rule, retention period, and events that affect its calculation. Restrict access to this data and use it only for the proper purpose.

Anonymization means removing information that could directly or indirectly identify a person. Replacing a name with “Customer” does not complete anonymization if the record still contains a phone number, address, or link to an order under the person’s name.

Before deleting data, check all copies: the accounting database, website, mailing service, spreadsheets, paper documents, backup archives, and contractor-held data. The Standard Procedure requires data to be destroyed in a way that prevents its subsequent restoration. Work with the administrator to determine how to meet this requirement for archives and how to prevent deleted contacts from reappearing when the database is restored.

How to respond to customer requests

A customer can ask what data the store processes, where it came from, who receives it, and how automated processing works. They have the right to free access to their data, to withdraw consent, to object to processing with reasons, and to request correction or destruction of unlawful or inaccurate data. The Law also protects a person from an automated decision that has legal consequences for them.

Publish a contact for these requests. The responsible employee logs the date received, verifies the requester’s identity, and clarifies what they are asking for. For a formal access request, Article 16 specifies, among other things, the person’s full name, place of residence or stay, and details of an identity document. This is a requirement for the request; it is not permission to collect passports from all customers in advance.

Do not defer a customer’s access to their own data. The option under Article 17 to extend the general period to 45 calendar days applies to third-party access and requires written notice with an explanation. If the store refuses, it must state the lawful grounds. The customer may appeal the decision to the Commissioner or a court.

When to notify the Commissioner

Registration of personal data databases has been abolished. An ordinary list of customers’ names and contact details does not, by itself, mean that the Commissioner must be notified. Notice is required for processing that poses a special risk to people’s rights and freedoms.

The specified categories include, among others, health data, biometric and genetic data, beliefs, liability for offences, violence, location, and movement routes. The store owner must separately review the history of use of discount cards linked to identified customers: if the records can identify a customer’s presence at a particular store at a particular time, they may count as location data. According to the Commissioner’s explanation, information about a person’s place of residence or registration is not included in this category. Explanation of data categories requiring notification. For example, a prescription for making eyeglasses requires a separate review of the rules for handling health data. Article 7 generally prohibits processing the sensitive data it specifies, but provides exceptions, including unambiguous consent. Having such consent does not remove other obligations.

Before launching such a process, the owner must check the legal basis for processing, the risk categories, and applicable exceptions. The start of processing that requires notification must be reported within 30 working days. Changes to information that must be reported must be reported within 10 working days. The owner must notify the Commissioner that such processing has ended within 10 calendar days of its termination, using the application form in Appendix 3 to the Notification Procedure. The owner must report the establishment of a responsible unit or the appointment of a responsible person by submitting the application form in Appendix 4 with supporting documents within 30 calendar days of the relevant event. The owner must keep copies of submitted applications and assign an employee to monitor these deadlines.

What to check before using a foreign service

Before connecting cloud storage, a mailing service, or another system, find out which company receives the data, in which country it is processed, and who else has access. Article 29 sets conditions for transfers to foreign entities. An adequate level of protection is recognized in European Economic Area states; states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data; and states whose capital markets regulators have signed the International Organization of Securities Commissions (IOSCO) Multilateral Memorandum of Understanding Concerning Consultation, Cooperation and the Exchange of Information. The Cabinet of Ministers of Ukraine determines the list of states that ensure an adequate level of personal data protection.

Part 4 of Article 29 also permits a transfer with the customer’s unambiguous consent specifically to that transfer, or where the controller provides appropriate safeguards against interference with the customer’s personal and family life. If the store chooses another basis under that part, it must establish and document compliance with the conditions of the specific item. A cloud-service agreement, by itself, does not prove that there is a basis for an international transfer. Choose a basis for transferring data to the specific service, enter into an agreement that reflects its role, and tell the customer about recipients. Specify the purpose of data use in the agreement: under part 3 of Article 29, the store must not transfer data to a foreign recipient for a purpose other than the one for which it was collected. Keep evidence that the conditions have been met. Choosing a service with a foreign server is not enough by itself.

How to edit and remove customer data in Torgsoft

In Torgsoft, a customer card can be opened through “Marketing → Customers” and its data can be changed. Before fulfilling a deletion request, the owner determines what information must be removed and which documents still have a lawful basis for retention. Remove contacts for which there is no basis to keep them, and check other fields and linked records. If the card itself must be deleted, first check for debts and documents: the program may block deletion because of unpaid goods, a debt, or the card’s inclusion in posted financial or inventory documents. A card with no interaction history can be deleted.

The “Deactivate” action makes the card inactive. Inactivation retains the data. Therefore, it does not fulfil a requirement to destroy the data. Clearing personal fields also requires a check: the customer may still be identifiable through other records, files, or copies.

The “Clear discount card” action deletes information about the current customer and creates an empty record with the same barcode for reuse. It also deletes information about their purchases and returns; information about the deleted customer cannot be restored. If the action is performed on the central computer of a retail chain, information about the clearing operation will be sent to all of its stores. Do not use this action without checking the accounting consequences. Editing and restrictions on deleting a customer card are described in the Torgsoft instructions. The “Clear discount card” action, deletion of purchase history, and propagation of clearing across a retail chain are described in the “Customers” help page. Software actions must be aligned with the store’s rules, and the necessary changes must be applied to other data storage locations.

What to do if data reaches an unauthorized party

In the internal plan, specify who receives incident reports and who addresses the cause. An employee must immediately tell the owner about a lost storage device, a customer list sent by mistake, or unauthorized access. The administrator closes unsafe access, preserves logs, and checks which records may have been exposed.

Document the incident: when it was discovered, the systems and data involved, the people involved, and the measures taken. Check agreements with services and any special requirements that may determine subsequent notices. Restore secure operations and fix the cause of the incident, such as excessive access rights or uncontrolled exports.

The Commissioner may inspect data handling and issue binding orders, including orders to correct or delete data or stop processing. Administrative liability is provided for violations. The fine depends on the specific violation, the status of the responsible person, and whether it is repeated. For sole proprietors and officials, Article 188-39 of the Code of Ukraine on Administrative Offenses provides for 200–400 non-taxable minimum incomes of citizens for violations of notification requirements concerning processing or changes to information, and 300–1,000 for failing to comply with a data-protection order or violating the protection procedure in a way that results in unauthorized access or infringes a customer’s rights. For a notification violation or failure to comply with an order repeated within a year after an administrative penalty has been imposed, the fine is 500–2,000 such minimums; for a repeated violation of the protection procedure within a year for which the person has already been subject to an administrative penalty, it is 1,000–2,000. Control procedure and liability.

Unlawful acts involving confidential information about a person may also fall under Article 182 of the Criminal Code. It provides for a fine or other penalties and, for repeat offences or significant harm, may include imprisonment for a term of three to five years. Criminal liability depends on whether the elements of the relevant offence are present.

Documents to prepare before launching a customer database

1. The owner lists the data, purposes, legal bases, storage locations, and recipients.
2. The owner approves internal procedures specifying responsible staff, deadlines, access, security, and deletion rules.
3. The employee responsible for forms and the website publishes customer notices and sets up separate marketing consent.
4. The manager prepares an access list and written confidentiality undertakings for employees.
5. The owner enters into agreements with processors and checks the terms for transfers to other recipients.
6. The administrator checks operation logs, security for the database and copies, and the deletion procedure.
7. The responsible employee prepares a request log, response templates, and a process for monitoring deadlines.

Official sources

• Law of Ukraine “On Personal Data Protection” No. 2297-VI — Articles 2, 4, 6–17, 19–24, 28–29: legal bases, notices, customer rights, transfers, retention, protection, and deletion.
• Order of the Ukrainian Parliament Commissioner for Human Rights No. 1/02-14 “On Approval of Documents in the Field of Personal Data Protection” — Standard Procedure, clauses 1.2, 2.1–2.18, 3.1–3.22; Notification Procedure. Text of the Standard Procedure on the Commissioner’s website.
• Procedure and forms for notices to the Commissioner — application of Articles 9 and 24 of Law No. 2297-VI, risk categories, and application forms.
• Law of Ukraine “On Electronic Commerce” No. 675-VIII — Article 7, parts 1 and 4; Article 10, parts 2–4: seller information, necessary data, and commercial messages.
• Law of Ukraine “On Electronic Communications” No. 1089-IX — Article 120, parts 1–2: prohibition on spam, consent, and free opt-out.
• Law of Ukraine “On Advertising” No. 270/96-ВР — Article 14-3, part 2: prior written consent, including electronic consent, for advertising using phone numbers or other network identifiers.
• Code of Ukraine on Administrative Offenses No. 8073-X — Articles 188-39 and 188-40: liability for violating data protection rules and failing to comply with the Commissioner’s lawful requirements.
• Criminal Code of Ukraine No. 2341-III — Article 182, parts 1–2: violation of privacy.