{"id":18451,"date":"2026-06-25T14:10:09","date_gmt":"2026-06-25T12:10:09","guid":{"rendered":"https:\/\/www.prodata.de\/kundenbindung\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/"},"modified":"2026-09-12T17:24:11","modified_gmt":"2026-09-12T15:24:11","slug":"gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection","status":"publish","type":"post","link":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/","title":{"rendered":"GDPR-Compliant Loyalty Program: Data Protection Requirements, Hosting in Germany, and Provider Selection"},"content":{"rendered":"\n<style id=\"pdg-golden-record-v2\">:root { --pdg-navy: #063b78; --pdg-blue: #1248b4; --pdg-blue-dark: #082f66; --pdg-orange: #f39200; --pdg-orange-dark: #d97800; --pdg-ink: #18324a; --pdg-muted: #5f7182; --pdg-line: #dbe5ef; --pdg-soft: #f4f8fc; --pdg-white: #ffffff; --pdg-radius: 22px; --pdg-shadow: 0 16px 42px rgba(8, 47, 102, 0.10); } body.single-post:has(.pdg-page-v1) .page-header { display: none; } body.single-post:has(.pdg-page-v1) .page-content { color: var(--pdg-ink); font-size: 18px; line-height: 1.72; overflow: clip; } body.single-post:has(.pdg-page-v1) .page-content > :not(.prodata-hero):not(.pdm-trust):not(.pdm-ref):not(.pd-intro):not(.pdm-ctaband):not(.pd-leadmagnet), body.single-post:has(.pdg-page-v1) .page-content > .wp-block-group:not(.pd-leadmagnet) { width: min(100% - 48px, 940px); margin-left: auto; margin-right: auto; } body.single-post:has(.pdg-page-v1) .page-content > p, body.single-post:has(.pdg-page-v1) .page-content > ul, body.single-post:has(.pdg-page-v1) .page-content > ol, body.single-post:has(.pdg-page-v1) .page-content > h2, body.single-post:has(.pdg-page-v1) .page-content > h3, body.single-post:has(.pdg-page-v1) .page-content > figure, body.single-post:has(.pdg-page-v1) .page-content > section, body.single-post:has(.pdg-page-v1) .page-content > aside { margin-top: 26px; margin-bottom: 26px; } body.single-post:has(.pdg-page-v1) .prodata-hero { width: 100%; max-width: none; min-height: 520px !important; margin: 0; padding: 84px 24px; background: radial-gradient(circle at 82% 32%, rgba(50, 119, 224, 0.50), transparent 31%), linear-gradient(125deg, var(--pdg-blue-dark), var(--pdg-blue)); color: var(--pdg-white); border: 0; box-shadow: none; } body.single-post:has(.pdg-page-v1) .prodata-hero .wp-block-cover__background { display: none; } body.single-post:has(.pdg-page-v1) .prodata-hero .wp-block-cover__inner-container { width: min(100%, 1110px); margin: auto; } body.single-post:has(.pdg-page-v1) .prodata-hero h1, body.single-post:has(.pdg-page-v1) .prodata-hero h2 { max-width: 820px; margin: 0 0 22px; color: var(--pdg-white) !important; font-size: clamp(44px, 5vw, 70px); font-weight: 800; line-height: 1.02; letter-spacing: -0.035em; } body.single-post:has(.pdg-page-v1) .prodata-hero .pdm-kw { color: var(--pdg-orange); } body.single-post:has(.pdg-page-v1) .prodata-hero .pdm-eyebrow { display: none !important; } body.single-post:has(.pdg-page-v1) .prodata-hero p { max-width: 760px; margin: 0 0 30px; color: #e7efff !important; font-size: clamp(20px, 2vw, 27px); line-height: 1.5; } body.single-post:has(.pdg-page-v1) .prodata-hero a { width: max-content !important; max-width: 100% !important; } body.single-post:has(.pdg-page-v1) .prodata-hero a, body.single-post:has(.pdg-page-v1) .pdm-btn { display: inline-flex; align-items: center; justify-content: center; min-height: 56px; padding: 15px 28px; border: 2px solid var(--pdg-orange); border-radius: 999px; background: var(--pdg-orange); color: #102f50 !important; font-weight: 800; line-height: 1.25; text-decoration: none !important; box-shadow: 0 12px 26px rgba(243, 146, 0, 0.24); } body.single-post:has(.pdg-page-v1) .prodata-hero a:hover, body.single-post:has(.pdg-page-v1) .pdm-btn:hover { background: var(--pdg-orange-dark); border-color: var(--pdg-orange-dark); } body.single-post:has(.pdg-page-v1) .pdm-trust, body.single-post:has(.pdg-page-v1) .pdm-ref, body.single-post:has(.pdg-page-v1) .pd-intro, body.single-post:has(.pdg-page-v1) .pd-leadmagnet { width: 100%; max-width: none; margin: 0; padding: 64px max(24px, calc((100% - 1110px) \/ 2)); } body.single-post:has(.pdg-page-v1) .pdm-trust { background: var(--pdg-soft); } body.single-post:has(.pdg-page-v1) .pdm-eyebrow, body.single-post:has(.pdg-page-v1) .pd-eyebrow { display: block; margin-bottom: 16px; color: var(--pdg-navy); font-size: 13px; font-weight: 850; letter-spacing: 0.18em; line-height: 1.3; text-transform: uppercase; } body.single-post:has(.pdg-page-v1) .pdm-trust-list { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 18px; margin: 0 0 26px; padding: 0; list-style: none; } body.single-post:has(.pdg-page-v1) .pdm-trust-list li { min-width: 0; padding: 24px; border: 1px solid var(--pdg-line); border-radius: 18px; background: var(--pdg-white); } body.single-post:has(.pdg-page-v1) .pdm-trust-list strong, body.single-post:has(.pdg-page-v1) .pdm-trust-list span { display: block; } body.single-post:has(.pdg-page-v1) .pdm-trust-list strong { margin-bottom: 6px; color: var(--pdg-navy); font-size: 20px; line-height: 1.25; } body.single-post:has(.pdg-page-v1) .pdm-trust-list span, body.single-post:has(.pdg-page-v1) .pdm-trust-note { color: var(--pdg-muted); font-size: 15px; line-height: 1.5; } body.single-post:has(.pdg-page-v1) .pdm-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 14px; margin-top: 24px; } body.single-post:has(.pdg-page-v1) .pdm-tel { display: inline-flex; align-items: center; min-height: 52px; padding: 12px 20px; border: 2px solid var(--pdg-navy); border-radius: 14px; color: var(--pdg-navy) !important; font-weight: 800; text-decoration: none !important; } body.single-post:has(.pdg-page-v1) .pdm-ref { background: var(--pdg-navy); color: var(--pdg-white); } body.single-post:has(.pdg-page-v1) .pdm-ref-k { color: #bfd8ff; font-size: 13px; font-weight: 800; letter-spacing: 0.16em; text-transform: uppercase; } body.single-post:has(.pdg-page-v1) .pdm-ref-list { display: flex; flex-wrap: wrap; gap: 10px; margin: 20px 0; padding: 0; list-style: none; } body.single-post:has(.pdg-page-v1) .pdm-ref-list li { padding: 9px 14px; border: 1px solid rgba(255,255,255,.24); border-radius: 999px; background: rgba(255,255,255,.08); } body.single-post:has(.pdg-page-v1) .pdm-ref-link { color: var(--pdg-white) !important; font-weight: 750; } body.single-post:has(.pdg-page-v1) .pd-intro { background: var(--pdg-white); } body.single-post:has(.pdg-page-v1) .pd-intro-grid { display: grid; grid-template-columns: 1.15fr .85fr; gap: 32px; align-items: stretch; } body.single-post:has(.pdg-page-v1) .pd-intro-text, body.single-post:has(.pdg-page-v1) .pd-ap, body.single-post:has(.pdg-page-v1) .pd-intro-stats, body.single-post:has(.pdg-page-v1) .pd-provider, body.single-post:has(.pdg-page-v1) .pd-author, body.single-post:has(.pdg-page-v1) .pd-golden-addendum, body.single-post:has(.pdg-page-v1) .pd-golden-addendum-2, body.single-post:has(.pdg-page-v1) .pd-golden-addendum-3, body.single-post:has(.pdg-page-v1) .pd-roi-role, body.single-post:has(.pdg-page-v1) .pd-cost-alternative, body.single-post:has(.pdg-page-v1) .pd-anbieter-full { padding: 28px; border: 1px solid var(--pdg-line); border-radius: var(--pdg-radius); background: var(--pdg-white); box-shadow: var(--pdg-shadow); } body.single-post:has(.pdg-page-v1) .pd-ap-head { margin-bottom: 14px; color: var(--pdg-navy); font-weight: 800; } body.single-post:has(.pdg-page-v1) .pd-ap ul { margin: 0; padding-left: 20px; } body.single-post:has(.pdg-page-v1) .pd-stats { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 14px; } body.single-post:has(.pdg-page-v1) .pd-stat { min-width: 0; padding: 20px; border-radius: 16px; background: var(--pdg-soft); } body.single-post:has(.pdg-page-v1) .pd-num, body.single-post:has(.pdg-page-v1) .pd-lab { display: block; } body.single-post:has(.pdg-page-v1) .pd-num { color: var(--pdg-navy); font-size: 21px; font-weight: 850; } body.single-post:has(.pdg-page-v1) .pd-lab { margin-top: 6px; color: var(--pdg-muted); font-size: 14px; line-height: 1.45; } body.single-post:has(.pdg-page-v1) .pdm-nav { width: min(100% - 48px, 1110px); margin: 38px auto; padding: 28px; border: 1px solid var(--pdg-line); border-radius: var(--pdg-radius); background: var(--pdg-soft); } body.single-post:has(.pdg-page-v1) .pdm-nav-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid a { display: grid; grid-template-columns: 38px minmax(0, 1fr); gap: 10px; align-items: start; padding: 12px; border-radius: 12px; color: var(--pdg-ink); text-decoration: none; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid a:hover { background: var(--pdg-white); } body.single-post:has(.pdg-page-v1) .pdm-nav-grid b { color: var(--pdg-orange-dark); } body.single-post:has(.pdg-page-v1) h2 { color: var(--pdg-navy); font-size: clamp(30px, 3.2vw, 44px); font-weight: 820; line-height: 1.12; letter-spacing: -0.025em; } body.single-post:has(.pdg-page-v1) h3 { color: var(--pdg-navy); font-size: clamp(23px, 2.2vw, 30px); line-height: 1.25; } body.single-post:has(.pdg-page-v1) a { color: #075db4; text-underline-offset: 3px; } body.single-post:has(.pdg-page-v1) .pd-figure { overflow: hidden; border-radius: var(--pdg-radius); background: var(--pdg-soft); box-shadow: var(--pdg-shadow); } body.single-post:has(.pdg-page-v1) .pd-figure img { display: block; width: 100%; height: auto; } body.single-post:has(.pdg-page-v1) .pd-figcaption { display: block; padding: 14px 18px; color: var(--pdg-muted); font-size: 14px; } body.single-post:has(.pdg-page-v1) .wp-block-table { overflow: visible; margin-top: 34px; margin-bottom: 34px; border-radius: 18px; box-shadow: var(--pdg-shadow); } body.single-post:has(.pdg-page-v1) table { width: 100%; border-collapse: separate; border-spacing: 0; table-layout: auto; overflow: hidden; border: 1px solid var(--pdg-line); border-radius: 18px; background: var(--pdg-white); } body.single-post:has(.pdg-page-v1) th, body.single-post:has(.pdg-page-v1) td { padding: 16px; border: 0; border-bottom: 1px solid var(--pdg-line); vertical-align: top; text-align: left; overflow-wrap: anywhere; } body.single-post:has(.pdg-page-v1) th { background: var(--pdg-navy); color: var(--pdg-white); font-size: 15px; font-weight: 800; } body.single-post:has(.pdg-page-v1) tbody tr:last-child td { border-bottom: 0; } body.single-post:has(.pdg-page-v1) .pd-leadmagnet { margin-top: 58px; margin-bottom: 58px; background: linear-gradient(135deg, #ecf5ff, #f8fbff); } body.single-post:has(.pdg-page-v1) .pd-lm-head { width: min(100%, 940px); margin: auto; } body.single-post:has(.pdg-page-v1) .schema-faq { width: min(100% - 48px, 940px); margin: 28px auto 54px; } body.single-post:has(.pdg-page-v1) .schema-faq-section { margin: 0 0 16px; overflow: hidden; border: 1px solid var(--pdg-line); border-radius: 18px; background: var(--pdg-white); box-shadow: 0 10px 28px rgba(8, 47, 102, 0.07); } body.single-post:has(.pdg-page-v1) .schema-faq-question { margin: 0; padding: 20px 24px; border: 0; border-left: 6px solid var(--pdg-orange); color: var(--pdg-navy); font-size: 20px; font-weight: 800; overflow-wrap: anywhere; hyphens: auto; } body.single-post:has(.pdg-page-v1) .schema-faq-answer { margin: 0; padding: 0 24px 22px 30px; border: 0; color: var(--pdg-ink); overflow-wrap: anywhere; hyphens: auto; } body.single-post:has(.pdg-page-v1) .schema-faq-answer p:last-child { margin-bottom: 0; } body.single-post:has(.pdg-page-v1) .pd-provider, body.single-post:has(.pdg-page-v1) .pd-author { width: min(100% - 48px, 940px); margin: 30px auto; } body.single-post:has(.pdg-page-v1) .pd-provider { position: relative; background: var(--pdg-white) !important; background-image: none !important; color: var(--pdg-ink) !important; } body.single-post:has(.pdg-page-v1) .pd-provider::before, body.single-post:has(.pdg-page-v1) .pd-provider::after { display: none !important; content: none !important; } body.single-post:has(.pdg-page-v1) .pd-provider h2 { color: var(--pdg-navy) !important; } body.single-post:has(.pdg-page-v1) .pd-provider p, body.single-post:has(.pdg-page-v1) .pd-provider li { color: var(--pdg-ink) !important; } body.single-post:has(.pdg-page-v1) .pd-author { display: grid; grid-template-columns: 70px minmax(0, 1fr); gap: 22px; align-items: start; } body.single-post:has(.pdg-page-v1) .pd-avatar { display: grid; place-items: center; width: 70px; height: 70px; border-radius: 50%; background: var(--pdg-navy); color: var(--pdg-white); font-weight: 850; } body.single-post:has(.pdg-page-v1) .pd-aname { margin: 0; color: var(--pdg-navy); font-size: 21px; font-weight: 850; } body.single-post:has(.pdg-page-v1) .pd-arole { margin: 2px 0 10px; color: var(--pdg-muted); font-size: 15px; } body.single-post:has(.pdg-page-v1) .pd-pills { display: flex; flex-wrap: wrap; gap: 10px; width: min(100% - 48px, 940px); margin: 18px auto 70px; } body.single-post:has(.pdg-page-v1) .pd-pill { display: inline-flex; padding: 10px 15px; border: 1px solid #cbdbee; border-radius: 999px; background: var(--pdg-soft); color: var(--pdg-navy) !important; font-size: 14px; font-weight: 750; line-height: 1.3; text-decoration: none !important; } body.single-post:has(.pdg-page-v1) .pdm-sticky, body.single-post:has(.pdg-page-v1) .pdm-ctaband { display: none !important; } @media (max-width: 800px) { body.single-post:has(.pdg-page-v1) main.site-main { width: 100%; max-width: none; padding-left: 0 !important; padding-right: 0 !important; } body.single-post:has(.pdg-page-v1) .page-content { width: 100%; max-width: none; padding-left: 0 !important; padding-right: 0 !important; font-size: 17px; line-height: 1.65; } body.single-post:has(.pdg-page-v1) .page-content > :not(.prodata-hero):not(.pdm-trust):not(.pdm-ref):not(.pd-intro):not(.pdm-ctaband):not(.pd-leadmagnet), body.single-post:has(.pdg-page-v1) .page-content > .wp-block-group:not(.pd-leadmagnet) { width: min(100% - 40px, 940px); } body.single-post:has(.pdg-page-v1) .prodata-hero { width: 100%; min-height: 0 !important; margin: 14px 0 0 !important; padding: 52px 24px 58px; border-radius: 0 !important; } body.single-post:has(.pdg-page-v1) .prodata-hero h1, body.single-post:has(.pdg-page-v1) .prodata-hero h2 { font-size: clamp(34px, 9.2vw, 42px); line-height: 1.04; overflow-wrap: normal !important; word-break: normal !important; hyphens: none !important; } body.single-post:has(.pdg-page-v1) .prodata-hero p { font-size: 19px; } body.single-post:has(.pdg-page-v1) .prodata-hero a, body.single-post:has(.pdg-page-v1) .pdm-btn { box-sizing: border-box; width: 100%; min-height: 58px; padding: 15px 12px; font-size: clamp(14px, 4.2vw, 16px); white-space: normal; text-align: center; } body.single-post:has(.pdg-page-v1) .pdm-trust, body.single-post:has(.pdg-page-v1) .pdm-ref, body.single-post:has(.pdg-page-v1) .pd-intro, body.single-post:has(.pdg-page-v1) .pd-leadmagnet { padding: 46px 20px; } body.single-post:has(.pdg-page-v1) .pdm-trust-list, body.single-post:has(.pdg-page-v1) .pd-stats { grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; } body.single-post:has(.pdg-page-v1) .pdm-trust-list li, body.single-post:has(.pdg-page-v1) .pd-stat { padding: 17px; } body.single-post:has(.pdg-page-v1) .pdm-trust-note { display: none; } body.single-post:has(.pdg-page-v1) .pdm-actions { display: grid; grid-template-columns: 1fr; } body.single-post:has(.pdg-page-v1) .pdm-tel { justify-content: center; width: 100%; } body.single-post:has(.pdg-page-v1) .pd-intro-grid { grid-template-columns: 1fr; } body.single-post:has(.pdg-page-v1) .pdm-nav { width: calc(100% - 40px); padding: 20px; } body.single-post:has(.pdg-page-v1) .pdm-nav.pdg-toc-long { display: none !important; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid { grid-template-columns: 1fr; } body.single-post:has(.pdg-page-v1) h2 { font-size: 31px; overflow-wrap: normal; word-break: normal; hyphens: auto; } body.single-post:has(.pdg-page-v1) .wp-block-table { width: calc(100% - 40px); margin-left: auto; margin-right: auto; overflow: visible; border-radius: 0; box-shadow: none; } body.single-post:has(.pdg-page-v1) table, body.single-post:has(.pdg-page-v1) thead, body.single-post:has(.pdg-page-v1) tbody, body.single-post:has(.pdg-page-v1) tr, body.single-post:has(.pdg-page-v1) td { display: block; width: 100%; } body.single-post:has(.pdg-page-v1) thead { position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0; overflow: hidden; clip: rect(0 0 0 0); clip-path: inset(50%); white-space: nowrap; } body.single-post:has(.pdg-page-v1) tbody tr { margin: 0 0 18px; overflow: hidden; border: 1px solid var(--pdg-line); border-radius: 18px; background: var(--pdg-white); box-shadow: var(--pdg-shadow); } body.single-post:has(.pdg-page-v1) td { display: grid; grid-template-columns: minmax(96px, 36%) minmax(0, 1fr); gap: 12px; padding: 13px 15px; overflow-wrap: anywhere; } body.single-post:has(.pdg-page-v1) td::before { content: attr(data-label); color: var(--pdg-navy); font-size: 13px; font-weight: 850; line-height: 1.35; } body.single-post:has(.pdg-page-v1) .schema-faq, body.single-post:has(.pdg-page-v1) .pd-provider, body.single-post:has(.pdg-page-v1) .pd-author, body.single-post:has(.pdg-page-v1) .pd-pills { width: calc(100% - 40px); } body.single-post:has(.pdg-page-v1) .schema-faq-question { padding: 18px 18px; font-size: 18px; } body.single-post:has(.pdg-page-v1) .schema-faq-answer { padding: 0 18px 20px 24px; } body.single-post:has(.pdg-page-v1) .pd-author { grid-template-columns: 1fr; } } @media (max-width: 360px) { body.single-post:has(.pdg-page-v1) .prodata-hero { padding-left: 20px; padding-right: 20px; } body.single-post:has(.pdg-page-v1) .prodata-hero h1, body.single-post:has(.pdg-page-v1) .prodata-hero h2 { font-size: 34px; } body.single-post:has(.pdg-page-v1) .pdm-trust-list, body.single-post:has(.pdg-page-v1) .pd-stats { grid-template-columns: 1fr 1fr; } body.single-post:has(.pdg-page-v1) .pdm-trust-list strong, body.single-post:has(.pdg-page-v1) .pd-num { font-size: 17px; } body.single-post:has(.pdg-page-v1) td { grid-template-columns: 1fr; gap: 5px; } } body.single-post:has(.pdg-page-v1) main.site-main, body.single-post:has(.pdg-page-v1) .page-content { width: 100% !important; max-width: none !important; margin-left: 0 !important; margin-right: 0 !important; padding-left: 0 !important; padding-right: 0 !important; } body.single-post:has(.pdg-page-v1) .page-content > :not(.prodata-hero):not(.pdm-trust):not(.pdm-ref):not(.pd-intro):not(.pdm-ctaband):not(.pd-leadmagnet):not(.pdg-cta-band), body.single-post:has(.pdg-page-v1) .page-content > .wp-block-group:not(.pd-leadmagnet) { width: min(100% - 48px, 980px); } body.single-post:has(.pdg-page-v1) .prodata-hero { min-height: 600px !important; padding: 92px max(28px, calc((100% - 1180px) \/ 2)) !important; border-radius: 0 !important; background: radial-gradient(circle at 78% 12%, rgba(102, 174, 255, .32), transparent 33%), radial-gradient(circle at 100% 100%, rgba(21, 151, 212, .25), transparent 42%), linear-gradient(128deg, #06366f 0%, #084994 52%, #1d4ec0 100%) !important; } body.single-post:has(.pdg-page-v1) .prodata-hero .wp-block-cover__inner-container { position: relative; width: 100% !important; max-width: 1180px !important; min-height: 390px; display: flex; flex-direction: column; justify-content: center; padding-right: 430px; } body.single-post:has(.pdg-page-v1) .prodata-hero h1, body.single-post:has(.pdg-page-v1) .prodata-hero h2 { max-width: 730px; font-size: clamp(56px, 5.3vw, 78px) !important; line-height: 1.01 !important; } body.single-post:has(.pdg-page-v1) .prodata-hero p { max-width: 700px; font-size: clamp(20px, 1.65vw, 25px) !important; } body.single-post:has(.pdg-page-v1) .pdm-trust { padding-top: 54px; padding-bottom: 48px; background: linear-gradient(180deg, #f3f7fd 0%, #f8fbff 100%); } body.single-post:has(.pdg-page-v1) .pdm-trust-list { gap: 34px; margin-top: 18px; margin-bottom: 18px; } body.single-post:has(.pdg-page-v1) .pdm-trust-list li { padding: 0; border: 0; border-radius: 0; background: transparent; box-shadow: none; } body.single-post:has(.pdg-page-v1) .pdg-trust-icon { display: grid !important; place-items: center; width: 42px; height: 42px; margin-bottom: 14px; border-radius: 12px; background: #e5effd; color: #0752a4; } body.single-post:has(.pdg-page-v1) .pdg-trust-icon svg { width: 23px; height: 23px; fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; } body.single-post:has(.pdg-page-v1) .pdm-trust-note { margin: 8px 0 0; font-size: 13px; } body.single-post:has(.pdg-page-v1) .pdm-ref { position: relative; overflow: hidden; padding-top: 38px; padding-bottom: 38px; background: linear-gradient(110deg, #073b78, #0d4da0 58%, #1748b2); } body.single-post:has(.pdg-page-v1) .pdm-ref-k { display: block; color: #d5e7ff; } body.single-post:has(.pdg-page-v1) .pdg-marquee { width: 100%; margin: 20px 0 18px; overflow: hidden; -webkit-mask-image: linear-gradient(90deg, transparent, #000 6%, #000 94%, transparent); mask-image: linear-gradient(90deg, transparent, #000 6%, #000 94%, transparent); } body.single-post:has(.pdg-page-v1) .pdg-marquee-track { display: flex; width: max-content; animation: pdg-marquee 34s linear infinite; } body.single-post:has(.pdg-page-v1) .pdm-ref-list { display: flex; flex-wrap: nowrap; flex: none; gap: 0; margin: 0; padding: 0; } body.single-post:has(.pdg-page-v1) .pdm-ref-list li { position: relative; padding: 0 36px 0 22px; border: 0; border-radius: 0; background: transparent; color: #fff; font-size: clamp(20px, 2vw, 30px); font-weight: 760; white-space: nowrap; } body.single-post:has(.pdg-page-v1) .pdm-ref-list li::after { position: absolute; top: 50%; right: 13px; width: 5px; height: 5px; border-radius: 50%; background: var(--pdg-orange); content: ''; transform: translateY(-50%); } body.single-post:has(.pdg-page-v1) .pdm-ref-link { display: inline-flex; color: #fff !important; font-size: 15px; text-underline-offset: 5px; } @keyframes pdg-marquee { to { transform: translateX(-50%); } } @media (prefers-reduced-motion: reduce) { body.single-post:has(.pdg-page-v1) .pdg-marquee-track { animation-play-state: paused; } } body.single-post:has(.pdg-page-v1) .pdm-nav { margin-top: 28px; margin-bottom: 52px; padding: 18px 20px; border-color: #e3ebf4; border-radius: 14px; background: #fbfdff; box-shadow: none; } body.single-post:has(.pdg-page-v1) .pdm-nav > .pdm-eyebrow { margin-bottom: 10px; font-size: 10px; letter-spacing: .15em; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid { grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 4px 10px; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid a { grid-template-columns: 24px minmax(0, 1fr); gap: 6px; padding: 7px 8px; color: #5a6b80; font-size: 12px; line-height: 1.35; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid b { color: #a05b09; font-size: 11px; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow { position: relative; display: block; width: min(100% - 48px, 980px); margin: 72px auto 0; padding: 52px 64px 8px; border: 1px solid #dce7f4; border-bottom: 0; border-radius: 24px 24px 0 0; background: linear-gradient(135deg, #edf5ff, #f7fbff); color: #49617b; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow::after { display: block; width: 66px; height: 6px; margin-top: 28px; border-radius: 999px; background: var(--pdg-orange); content: ''; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2 { position: relative; width: min(100% - 48px, 980px); margin: 0 auto 28px; padding: 12px 64px 58px; overflow: hidden; border: 1px solid #dce7f4; border-top: 0; border-radius: 0 0 24px 24px; background: linear-gradient(135deg, #edf5ff, #f7fbff); color: #07468f; font-size: clamp(40px, 4vw, 56px); } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2::after { position: absolute; right: 70px; bottom: -92px; width: 220px; height: 220px; border: 1px solid rgba(33, 112, 203, .17); border-radius: 50%; box-shadow: 0 0 0 34px rgba(33, 112, 203, .08), 0 0 0 68px rgba(33, 112, 203, .045); content: ''; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2 + p { margin-top: 0; margin-bottom: 34px; color: #203d59; font-size: 20px; font-weight: 650; line-height: 1.65; } body.single-post:has(.pdg-page-v1) .pd-golden-addendum-3 > h2, body.single-post:has(.pdg-page-v1) .pd-cost-alternative > h2 { padding-left: 18px; border-left: 5px solid var(--pdg-orange); } body.single-post:has(.pdg-page-v1) .pd-ca-sources, body.single-post:has(.pdg-page-v1) .pd-ca-note, body.single-post:has(.pdg-page-v1) .pdg-source-note { color: #657487 !important; font-size: 12.5px !important; font-weight: 400 !important; line-height: 1.55 !important; } body.single-post:has(.pdg-page-v1) .pd-ca-sources strong, body.single-post:has(.pdg-page-v1) .pdg-source-note strong { color: #46576a; font-weight: 650; } body.single-post:has(.pdg-page-v1) .pd-ca-sources a, body.single-post:has(.pdg-page-v1) .pdg-source-note a { display: inline !important; font-size: inherit !important; font-weight: inherit !important; line-height: inherit !important; } body.single-post:has(.pdg-page-v1) .pdg-cta-band { box-sizing: border-box; display: grid; grid-template-columns: minmax(0, 1.2fr) minmax(280px, .8fr); align-items: center; gap: 42px; width: min(100% - 48px, 980px); margin: 64px auto; padding: 42px 46px; border-radius: 22px; background: linear-gradient(112deg, #063b78, #1248b4); color: #fff; box-shadow: 0 22px 48px rgba(6, 59, 120, .18); } body.single-post:has(.pdg-page-v1) .pdg-cta-band > *, body.single-post:has(.pdg-page-v1) .pdg-cta-actions, body.single-post:has(.pdg-page-v1) .pdg-cta-primary, body.single-post:has(.pdg-page-v1) .pdg-cta-phone { box-sizing: border-box; min-width: 0; max-width: 100%; } body.single-post:has(.pdg-page-v1) .pdg-cta-band h2, body.single-post:has(.pdg-page-v1) .pdg-cta-band p { color: #fff; } body.single-post:has(.pdg-page-v1) .pdg-cta-band h2 { margin: 6px 0 10px; font-size: clamp(28px, 3vw, 38px); } body.single-post:has(.pdg-page-v1) .pdg-cta-band p { margin: 0; color: #dbeaff; line-height: 1.55; } body.single-post:has(.pdg-page-v1) .pdg-cta-kicker, body.single-post:has(.pdg-page-v1) .pdg-personal-kicker { display: block; color: #bcdcff; font-size: 11px; font-weight: 850; letter-spacing: .17em; text-transform: uppercase; } body.single-post:has(.pdg-page-v1) .pdg-cta-actions { display: grid; gap: 12px; } body.single-post:has(.pdg-page-v1) .pdg-cta-primary, body.single-post:has(.pdg-page-v1) .pdg-cta-phone { display: inline-flex; align-items: center; justify-content: center; min-height: 54px; padding: 13px 18px; border-radius: 12px; font-weight: 800; text-align: center; text-decoration: none !important; } body.single-post:has(.pdg-page-v1) .pdg-cta-primary { background: var(--pdg-orange); color: #092f55 !important; box-shadow: 0 12px 24px rgba(0, 24, 66, .25); } body.single-post:has(.pdg-page-v1) .pdg-cta-phone { border: 2px solid rgba(255, 255, 255, .48); color: #fff !important; } body.single-post:has(.pdg-page-v1) .pdg-cta-final { width: 100% !important; max-width: none !important; margin: 72px 0 0; padding: 54px max(28px, calc((100% - 1110px) \/ 2)); border-radius: 0; } body.single-post:has(.pdg-page-v1) .pdg-personal-contact { display: grid; grid-template-columns: 100px minmax(0, 1fr); gap: 28px; width: min(100% - 48px, 980px); margin: 64px auto; padding: 38px 42px; border: 1px solid #dce7f4; border-radius: 22px; background: linear-gradient(135deg, #f4f8fd, #fff); box-shadow: 0 18px 44px rgba(8, 47, 102, .09); } body.single-post:has(.pdg-page-v1) .pdg-personal-avatar { display: grid; place-items: center; width: 92px; height: 92px; border: 8px solid #dfebfb; border-radius: 50%; background: #083f83; color: #fff; font-size: 24px; font-weight: 850; } body.single-post:has(.pdg-page-v1) .pdg-personal-kicker { color: #5f7185; } body.single-post:has(.pdg-page-v1) .pdg-personal-contact h2 { margin: 7px 0 10px; font-size: clamp(28px, 3vw, 40px); } body.single-post:has(.pdg-page-v1) .pdg-personal-contact p { margin: 0 0 14px; } body.single-post:has(.pdg-page-v1) .pdg-personal-name span { display: block; color: var(--pdg-muted); font-size: 14px; } body.single-post:has(.pdg-page-v1) .pdg-personal-links { display: flex; flex-wrap: wrap; gap: 10px 18px; } body.single-post:has(.pdg-page-v1) .pdg-personal-links a { font-weight: 750; } @media (max-width: 1050px) and (min-width: 801px) { body.single-post:has(.pdg-page-v1) .prodata-hero .wp-block-cover__inner-container { padding-right: 330px; } } @media (max-width: 800px) { body.single-post:has(.pdg-page-v1) .prodata-hero { min-height: 0 !important; padding: 52px 24px 56px !important; } body.single-post:has(.pdg-page-v1) .prodata-hero .wp-block-cover__inner-container { min-height: 0; max-width: 100% !important; padding-right: 0; } body.single-post:has(.pdg-page-v1) .prodata-hero h1, body.single-post:has(.pdg-page-v1) .prodata-hero h2 { font-size: clamp(34px, 9.6vw, 43px) !important; line-height: 1.04 !important; } body.single-post:has(.pdg-page-v1) .prodata-hero a { width: 100% !important; } body.single-post:has(.pdg-page-v1) .pdm-trust-list li { min-height: 150px; padding: 16px; border: 1px solid #dfe9f5; border-radius: 16px; background: rgba(255, 255, 255, .78); } body.single-post:has(.pdg-page-v1) .pdg-trust-icon { width: 38px; height: 38px; margin-bottom: 12px; } body.single-post:has(.pdg-page-v1) .pdm-ref-list li { padding-right: 28px; padding-left: 16px; font-size: 20px; } body.single-post:has(.pdg-page-v1) .pdm-ref-link { display: inline-block; max-width: 100%; font-size: 12.5px; line-height: 1.45; white-space: normal; overflow-wrap: break-word; } body.single-post:has(.pdg-page-v1) .pdm-nav { margin-top: 24px; margin-bottom: 34px; padding: 14px; } body.single-post:has(.pdg-page-v1) .pdm-nav-grid { grid-template-columns: 1fr; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow { width: calc(100% - 32px); margin-top: 48px; padding: 34px 24px 6px; border-radius: 18px 18px 0 0; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow::after { width: 52px; height: 5px; margin-top: 20px; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2 { width: calc(100% - 32px); padding: 10px 24px 36px; border-radius: 0 0 18px 18px; font-size: clamp(29px, 8.3vw, 36px); } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2::after { right: -70px; bottom: -125px; } body.single-post:has(.pdg-page-v1) .page-content > .pdm-eyebrow + h2 + p { font-size: 18px; line-height: 1.58; } body.single-post:has(.pdg-page-v1) .pdg-cta-band { grid-template-columns: 1fr; gap: 24px; width: 100%; margin: 50px 0; padding: 42px 24px; border-radius: 0; } body.single-post:has(.pdg-page-v1) .pdg-cta-final { margin-bottom: 0; } body.single-post:has(.pdg-page-v1) .pdg-personal-contact { grid-template-columns: 1fr; width: calc(100% - 40px); padding: 28px 24px; } body.single-post:has(.pdg-page-v1) .pdg-personal-avatar { width: 74px; height: 74px; border-width: 6px; font-size: 20px; } body.single-post:has(.pdg-page-v1) .pdg-personal-links { display: grid; } } @media (max-width: 360px) { body.single-post:has(.pdg-page-v1) .pdm-trust-list li { min-height: 158px; padding: 14px; } body.single-post:has(.pdg-page-v1) .pdm-trust-list strong { font-size: 16px; } } @media (min-width: 801px) { body.single-post:has(.pdg-golden-v2) .prodata-hero { box-sizing: border-box !important; min-height: 600px !important; padding: 84px max(24px, calc((100% - 1110px) \/ 2)) 78px !important; background-image: url(\"data:image\/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%22520%22%20height%3D%22420%22%20viewBox%3D%220%200%20520%20420%22%20fill%3D%22none%22%3E%20%3Cg%20stroke%3D%22%23ffffff%22%20stroke-opacity%3D%220.28%22%20stroke-width%3D%221.4%22%3E%20%3Ccircle%20cx%3D%22260%22%20cy%3D%22210%22%20r%3D%2258%22%2F%3E%3Ccircle%20cx%3D%22260%22%20cy%3D%22210%22%20r%3D%22112%22%2F%3E%3Ccircle%20cx%3D%22260%22%20cy%3D%22210%22%20r%3D%22168%22%2F%3E%20%3Cpath%20d%3D%22M260%20210%20L128%20128M260%20210%20L392%20128M260%20210%20L120%20292M260%20210%20L400%20292M260%20210%20L260%2042M260%20210%20L260%20378%22%2F%3E%3C%2Fg%3E%20%3Cg%20fill%3D%22%23ffffff%22%20fill-opacity%3D%220.88%22%3E%20%3Ccircle%20cx%3D%22128%22%20cy%3D%22128%22%20r%3D%229%22%2F%3E%3Ccircle%20cx%3D%22392%22%20cy%3D%22128%22%20r%3D%229%22%2F%3E%3Ccircle%20cx%3D%22120%22%20cy%3D%22292%22%20r%3D%229%22%2F%3E%3Ccircle%20cx%3D%22400%22%20cy%3D%22292%22%20r%3D%229%22%2F%3E%3Ccircle%20cx%3D%22260%22%20cy%3D%2242%22%20r%3D%227%22%2F%3E%3Ccircle%20cx%3D%22260%22%20cy%3D%22378%22%20r%3D%227%22%2F%3E%3C%2Fg%3E%20%3Ccircle%20cx%3D%22260%22%20cy%3D%22210%22%20r%3D%2240%22%20fill%3D%22none%22%20stroke%3D%22%23EF7D00%22%20stroke-opacity%3D%220.5%22%20stroke-width%3D%222%22%2F%3E%20%3Ccircle%20cx%3D%22260%22%20cy%3D%22210%22%20r%3D%2226%22%20fill%3D%22%23EF7D00%22%2F%3E%20%3Cpath%20d%3D%22M250%20210l6%206%2013-13%22%20fill%3D%22none%22%20stroke%3D%22%23ffffff%22%20stroke-width%3D%222.6%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%2F%3E%3C%2Fsvg%3E\"), linear-gradient(135deg, #00306f 0%, #003d91 56%, #1d39af 100%) !important; background-repeat: no-repeat, no-repeat !important; background-position: calc(100% - 86px) 50%, 50% 50% !important; background-size: auto 456px, cover !important; } body.single-post:has(.pdg-golden-v2) .prodata-hero .wp-block-cover__inner-container { width: 100% !important; max-width: 1110px !important; min-height: 0 !important; padding-right: 430px !important; } body.single-post:has(.pdg-golden-v2) .prodata-hero h1, body.single-post:has(.pdg-golden-v2) .prodata-hero h2 { max-width: 680px !important; font-size: 54px !important; line-height: 1.1 !important; letter-spacing: -.025em !important; } body.single-post:has(.pdg-golden-v2) .prodata-hero p { max-width: 680px !important; font-size: 18.24px !important; line-height: 1.6 !important; } body.single-post:has(.pdg-golden-v2) .page-content > .pd-roi-role, body.single-post:has(.pdg-golden-v2) .page-content > .pdg-inline-cta-wrap, body.single-post:has(.pdg-golden-v2) .page-content > .pdg-cta-mid { box-sizing: border-box !important; width: min(100% - 48px, 980px) !important; margin-left: auto !important; margin-right: auto !important; } } body.single-post:has(.pdg-golden-v2) .pd-roi-role { border-left: 4px solid var(--pdg-orange) !important; background: #f7fafc !important; } body.single-post:has(.pdg-golden-v2) .pdg-inline-cta-wrap { margin-top: 22px; margin-bottom: 34px; } body.single-post:has(.pdg-golden-v2) .pdg-inline-cta { display: inline-flex; align-items: center; min-height: 52px; padding: 13px 24px; border-radius: 999px; background: var(--pdg-orange); color: #092f55 !important; font-weight: 800; text-decoration: none !important; box-shadow: 0 10px 22px rgba(8, 47, 102, .13); } body.single-post:has(.pdg-golden-v2) .pd-leadmagnet > .pd-lm-head, body.single-post:has(.pdg-golden-v2) .pd-leadmagnet > .pd-lead-form { box-sizing: border-box; width: min(100%, 980px); margin-left: auto; margin-right: auto; } body.single-post:has(.pdg-golden-v2) .pd-lead-form, body.single-post:has(.pdg-golden-v2) .pd-lead-row { min-width: 0; } body.single-post:has(.pdg-golden-v2) .pd-lead-row { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 14px; } body.single-post:has(.pdg-golden-v2) .pd-lead-form input, body.single-post:has(.pdg-golden-v2) .pd-lead-form button { box-sizing: border-box; width: 100%; max-width: 100%; min-width: 0; } body.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow { margin-bottom: 0 !important; } body.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow + h2, body.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow + h2.pd-related-title { margin-top: 0 !important; } body.single-post:has(.pdg-golden-v2) .pdg-personal-contact { grid-template-columns: 150px minmax(0, 1fr); align-items: center; } body.single-post:has(.pdg-golden-v2) .pdg-personal-photo { display: block; width: 138px; height: 138px; object-fit: cover; object-position: 50% 34%; border: 8px solid #dfebfb; border-radius: 50%; background: #e8f0fa; } body.single-post:has(.pdg-golden-v2) .pdg-personal-links { gap: 10px; } body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 { hyphens: none !important; overflow-wrap: normal !important; word-break: normal !important; } body.single-post:has(.pdg-golden-v2) .pdg-personal-links a { display: inline-flex; align-items: center; justify-content: center; min-height: 44px; padding: 9px 16px; border: 1px solid #b8cce5; border-radius: 999px; background: #fff; color: #0752a4 !important; font-size: 14px; font-weight: 750; line-height: 1.25; text-align: center; text-decoration: none !important; } body.single-post:has(.pdg-golden-v2) .pdg-personal-links a:last-child { border-color: var(--pdg-orange); background: var(--pdg-orange); color: #092f55 !important; } @media (max-width: 800px) { body.single-post:has(.pdg-golden-v2) .page-content > .pdg-cta-band { width: 100% !important; margin-left: 0 !important; margin-right: 0 !important; } body.single-post:has(.pdg-golden-v2) .pdg-personal-contact { grid-template-columns: 1fr; } body.single-post:has(.pdg-golden-v2) .pdg-personal-photo { width: 104px; height: 104px; border-width: 6px; } body.single-post:has(.pdg-golden-v2) .pdg-inline-cta-wrap { width: calc(100% - 32px) !important; margin-left: auto !important; margin-right: auto !important; } body.single-post:has(.pdg-golden-v2) .pdg-inline-cta { width: 100%; justify-content: center; text-align: center; } body.single-post:has(.pdg-golden-v2) .pd-lead-row { grid-template-columns: 1fr; } } @media (max-width: 360px) { body.single-post:has(.pdg-golden-v2) .pdg-cta-band h2 { font-size: 26px; } body.single-post:has(.pdg-golden-v2) .pdg-cta-primary { padding-left: 8px; padding-right: 8px; font-size: 14px; } body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 { font-size: 24px; line-height: 1.12; } body.single-post:has(.pdg-golden-v2) .pd-intro-stats .pd-stats { grid-template-columns: 1fr; } body.single-post:has(.pdg-golden-v2) .pd-intro-stats .pd-stat { min-height: 0; } }\n\/* Reusable clean-room modules for legacy editorial structures. *\/\nbody.single-post:has(.pdg-golden-v2) main.site-main {\n  overflow-x: clip;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-editorial-note {\n  width: min(100% - 48px, 980px);\n  margin: 34px auto;\n  padding: 26px 28px;\n  border: 1px solid var(--pdg-line);\n  border-left: 4px solid var(--pdg-orange);\n  border-radius: 18px;\n  background: #f7fafc;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-editorial-note p:last-child { margin-bottom: 0; }\nbody.single-post:has(.pdg-golden-v2) .prodata-hero .pd-eyebrow {\n  color: #ffd08a !important;\n  font-weight: 850;\n  letter-spacing: .15em;\n  text-transform: uppercase;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-callout {\n  display: grid;\n  grid-template-columns: minmax(170px, .7fr) 2fr;\n  gap: 26px;\n  align-items: center;\n  margin: 30px auto;\n  padding: 26px 28px;\n  border: 1px solid var(--pdg-line);\n  border-left: 5px solid var(--pdg-orange);\n  border-radius: 18px;\n  background: var(--pdg-soft);\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-callout strong { color: var(--pdg-navy); font-size: 20px; }\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-grid,\nbody.single-post:has(.pdg-golden-v2) .pdg-card-grid,\nbody.single-post:has(.pdg-golden-v2) .pdg-step-grid {\n  display: grid;\n  gap: 16px;\n  margin-top: 28px;\n  margin-bottom: 38px;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-grid { grid-template-columns: repeat(4, minmax(0, 1fr)); }\nbody.single-post:has(.pdg-golden-v2) .pdg-card-grid { grid-template-columns: repeat(3, minmax(0, 1fr)); }\nbody.single-post:has(.pdg-golden-v2) .pdg-step-grid { counter-reset: pdg-step; grid-template-columns: repeat(2, minmax(0, 1fr)); }\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-card,\nbody.single-post:has(.pdg-golden-v2) .pdg-card,\nbody.single-post:has(.pdg-golden-v2) .pdg-step-card {\n  min-width: 0;\n  padding: 22px;\n  border: 1px solid var(--pdg-line);\n  border-radius: 16px;\n  background: var(--pdg-white);\n  box-shadow: 0 10px 28px rgba(8, 47, 102, .07);\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-card { text-align: center; }\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-card b,\nbody.single-post:has(.pdg-golden-v2) .pdg-step-card b { display: block; margin-bottom: 6px; color: var(--pdg-navy); font-size: 19px; }\nbody.single-post:has(.pdg-golden-v2) .pdg-stat-card span { display: block; color: var(--pdg-muted); font-size: 14px; line-height: 1.45; }\nbody.single-post:has(.pdg-golden-v2) .pdg-card h3 { margin-top: 0; }\nbody.single-post:has(.pdg-golden-v2) .pdg-card p:last-child { margin-bottom: 0; }\nbody.single-post:has(.pdg-golden-v2) .pdg-step-card { counter-increment: pdg-step; position: relative; padding-left: 68px; }\nbody.single-post:has(.pdg-golden-v2) .pdg-step-card::before {\n  content: counter(pdg-step);\n  position: absolute;\n  top: 22px;\n  left: 20px;\n  display: grid;\n  place-items: center;\n  width: 34px;\n  height: 34px;\n  border-radius: 50%;\n  background: var(--pdg-navy);\n  color: #fff;\n  font-weight: 850;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-check-card,\nbody.single-post:has(.pdg-golden-v2) .pdg-proof-card,\nbody.single-post:has(.pdg-golden-v2) .pdg-section-shell {\n  margin-top: 34px;\n  margin-bottom: 42px;\n  padding: 30px;\n  border: 1px solid var(--pdg-line);\n  border-radius: 18px;\n  background: var(--pdg-soft);\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-proof-card { background: #eef6fb; }\nbody.single-post:has(.pdg-golden-v2) .pdg-card-title { display: block; margin-bottom: 10px; color: var(--pdg-navy); font-size: 18px; }\nbody.single-post:has(.pdg-golden-v2) .pdg-link-pills { display: flex; flex-wrap: wrap; gap: 10px; margin-top: 30px; margin-bottom: 42px; }\nbody.single-post:has(.pdg-golden-v2) .pdg-link-pills a {\n  display: inline-flex;\n  align-items: center;\n  min-height: 42px;\n  padding: 8px 14px;\n  border: 1px solid #bfd0e2;\n  border-radius: 999px;\n  background: #fff;\n  font-size: 15px;\n  line-height: 1.35;\n  text-decoration: none;\n}\nbody.single-post:has(.pdg-golden-v2) .schema-faq-section {\n  padding: 0 !important;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-heading-break-at-compound {\n  white-space: normal !important;\n  overflow-wrap: normal !important;\n  word-break: normal !important;\n  hyphens: none !important;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-heading-break-at-compound .pdm-kw {\n  white-space: normal !important;\n}\n@media (min-width: 801px) {\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h1.pdg-heading-break-at-compound,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h2.pdg-heading-break-at-compound {\n    font-size: 46px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table table { table-layout: fixed; }\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table th:nth-child(1),\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table td:nth-child(1) { width: 20%; }\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table th:nth-child(2),\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table td:nth-child(2) { width: 45%; }\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table th:nth-child(3),\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table td:nth-child(3) { width: 35%; }\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table th,\n  body.single-post:has(.pdg-golden-v2) .pd-decision-table td { overflow-wrap: normal; word-break: normal; }\n}\n@media (max-width: 800px) {\n  body.single-post:has(.pdg-golden-v2) .page-content h1,\n  body.single-post:has(.pdg-golden-v2) .page-content h2,\n  body.single-post:has(.pdg-golden-v2) .page-content h3 {\n    min-width: 0;\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .page-content p a {\n    overflow-wrap: break-word;\n    word-break: normal;\n    hyphens: auto;\n  }\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h1,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h2 {\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .prodata-hero.pdg-hero-compact h1,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero.pdg-hero-compact h2 {\n    font-size: clamp(27px, 8vw, 34px) !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact { grid-template-columns: minmax(0, 1fr); }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-copy { min-width: 0; }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 { overflow-wrap: break-word !important; word-break: normal !important; hyphens: auto !important; }\n  body.single-post:has(.pdg-golden-v2) .schema-faq-question { display: block; box-sizing: border-box; width: 100%; overflow-wrap: break-word !important; word-break: normal !important; hyphens: none !important; }\n  body.single-post:has(.pdg-golden-v2) .schema-faq-answer { overflow-wrap: normal !important; word-break: normal !important; hyphens: none !important; }\n  body.single-post:has(.pdg-golden-v2) .pd-leadmagnet h2 { font-size: clamp(25px, 7.4vw, 32px) !important; overflow-wrap: break-word !important; word-break: normal !important; hyphens: auto !important; }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-links a { box-sizing: border-box; width: 100%; min-width: 0; overflow-wrap: anywhere; }\n  body.single-post:has(.pdg-golden-v2) .pdg-callout { grid-template-columns: 1fr; gap: 8px; padding: 22px; }\n  body.single-post:has(.pdg-golden-v2) .pdg-stat-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }\n  body.single-post:has(.pdg-golden-v2) .pdg-card-grid,\n  body.single-post:has(.pdg-golden-v2) .pdg-step-grid { grid-template-columns: 1fr; }\n  body.single-post:has(.pdg-golden-v2) .pdg-check-card,\n  body.single-post:has(.pdg-golden-v2) .pdg-proof-card,\n  body.single-post:has(.pdg-golden-v2) .pdg-section-shell { padding: 24px; }\n  body.single-post:has(.pdg-golden-v2) .pdg-link-pills { display: grid; }\n  \/* Keep the semantic table header available to assistive technology without\n     letting its desktop-sized cells enlarge the mobile document canvas. *\/\n  body.single-post:has(.pdg-golden-v2) thead,\n  body.single-post:has(.pdg-golden-v2) thead tr,\n  body.single-post:has(.pdg-golden-v2) thead th {\n    box-sizing: border-box !important;\n    width: 1px !important;\n    min-width: 0 !important;\n    max-width: 1px !important;\n    height: 1px !important;\n    min-height: 0 !important;\n    max-height: 1px !important;\n    margin: -1px !important;\n    padding: 0 !important;\n    overflow: hidden !important;\n    border: 0 !important;\n    white-space: nowrap !important;\n    clip: rect(0 0 0 0) !important;\n    clip-path: inset(50%) !important;\n  }\n  body.single-post:has(.pdg-golden-v2) thead tr,\n  body.single-post:has(.pdg-golden-v2) thead th { display: block !important; }\n}\n\n@media (max-width: 360px) {\n  body.single-post:has(.pdg-golden-v2) .schema-faq-question {\n    font-size: 15px;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 {\n    font-size: 22px !important;\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-title-compact h2 {\n    font-size: 20px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .prodata-hero {\n    padding-left: 20px !important;\n    padding-right: 20px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h1,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h2 {\n    font-size: 28px !important;\n    line-height: 1.08 !important;\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .prodata-hero.pdg-hero-compact h1,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero.pdg-hero-compact h2 {\n    font-size: 23px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pd-golden-addendum,\n  body.single-post:has(.pdg-golden-v2) .pd-golden-addendum-2,\n  body.single-post:has(.pdg-golden-v2) .pd-golden-addendum-3 {\n    padding: 20px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) td {\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .schema-faq-question,\n  body.single-post:has(.pdg-golden-v2) .schema-faq-answer {\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-cta-band h2 {\n    font-size: 23px;\n    hyphens: none;\n    overflow-wrap: normal;\n    word-break: normal;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-cta-phone {\n    padding-left: 8px;\n    padding-right: 8px;\n    font-size: 20px;\n    white-space: nowrap;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-cta-primary {\n    padding-right: 14px;\n    padding-left: 14px;\n    font-size: 12px;\n    white-space: normal;\n    overflow-wrap: anywhere;\n  }\n}\n\n@media (max-width: 420px) {\n  body.single-post:has(.pdg-golden-v2) .prodata-hero .pdg-long-keyword {\n    font-size: .84em;\n  }\n}\n\n@media (max-width: 800px) {\n  body.single-post:has(.pdg-golden-v2) .pd-leadmagnet h2.pdg-heading-break-at-compound {\n    overflow-wrap: normal !important;\n    word-break: normal !important;\n    hyphens: none !important;\n  }\n}\n\/* Full-width modules must keep their horizontal padding inside the declared\n   width even when legacy source markup uses section\/aside instead of a\n   Gutenberg Cover or Group block. *\/\nbody.single-post:has(.pdg-golden-v2) .prodata-hero,\nbody.single-post:has(.pdg-golden-v2) .pdm-trust,\nbody.single-post:has(.pdg-golden-v2) .pdm-ref,\nbody.single-post:has(.pdg-golden-v2) .pd-intro,\nbody.single-post:has(.pdg-golden-v2) .pd-leadmagnet {\n  box-sizing: border-box !important;\n}\nbody.single-post:has(.pdg-golden-v2) .pdg-marquee {\n  overflow: clip !important;\n  contain: paint;\n}\nbody.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow,\nbody.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow + h2 {\n  box-sizing: border-box !important;\n}\nbody.single-post:has(.pdg-golden-v2) .page-content p a {\n  display: inline !important;\n  max-width: 100%;\n  font-size: inherit !important;\n  line-height: inherit !important;\n  overflow-wrap: anywhere;\n}\n@media (min-width: 801px) and (max-width: 1100px) {\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h1,\n  body.single-post:has(.pdg-golden-v2) .prodata-hero h2 {\n    font-size: 46px !important;\n    overflow-wrap: break-word !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n}\n\n\/* Golden Record v2.1: narrow-phone typography and contact-card geometry.\n   Keep German compound words readable without arbitrary character breaks. *\/\n@media (max-width: 800px) {\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact {\n    box-sizing: border-box;\n    width: calc(100% - 32px);\n    padding: 28px 18px;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 {\n    font-size: clamp(18px, 5vw, 22px) !important;\n    line-height: 1.13 !important;\n    overflow-wrap: normal !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-links a {\n    padding-right: 10px;\n    padding-left: 10px;\n    font-size: 13px;\n    overflow-wrap: normal;\n    word-break: normal;\n    hyphens: auto;\n  }\n  body.single-post:has(.pdg-golden-v2) .page-content > .pdm-eyebrow + h2 {\n    font-size: clamp(26px, 7.8vw, 34px);\n    overflow-wrap: normal;\n    word-break: normal;\n    hyphens: auto;\n  }\n  body.single-post:has(.pdg-golden-v2) .schema-faq-question {\n    font-size: 16px;\n    overflow-wrap: normal !important;\n    word-break: normal !important;\n    hyphens: auto !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-cta-band h2 {\n    font-size: clamp(21px, 6.8vw, 28px);\n    line-height: 1.12;\n    overflow-wrap: normal;\n    word-break: normal;\n    hyphens: auto;\n  }\n  body.single-post:has(.pdg-golden-v2) .page-content p,\n  body.single-post:has(.pdg-golden-v2) .page-content li {\n    overflow-wrap: break-word;\n    word-break: normal;\n    hyphens: auto;\n  }\n}\n\n@media (max-width: 360px) {\n  body.single-post:has(.pdg-golden-v2) .pdg-personal-contact h2 {\n    font-size: 18px !important;\n  }\n  body.single-post:has(.pdg-golden-v2) .pdg-cta-band h2 {\n    font-size: 21px;\n  }\n}\n\n\/* Golden Record v2.2: keep long lead-form submit labels fully readable on\n   narrow phones without reducing the touch target. *\/\n@media (max-width: 380px) {\n  body.single-post:has(.pdg-golden-v2) .pd-leadmagnet .pd-lead-form button[type=\"submit\"],\n  body.single-post:has(.pdg-golden-v2) .pd-leadmagnet .pd-lead-form input[type=\"submit\"] {\n    box-sizing: border-box !important;\n    width: 100% !important;\n    max-width: 100% !important;\n    min-height: 54px !important;\n    height: auto !important;\n    padding: 12px !important;\n    font-size: 14px !important;\n    line-height: 1.3 !important;\n    white-space: normal !important;\n    overflow-wrap: break-word !important;\n    text-align: center !important;\n  }\n}\nbody.single-post:has(.pdg-golden-v2) .pd-stats > * { min-width: 0; overflow-wrap: anywhere; }\n\n\/* Golden Record v2.3: use full-width label\/value rows for the two dense\n   tables on narrow phones and retain readable desktop tax-table columns. *\/\n@media (min-width: 361px) and (max-width: 430px) {\n  body.single-post:has(.pdg-golden-v2) table.pdg-status-table td,\n  body.single-post:has(.pdg-golden-v2) table.pdg-tax-table td { display: block; }\n  body.single-post:has(.pdg-golden-v2) table.pdg-status-table td { font-size: 16px; }\n  body.single-post:has(.pdg-golden-v2) table.pdg-status-table td::before,\n  body.single-post:has(.pdg-golden-v2) table.pdg-tax-table td::before { display: block; margin-bottom: 5px; }\n}\n@media (min-width: 801px) {\n  body.single-post:has(.pdg-golden-v2) table.pdg-tax-table { table-layout: fixed; }\n}\n\/* Shared English Golden Record v2 language layer.\n   English headings must wrap at word boundaries, not hyphenate. *\/\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content h1,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content h2,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content h3 {\n  hyphens: none !important;\n  overflow-wrap: normal !important;\n  word-break: normal !important;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .prodata-hero p {\n  hyphens: none !important;\n  overflow-wrap: normal !important;\n  word-break: normal !important;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content p,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content li,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content th,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content td,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content .schema-faq-question,\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .page-content .schema-faq-answer {\n  hyphens: none !important;\n  overflow-wrap: normal !important;\n  word-break: normal !important;\n}\n\n\/* English action module: a post-scoped alternative while the shared lead-form\n   shortcode has no fully English public rendering. *\/\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action {\n  display: grid;\n  grid-template-columns: minmax(0, 1.35fr) minmax(260px, .65fr);\n  align-items: center;\n  gap: 38px;\n  background: linear-gradient(135deg, #f2f7fd 0%, #ffffff 100%);\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action > .pdg-en-action-copy {\n  width: auto;\n  margin: 0;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-copy h2 {\n  margin: 0 0 12px;\n  color: var(--pdg-navy);\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-copy p {\n  max-width: 720px;\n  margin: 0;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-actions {\n  display: grid;\n  gap: 12px;\n  min-width: 0;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-pill {\n  box-sizing: border-box;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 100%;\n  min-height: 54px;\n  padding: 13px 20px;\n  border: 2px solid #b8cce5;\n  border-radius: 999px;\n  background: #ffffff;\n  color: #0752a4 !important;\n  font-weight: 800;\n  line-height: 1.25;\n  text-align: center;\n  text-decoration: none !important;\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-email {\n  border-color: var(--pdg-orange);\n  background: var(--pdg-orange);\n  color: #092f55 !important;\n  box-shadow: 0 12px 24px rgba(8, 47, 102, .14);\n}\nbody.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action-pill:focus-visible {\n  outline: 3px solid #1597d4;\n  outline-offset: 3px;\n}\n@media (max-width: 800px) {\n  body.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-en-action {\n    grid-template-columns: 1fr;\n    gap: 24px;\n  }\n  body.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-cta-primary,\n  body.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-cta-phone {\n    overflow-wrap: normal !important;\n    word-break: normal !important;\n    hyphens: none !important;\n    white-space: nowrap;\n  }\n  body.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-cta-primary {\n    font-size: clamp(14px, 4.2vw, 18px);\n  }\n  body.single-post:has(.pdg-golden-v2.pdg-lang-en) .pdg-cta-phone {\n    font-size: clamp(18px, 5vw, 20px);\n  }\n}<\/style>\n\n\n\n<div class=\"wp-block-group pdg-page-v1 pdg-golden-v2 pdg-lang-en is-layout-flow wp-block-group-is-layout-flow\">\n\n<div class=\"wp-block-cover prodata-hero\"><span aria-hidden=\"true\" class=\"wp-block-cover__background has-background-dim-0 has-background-dim\"><\/span><div class=\"wp-block-cover__inner-container is-layout-flow wp-block-cover-is-layout-flow\"><h1 class=\"wp-block-heading\"><span class=\"pdm-kw\">GDPR Requirements for Loyalty Programs<\/span>: Privacy, Hosting, and Provider Selection<\/h1><p class=\"wp-block-paragraph\">Translate privacy obligations into a buyer-ready scope, compare hosting and security evidence, and test one complete loyalty data journey before selecting a provider.<\/p><div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/contact\/\">Discuss your requirements \u2192<\/a><\/div><\/div><\/div><\/div>\n\n\n\n<section class=\"pdm-trust\" aria-label=\"Why PRODATA\"><span class=\"pdm-eyebrow\">Why PRODATA<\/span><ul class=\"pdm-trust-list\"><li><strong>Since 1991<\/strong><span>Experience with loyalty and incentive projects<\/span><\/li><li><strong>Full-service view<\/strong><span>Strategy, software, operations and rewards considered together<\/span><\/li><li><strong>Evidence first<\/strong><span>Roles, controls and supplier claims separated by scope<\/span><\/li><li><strong>Project clarity<\/strong><span>Requirements, decisions and acceptance tests documented<\/span><\/li><\/ul><div class=\"pdm-actions\"><a class=\"pdm-tel\" href=\"tel:+4972198171111\">+49 721 98171-111<\/a><\/div><\/section>\n\n\n\n<aside class=\"pdm-ref\" aria-label=\"Public references\"><span class=\"pdm-ref-k\">Selected client references.<\/span><p>Review public project contexts when assessing relevant loyalty experience.<\/p><a class=\"pdm-ref-link\" href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/references\/\">View all references and client testimonials \u2192<\/a><\/aside>\n\n\n\n<section class=\"pd-intro\"><div class=\"pd-intro-grid\"><div class=\"pd-intro-text\"><span class=\"pd-eyebrow\">Quick answer<\/span><p><strong>A loyalty program meets GDPR requirements only when the actual purposes, data flows, roles, retention rules, participant rights, security measures, suppliers, and transfers are defined and operated for that specific program.<\/strong> A server location, certificate, contract template, or consent checkbox alone does not establish compliance. Buyers need an evidence package that connects each processing activity to a responsible owner, an approved rule, a technical control, and an acceptance test.<\/p><\/div><div class=\"pd-ap\"><div class=\"pd-ap-head\">Four questions for the buyer brief<\/div><ul><li>Which personal data is used for which documented purpose?<\/li><li>Who acts as controller, processor, recipient, or subprocessor?<\/li><li>Where are production, backup, log, analytics, and support data handled?<\/li><li>Which evidence proves rights, deletion, security, transfer, and exit processes?<\/li><\/ul><\/div><\/div><\/section>\n\n\n\n<nav class=\"pdm-nav\" aria-label=\"On this page\"><span class=\"pdm-eyebrow\">On this page<\/span><div class=\"pdm-nav-grid\"><a href=\"#privacy-meaning\"><b>01<\/b><span>Define compliance<\/span><\/a><a href=\"#privacy-map\"><b>02<\/b><span>Map purposes and data<\/span><\/a><a href=\"#privacy-roles\"><b>03<\/b><span>Assign responsibilities<\/span><\/a><a href=\"#privacy-operations\"><b>04<\/b><span>Operationalize rights<\/span><\/a><a href=\"#privacy-security\"><b>05<\/b><span>Test security controls<\/span><\/a><a href=\"#privacy-hosting\"><b>06<\/b><span>Evaluate hosting<\/span><\/a><a href=\"#privacy-provider\"><b>07<\/b><span>Compare provider evidence<\/span><\/a><a href=\"#privacy-prodata\"><b>08<\/b><span>Scope PRODATA\u2019s role<\/span><\/a><\/div><\/nav>\n\n\n\n<span id=\"privacy-meaning\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 01<\/span><h2>What GDPR Compliance Means for a Loyalty Program<\/h2><p><strong>Compliance is an operating condition of the complete program, not a product badge.<\/strong> A loyalty program connects identities, transactions or activities, balances, rewards, communications, service cases, and analysis. The buyer must understand why each record exists, who can use it, how long it remains necessary, how a participant exercises rights, and which organizations support the process.<\/p><p>Begin with the program purpose rather than the interface. Participation administration, reward calculation, service, direct marketing, profiling, partner disclosures, fraud review, finance reconciliation, and analytics can involve different data, legal bases, recipients, retention periods, and controls. Treating them as one undifferentiated \u201cloyalty purpose\u201d hides decisions that specialists need to review.<\/p><p>The lawful basis must be selected for each purpose and jurisdiction. Consent is not automatically required for every processing activity, and obtaining consent does not make every later use permissible. Contract performance, legitimate interests, legal obligations, and consent each have distinct requirements. Marketing and tracking can also trigger ePrivacy or national rules. The buyer\u2019s legal and privacy specialists must approve the project-specific assessment.<\/p><p>Use the public <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-and-loyalty-data-protection-requirements\/\">overview of GDPR and loyalty data-protection requirements<\/a> for the general principles. This page focuses more narrowly on procurement: how a buyer converts those principles into provider evidence, hosting questions, operating responsibilities, and acceptance criteria.<\/p><div class=\"wp-block-table\"><table><thead><tr><th>Requirement<\/th><th>Loyalty-program decision<\/th><th>Evidence to retain<\/th><\/tr><\/thead><tbody><tr><td data-label=\"Requirement\">Purpose and lawful basis<\/td><td data-label=\"Loyalty-program decision\">Separate participation, rewards, service, marketing, profiling, partner use, and analysis<\/td><td data-label=\"Evidence to retain\">Approved processing register and decision record<\/td><\/tr><tr><td data-label=\"Requirement\">Consent and preferences<\/td><td data-label=\"Loyalty-program decision\">Define where consent is used and how withdrawal affects each purpose<\/td><td data-label=\"Evidence to retain\">Wording, timestamp, version, channel, and preference history<\/td><\/tr><tr><td data-label=\"Requirement\">Data minimization<\/td><td data-label=\"Loyalty-program decision\">Justify every requested field, event, attribute, and derived value<\/td><td data-label=\"Evidence to retain\">Field catalog with purpose and owner<\/td><\/tr><tr><td data-label=\"Requirement\">Transparency and rights<\/td><td data-label=\"Loyalty-program decision\">Explain processing and provide identity, access, correction, objection, portability, and deletion routes<\/td><td data-label=\"Evidence to retain\">Notices, workflow tests, service instructions, and response records<\/td><\/tr><tr><td data-label=\"Requirement\">Retention and deletion<\/td><td data-label=\"Loyalty-program decision\">Set rules for accounts, events, rewards, communications, logs, cases, backups, and exports<\/td><td data-label=\"Evidence to retain\">Retention schedule and deletion-test results<\/td><\/tr><tr><td data-label=\"Requirement\">Controller and processor roles<\/td><td data-label=\"Loyalty-program decision\">Allocate decisions, instructions, assistance, recipients, and subprocessors<\/td><td data-label=\"Evidence to retain\">Role map, processing agreement, and responsibility matrix<\/td><\/tr><tr><td data-label=\"Requirement\">Security and risk review<\/td><td data-label=\"Loyalty-program decision\">Match controls and testing to data, threats, users, suppliers, and impact<\/td><td data-label=\"Evidence to retain\">Technical and organizational measures, test evidence, and accepted risks<\/td><\/tr><\/tbody><\/table><\/div><\/section>\n\n\n\n<span id=\"privacy-map\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 02<\/span><h2>Map Data, Purposes, Legal Bases, and Consent<\/h2><p><strong>A useful data map follows records from collection to deletion and links each step to a purpose, legal basis, system, recipient, and owner.<\/strong> List identity and eligibility data, transaction or activity events, balances, rewards, communications, preferences, device or log data, service cases, fraud indicators, reporting attributes, and derived segments. Mark whether data is provided by the participant, the client, a partner, a connected system, or a calculation.<\/p><p>For every field and event, record why it is required, who decides the purpose, who receives it, where it is stored, which rule changes it, how long it is retained, and how it appears in an access or export response. This work exposes duplication and prevents a convenient integration from becoming an undefined secondary use.<\/p><p>Consent management needs more than a checkbox. The program should retain the wording shown, version, timestamp, source, channel, language, scope, and later preference changes. Withdrawal must propagate to the systems and suppliers that rely on that consent without erasing records that must remain for another documented reason. Test the complete path described in the guide to <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/consent-management-in-loyalty-programs\/\">consent management in loyalty programs<\/a>.<\/p><p>Zero-party data requires the same discipline. Voluntarily shared preferences can improve relevance, but voluntary disclosure does not create permission for unrelated use. Explain the benefit, make optional fields genuinely optional, limit access, allow correction, and define what happens when a preference is withdrawn. The <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/zero-party-data-in-loyalty-programs-using-voluntarily-shared-customer-data-in-compliance-with-data-protection-regulations\/\">zero-party data guide<\/a> covers that distinction.<\/p><p>Finish the map with edge cases: duplicate identities, joint accounts, company contacts, minors where relevant, returned purchases, closed accounts, disputed events, inherited preferences, bounced addresses, and data received after withdrawal. A provider demonstration should show how these cases affect the participant record, campaign eligibility, reporting, and retention.<\/p><\/section>\n\n\n\n<span id=\"privacy-roles\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 03<\/span><h2>Define Controller, Processor, Partner, and Subprocessor Responsibilities<\/h2><p><strong>Roles follow actual decisions and processing, not the label used in a proposal.<\/strong> The program sponsor will often decide core purposes and means, while a provider may process data under documented instructions. Other parties can have separate or joint responsibilities depending on what they decide and do. A generic \u201csupplier\u201d label is therefore not enough for the privacy model.<\/p><p>Create a responsibility matrix for notices, lawful-basis decisions, consent wording, data-quality corrections, rights requests, retention, deletion, incident response, security reviews, subprocessor approval, transfer assessment, reporting, and exit. Name both the accountable client role and the delivery role. State when a provider may act only on instructions and when another recipient determines its own purpose.<\/p><p>Where a processor relationship applies, Article 28 requirements need to be reflected in the agreement and the operating process. The buyer should verify documented instructions, confidentiality, security, subprocessors, rights assistance, incident support, deletion or return, audit information, and handling of unlawful instructions. Contract wording should match the proposed service instead of describing an abstract platform.<\/p><p>Connected CRM, ERP, commerce, wallet, messaging, reward, support, analytics, and hosting services can introduce additional recipients and subprocessors. Do not infer the actual data flow from a logo list. Use the proposed architecture, payload fields, credentials, endpoints, logging, support access, and transfer routes. The guides to <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/loyalty-platform-and-technical-architecture-engine-api-wallet-data-and-operations\/\">loyalty platform architecture<\/a>, <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/api-integration-for-loyalty-systems-technical-fundamentals-and-best-practices\/\">API integration<\/a>, and <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/loyalty-crm-integration-connecting-salesforce-sap-and-others-correctly\/\">CRM integration<\/a> provide technical questions for that review.<\/p><p>Test the handoffs. Submit a rights request, consent withdrawal, disputed transaction, security inquiry, deletion instruction, subprocessor change, and exit request. Verify who receives the case, which records are located, which exceptions apply, which response returns to the participant, and which evidence remains.<\/p><\/section>\n\n\n\n<span id=\"privacy-operations\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 04<\/span><h2>Operationalize Data Minimization, Rights, Retention, and Deletion<\/h2><p><strong>A privacy design is credible when recurring operational work produces the same controlled result as the policy describes.<\/strong> Data minimization begins before launch: remove fields that lack a current purpose, limit free-text entry, avoid broad exports, separate operational and analytical access, and restrict test data. Record why derived scores or segments are needed and how they influence a participant.<\/p><p>Rights handling should use a defined identity-verification and routing process. The team needs to locate the relevant person across the loyalty platform and connected services without disclosing another person\u2019s data. It must distinguish access, correction, restriction, objection, portability, and erasure, preserve applicable records, explain decisions, and coordinate suppliers within the required timeline.<\/p><p>Retention rules should be record-specific. An active account, expired balance, completed reward order, invoice-related record, consent event, campaign history, support case, security log, backup, and analytics dataset can require different treatment. Avoid a single retention number for the whole program. Define the trigger, period, exception, deletion method, verification step, and owner for each record class.<\/p><p>Deletion must be testable. Close a representative account and trace the result through production, search indexes, exports, downstream systems, support tools, analytics, queued campaigns, backups, and suppliers. Document which data is removed, anonymized, restricted, or retained and why. Confirm that a later import does not recreate an account or marketing permission that should remain inactive.<\/p><p>Operational metrics help expose control failures. Track overdue rights cases, incomplete deletions, preference-sync errors, excessive privileges, unowned data fields, failed exports, and unresolved processor queries. These are control indicators, not proof of legal compliance, but they make governance reviewable.<\/p><\/section>\n\n\n\n<aside class=\"pdg-personal-contact\" aria-labelledby=\"pdg-personal-18451\"><img decoding=\"async\" class=\"pdg-personal-photo\" src=\"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg\" alt=\"Thorsten Heftrich, Managing Director and Loyalty Consultant at PRODATA\" loading=\"lazy\"\/><div class=\"pdg-personal-copy\"><span class=\"pdg-personal-kicker\">YOUR PERSONAL CONTACT<\/span><h2 id=\"pdg-personal-18451\">Turn privacy requirements into a testable loyalty scope<\/h2><p>Thorsten Heftrich discusses program roles, data flows, provider evidence, operating responsibilities, and acceptance tests with your project team.<\/p><p class=\"pdg-personal-name\">Thorsten Heftrich<\/p><p class=\"pdg-personal-role\">Managing Director and Loyalty Consultant<\/p><div class=\"pdg-personal-links\"><a href=\"tel:+4972198171111\">+49 721 98171-111<\/a><a href=\"mailto:vertrieb@prodata.de\">vertrieb@prodata.de<\/a><a href=\"#pdg-final-cta\">No-obligation consultation &rarr;<\/a><\/div><\/div><\/aside>\n\n\n\n<span id=\"privacy-security\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 05<\/span><h2>Security by Design: Controls, Logs, Testing, and Incident Response<\/h2><p><strong>Security evidence should match the proposed loyalty architecture, data, users, suppliers, and operating responsibilities.<\/strong> Begin with data classification and threat scenarios. Consider account takeover, unauthorized staff access, excessive export rights, exposed credentials, manipulated transactions, reward abuse, insecure interfaces, misdirected communications, supplier compromise, and unavailable services.<\/p><p>Translate those risks into controls: authentication, role design, least privilege, environment separation, encryption where appropriate, secret management, logging, monitoring, patching, vulnerability handling, backup, recovery, change control, supplier review, and incident response. The correct combination depends on the program scope. A generic control list is useful only when the provider can show where and how each control applies.<\/p><p>Logs need their own privacy and retention design. Decide which events are recorded, who can access them, how long they remain, what identifiers they contain, and how they support investigation without becoming an unrestricted behavioral dataset. Confirm time synchronization, integrity, alert ownership, escalation, and access review.<\/p><p>Request recent, scope-relevant test evidence. This can include access reviews, recovery exercises, vulnerability-management records, penetration-test summaries, incident exercises, secure-development practices, or independent assessments. Confidential evidence may be reviewed under appropriate terms, but the buyer still needs a clear statement of scope, date, exceptions, and remediation ownership.<\/p><p>Incident response should be rehearsed across organizations. Use a scenario involving unusual reward activity and possible account compromise. Verify detection, containment, evidence preservation, role escalation, client notification, legal assessment, participant communication, recovery, and post-incident improvements. The process must identify who decides whether a personal-data breach notification is required; the technology should not imply an automatic legal conclusion.<\/p><\/section>\n\n\n\n<span id=\"privacy-hosting\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 06<\/span><h2>Hosting in Germany and the EEA: What Location Does\u2014and Does Not\u2014Prove<\/h2><p><strong>A German or EEA data location can support a sourcing requirement, but it does not by itself prove GDPR compliance, security, or the absence of international transfers.<\/strong> Buyers should examine production, backup, disaster recovery, logs, analytics, monitoring, support, administration, subprocessors, content delivery, messaging, and diagnostic services.<\/p><p>Ask the provider to map each environment and service, the legal entity operating it, the people who can access it, the purposes of access, and any onward processing. A contract or portal setting should match the technical architecture and support model. If a third-country transfer is possible, the responsible specialists must assess the applicable transfer mechanism, supplementary measures, transparency, and ongoing review. The <a href=\"https:\/\/commission.europa.eu\/law\/law-topic\/data-protection\/international-dimension-data-protection_en\">European Commission\u2019s transfer guidance<\/a> is a primary starting point.<\/p><p>Certificates and assessments require scope discipline. ISO\/IEC 27001 concerns an information security management system within a defined certification scope; it does not automatically certify every product, environment, or processing activity and does not establish GDPR compliance. Review the certificate owner, locations, statement of applicability, validity, exclusions, and relation to the proposed service. The <a href=\"https:\/\/www.iso.org\/standard\/27001\">ISO overview of ISO\/IEC 27001<\/a> explains the standard at a high level.<\/p><p>TISAX is an assessment and exchange mechanism for information-security requirements in the automotive industry. A cloud provider or infrastructure service may have an assessment for specified locations and objectives. That result cannot simply be attributed to a loyalty provider, the client\u2019s application, or the entire program. Verify the assessed participant, scope, locations, objectives, validity, and the buyer\u2019s authorized access to the result through the <a href=\"https:\/\/enx.com\/tisax\/\">ENX Association\u2019s TISAX information<\/a>.<\/p><p>Record the hosting decision as a set of testable requirements: allowed regions, backup locations, support access, subprocessors, transfer controls, audit information, deletion, recovery, continuity, change notification, and exit. The goal is traceability rather than a broad marketing label.<\/p><\/section>\n\n\n\n<span id=\"privacy-provider\" class=\"pdm-anchor\"><\/span><section><span class=\"pdm-eyebrow\">Chapter 07<\/span><h2>Compare Providers With a Privacy and Hosting Evidence Scorecard<\/h2><p><strong>Every provider should answer the same program-specific questions and demonstrate the same end-to-end data case.<\/strong> Start with a concise brief containing the intended audience, purposes, data sources, mechanics, channels, integrations, rewards, communications, service, reporting, regions, volumes, and internal responsibilities. Mark requirements as mandatory, optional, later phase, or out of scope.<\/p><p>Separate available standard capability, project configuration, custom work, client-supplied work, and third-party dependencies. A provider may support the process without owning every legal decision or technical component. The proposal should show who supplies notices, approves purposes, configures retention, handles rights, monitors interfaces, reviews subprocessors, and verifies deletion.<\/p><p>Use evidence with a date and scope. A certificate, processing agreement, hosting statement, policy, architecture diagram, penetration-test summary, or subprocessor list answers a different question. Do not combine them into one compliance score without checking what each document actually covers. Request clarification where proposal language is broader than the evidence.<\/p><div class=\"wp-block-table\"><table><thead><tr><th>Evidence item<\/th><th>What to verify<\/th><th>Acceptance criterion<\/th><\/tr><\/thead><tbody><tr><td data-label=\"Evidence item\">Hosting and data-location map<\/td><td data-label=\"What to verify\">Production, backups, logs, analytics, support, and recovery<\/td><td data-label=\"Acceptance criterion\">Every service has a location, operator, access path, and owner<\/td><\/tr><tr><td data-label=\"Evidence item\">Subprocessors and transfers<\/td><td data-label=\"What to verify\">Entities, purposes, regions, mechanisms, notices, and change process<\/td><td data-label=\"Acceptance criterion\">List matches architecture and contract<\/td><\/tr><tr><td data-label=\"Evidence item\">Processing agreement and measures<\/td><td data-label=\"What to verify\">Instructions, assistance, security, deletion, audit, and responsibilities<\/td><td data-label=\"Acceptance criterion\">Terms match the proposed service and operating model<\/td><\/tr><tr><td data-label=\"Evidence item\">ISO certificate<\/td><td data-label=\"What to verify\">Certificate owner, scope, locations, validity, and exclusions<\/td><td data-label=\"Acceptance criterion\">Claim is no broader than the certificate scope<\/td><\/tr><tr><td data-label=\"Evidence item\">TISAX or cloud assessment<\/td><td data-label=\"What to verify\">Assessed participant, sites, objectives, validity, and service relationship<\/td><td data-label=\"Acceptance criterion\">Assessment is attributed only to its documented subject<\/td><\/tr><tr><td data-label=\"Evidence item\">Rights, retention, and deletion<\/td><td data-label=\"What to verify\">Identity, routing, connected systems, exceptions, backups, and evidence<\/td><td data-label=\"Acceptance criterion\">Representative cases pass within the agreed process<\/td><\/tr><tr><td data-label=\"Evidence item\">Incident response<\/td><td data-label=\"What to verify\">Detection, escalation, support, evidence, communication, and recovery<\/td><td data-label=\"Acceptance criterion\">Joint exercise identifies decisions and response owners<\/td><\/tr><tr><td data-label=\"Evidence item\">Exit and portability<\/td><td data-label=\"What to verify\">Formats, field definitions, histories, open cases, deletion, and transition support<\/td><td data-label=\"Acceptance criterion\">Test export and closure plan are complete<\/td><\/tr><\/tbody><\/table><\/div><p>Score evidence separately from feature fit and commercial terms. Document gaps, dependencies, owner decisions, remediation dates, and acceptance tests. A lower-risk decision is not the provider with the longest security page; it is the provider whose documented scope and demonstrated behavior match the intended program.<\/p><\/section>\n\n\n\n<span id=\"privacy-prodata\" class=\"pdm-anchor\"><\/span><section class=\"pd-provider\"><span class=\"pdm-eyebrow\">Chapter 08<\/span><h2>Scope PRODATA\u2019s Role for the Actual Loyalty Program<\/h2><p><strong>PRODATA supports the planning, technical implementation, and agreed operation of loyalty programs within a documented project scope.<\/strong> Hosting, privacy roles, subprocessors, security controls, interfaces, rewards, service, reporting, and operating evidence must be defined for the specific project. ProLoyalty is PRODATA\u2019s software solution; neither the product name nor a company-level statement replaces the buyer\u2019s program assessment.<\/p><p>Discovery should produce a purpose and data map, role matrix, architecture, interface catalog, hosting and supplier view, retention schedule, rights workflow, security requirements, incident contacts, test cases, and exit specification. Each element should show whether it is a client decision, provider standard, configuration, individual development, client-supplied service, or third-party dependency.<\/p><p>Provider evaluation remains comparative. PRODATA should be assessed against the same use case, evidence requirements, controls, cost scope, acceptance criteria, and exit needs as other candidates. Public references can help identify relevant contexts but do not transfer a customer\u2019s scope or result to another project. For regional procurement questions, see the guide to <a href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/customer-loyalty-programs-in-the-dach-region-providers-selection-criteria-and-process-for-b2b-decision-makers\/\">loyalty provider selection in the DACH region<\/a>.<\/p><p>A project-specific demonstration should follow one participant from enrollment through a qualifying event, balance change, communication, reward, service case, preference change, rights request, correction, report, export, and deletion instruction. It should expose the source record, purpose, status, rule version, access rights, responsible organization, logs, exceptions, and handoffs. The demonstration should also show what remains outside the proposed scope.<\/p><p>Before launch, the client\u2019s responsible legal, privacy, security, procurement, and business owners approve their respective decisions. After launch, governance reviews changes to purposes, data, suppliers, locations, interfaces, roles, rules, audiences, and analytics. A compliant design can become outdated when the program changes without the same review discipline.<\/p><\/section>\n\n\n\n<section><span class=\"pdm-eyebrow\">Demonstration scenario<\/span><h2>Require One Loyalty Data Journey From Enrollment to Deletion<\/h2><p>Create a representative participant and explain every field collected during enrollment. Record the applicable notice and preference choices. Import one qualifying event through the proposed source, apply the agreed rule, update the account, send the intended communication, and show the operational and reporting records. Then change a preference and verify propagation to connected services.<\/p><p>Next, submit an access and correction request. Demonstrate identity verification, case routing, data discovery, response preparation, correction, audit evidence, and supplier coordination. Introduce a disputed transaction and an unusual reward order to test access control, logging, escalation, and separation between service and security decisions.<\/p><p>Finish with account closure, export, and deletion instructions. Show the agreed format, field descriptions, retained exceptions, removed records, restricted data, backup handling, downstream status, and evidence of completion. A good demonstration makes responsibilities and limitations visible; it does not claim that a polished workflow alone establishes legal compliance.<\/p><\/section>\n\n\n\n<section><span class=\"pdm-eyebrow\">Implementation checklist<\/span><h2>What the Buyer\u2019s Privacy and Hosting Brief Should Contain<\/h2><p>Document the program purpose, audience, regions, eligibility, identity model, qualifying events, rewards, communications, service, profiling, analytics, data fields, sources, recipients, legal bases, consent and preferences, retention, rights, deletion, security, hosting, backups, support access, subprocessors, transfers, interfaces, logs, incidents, reporting, change control, acceptance tests, and exit.<\/p><p>For every requirement, assign a client owner, provider owner, evidence source, test case, acceptance criterion, review date, and escalation route. Separate mandatory launch requirements from later options. Identify decisions that require legal, privacy, security, finance, works-council, tax, or procurement review for the specific organization and jurisdiction.<\/p><p>Keep the brief synchronized with the contract, processing agreement, architecture, interface specification, field catalog, retention schedule, notices, consent wording, subprocessor list, test evidence, operating handbook, and exit plan. Reassess the model whenever a purpose, audience, data source, supplier, region, integration, reward mechanic, or analytical use changes.<\/p><\/section>\n\n\n\n<section class=\"schema-faq\"><span class=\"pdm-eyebrow\">Frequently asked questions<\/span><h2>Frequently Asked Questions About GDPR Requirements for Loyalty Programs<\/h2><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">What makes a loyalty program compliant with GDPR?<\/h3><div class=\"schema-faq-answer\"><p>A loyalty program requires documented purposes and legal bases, transparent information, data minimization, retention rules, participant-rights processes, clear controller and processor roles, appropriate security, and reviewed suppliers and transfers. The organization\u2019s responsible legal and privacy specialists must approve the project-specific assessment.<\/p><\/div><\/div><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">Does a loyalty program always require consent?<\/h3><div class=\"schema-faq-answer\"><p>No. The legal basis must be assessed separately for each purpose. Participation administration, direct marketing, profiling, partner disclosures, analytics, and tracking can require different decisions, and ePrivacy or national rules may also apply. Where consent is used, it must be specific, informed, recorded, and withdrawable.<\/p><\/div><\/div><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">Does hosting in Germany automatically make a loyalty program GDPR compliant?<\/h3><div class=\"schema-faq-answer\"><p>No. Buyers must also examine subprocessors, backups, logs, analytics, support access, international transfers, contracts, retention, rights processes, and security. A German data location can support a sourcing requirement, but it is only one part of the complete assessment.<\/p><\/div><\/div><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">What evidence should buyers request from a loyalty provider?<\/h3><div class=\"schema-faq-answer\"><p>Request a processing agreement, technical and organizational measures, a subprocessor and hosting map, transfer information, retention and deletion processes, incident procedures, exit and export details, and current certificate or assessment evidence with its exact scope and validity.<\/p><\/div><\/div><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">What does ISO\/IEC 27001 prove?<\/h3><div class=\"schema-faq-answer\"><p>ISO\/IEC 27001 concerns an information security management system within a defined certification scope. Buyers should verify the certificate owner, locations, validity, and exclusions. It does not automatically certify every product or processing activity and does not by itself establish GDPR compliance.<\/p><\/div><\/div><div class=\"schema-faq-section\"><h3 class=\"schema-faq-question\">Can an Azure TISAX assessment be attributed to a loyalty provider?<\/h3><div class=\"schema-faq-answer\"><p>Only the precisely documented assessment scope can be stated. An assessment of a cloud provider, infrastructure service, or particular site cannot automatically be attributed to the loyalty provider, its application, or the client\u2019s complete program. Verify the assessed participant, objectives, locations, validity, and service relationship.<\/p><\/div><\/div><\/section>\n\n\n\n<p class=\"wp-block-paragraph\">Before procurement, connect each privacy and hosting claim to the exact service, environment, organization, document, date, control, and acceptance test. Keep legal conclusions with the client\u2019s responsible specialists and require providers to distinguish evidence from marketing language.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Preserve the approved purpose map, role matrix, architecture, field catalog, supplier list, notices, retention schedule, test results, incident contacts, decision log, and exit specification throughout the program lifecycle.<\/p>\n\n\n\n<p class=\"pdg-source-note\"><small>Editorial and source scope check: 8 September 2026. Primary orientation: <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj\">GDPR text on EUR-Lex<\/a>, <a href=\"https:\/\/www.edpb.europa.eu\/our-work-tools\/our-documents\/guidelines\/guidelines-052020-consent-under-regulation-2016679_en\">EDPB consent guidelines<\/a>, European Commission transfer guidance, ISO\u2019s standard overview, and ENX TISAX information. This buyer guide is not legal advice; requirements must be validated for the specific organizations, jurisdictions, systems, and project.<\/small><\/p>\n\n\n\n<section id=\"pdg-final-cta\" class=\"pdg-cta-band pdg-cta-final\"><div><span class=\"pdg-cta-kicker\">Next step<\/span><h2>Build a loyalty data scope your teams can verify.<\/h2><p>Discuss program purposes, roles, hosting, suppliers, controls, operating evidence, and provider acceptance tests with an experienced loyalty consultant.<\/p><\/div><div class=\"pdg-cta-actions\"><a class=\"pdg-cta-primary\" href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/contact\/\">Schedule a consultation \u2192<\/a><a class=\"pdg-cta-phone\" href=\"tel:+4972198171111\">+49 721 98171-111<\/a><\/div><\/section>\n\n<\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What makes a loyalty program compliant with GDPR?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A loyalty program requires documented purposes and legal bases, transparent information, data minimization, retention rules, participant-rights processes, clear controller and processor roles, appropriate security, and reviewed suppliers and transfers. The organization\u2019s responsible legal and privacy specialists must approve the project-specific assessment.\"}},{\"@type\":\"Question\",\"name\":\"Does a loyalty program always require consent?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. The legal basis must be assessed separately for each purpose. Participation administration, direct marketing, profiling, partner disclosures, analytics, and tracking can require different decisions, and ePrivacy or national rules may also apply. Where consent is used, it must be specific, informed, recorded, and withdrawable.\"}},{\"@type\":\"Question\",\"name\":\"Does hosting in Germany automatically make a loyalty program GDPR compliant?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. Buyers must also examine subprocessors, backups, logs, analytics, support access, international transfers, contracts, retention, rights processes, and security. A German data location can support a sourcing requirement, but it is only one part of the complete assessment.\"}},{\"@type\":\"Question\",\"name\":\"What evidence should buyers request from a loyalty provider?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Request a processing agreement, technical and organizational measures, a subprocessor and hosting map, transfer information, retention and deletion processes, incident procedures, exit and export details, and current certificate or assessment evidence with its exact scope and validity.\"}},{\"@type\":\"Question\",\"name\":\"What does ISO\/IEC 27001 prove?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"ISO\/IEC 27001 concerns an information security management system within a defined certification scope. Buyers should verify the certificate owner, locations, validity, and exclusions. It does not automatically certify every product or processing activity and does not by itself establish GDPR compliance.\"}},{\"@type\":\"Question\",\"name\":\"Can an Azure TISAX assessment be attributed to a loyalty provider?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Only the precisely documented assessment scope can be stated. An assessment of a cloud provider, infrastructure service, or particular site cannot automatically be attributed to the loyalty provider, its application, or the client\u2019s complete program. Verify the assessed participant, objectives, locations, validity, and service relationship.\"}}]},{\"@type\":\"Service\",\"name\":\"Loyalty program privacy and provider scoping\",\"provider\":{\"@type\":\"Organization\",\"name\":\"PRODATA Datenbanken und Informationssysteme GmbH\",\"url\":\"https:\/\/www.prodata.de\/\"},\"audience\":{\"@type\":\"BusinessAudience\",\"audienceType\":\"Loyalty, marketing, IT, privacy, security, procurement, and operations teams\"},\"serviceType\":\"Loyalty consulting, technical implementation, and agreed program operations within a documented project scope\",\"url\":\"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/\"},{\"@type\":\"Person\",\"name\":\"Thorsten Heftrich\",\"jobTitle\":\"Managing Director and Loyalty Consultant\",\"worksFor\":{\"@type\":\"Organization\",\"name\":\"PRODATA Datenbanken und Informationssysteme GmbH\"},\"url\":\"https:\/\/www.linkedin.com\/in\/thorsten-heftrich-loyalty\/\"}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"<p>Why PRODATA Since 1991Experience with loyalty and incentive projects Full-service viewStrategy, software, operations and rewards considered together Evidence firstRoles, controls and supplier claims separated by scope Project clarityRequirements, decisions and acceptance tests documented +49 721 98171-111 Selected client references. Review public project contexts when assessing relevant loyalty experience. View all references and client testimonials \u2192 [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52],"tags":[],"class_list":["post-18451","post","type-post","status-publish","format-standard","hentry","category-loyalty-customer-retention-insights"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GDPR-Compliant Loyalty Program: Requirements &amp; Choosing a Provider | PRODATA<\/title>\n<meta name=\"description\" content=\"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GDPR-Compliant Loyalty Program: Requirements &amp; Choosing a Provider | PRODATA\" \/>\n<meta property=\"og:description\" content=\"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/\" \/>\n<meta property=\"og:site_name\" content=\"Loyalty und Kundenbindung-Systeme\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prodatagmbh\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-25T12:10:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-12T15:24:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg\" \/>\n<meta name=\"author\" content=\"Thorsten Heftrich\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Thorsten Heftrich\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/\"},\"author\":{\"name\":\"Thorsten Heftrich\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#\\\/schema\\\/person\\\/25e544759fd24b9da47cf61c6aa419d4\"},\"headline\":\"GDPR-Compliant Loyalty Program: Data Protection Requirements, Hosting in Germany, and Provider Selection\",\"datePublished\":\"2026-06-25T12:10:09+00:00\",\"dateModified\":\"2026-09-12T15:24:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/\"},\"wordCount\":3456,\"publisher\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/thh-profilbild-neu.jpg\",\"articleSection\":[\"Loyalty &amp; Customer Retention \u2013 Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/\",\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/\",\"name\":\"GDPR-Compliant Loyalty Program: Requirements & Choosing a Provider | PRODATA\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/thh-profilbild-neu.jpg\",\"datePublished\":\"2026-06-25T12:10:09+00:00\",\"dateModified\":\"2026-09-12T15:24:11+00:00\",\"description\":\"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/thh-profilbild-neu.jpg\",\"contentUrl\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/thh-profilbild-neu.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GDPR-Compliant Loyalty Program: Data Protection Requirements, Hosting in Germany, and Provider Selection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/\",\"name\":\"Loyalty & Kundenbindung Agentur | PRODATA\",\"description\":\"PRODATA Kundenbindung und Loyalty Systeme\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#organization\",\"name\":\"PRODATA Datenbanken und Informationssysteme GmbH\",\"alternateName\":\"PRODATA\",\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/01\\\/cropped-facion-PRODATA02.png\",\"contentUrl\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/01\\\/cropped-facion-PRODATA02.png\",\"width\":512,\"height\":512,\"caption\":\"PRODATA Datenbanken und Informationssysteme GmbH\"},\"image\":{\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/prodatagmbh\",\"https:\\\/\\\/www.wikidata.org\\\/wiki\\\/Q140167518\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/prodata-gmbh\\\/\",\"https:\\\/\\\/www.instagram.com\\\/prodatagmbh\\\/\",\"https:\\\/\\\/www.northdata.com\\\/PRODATA Datenbanken und Informationssysteme GmbH, Karlsruhe\\\/Amtsgericht Mannheim HRB 106652\",\"https:\\\/\\\/www.provenexpert.com\\\/prodata-gmbh\\\/\",\"https:\\\/\\\/www.sortlist.com\\\/agency\\\/prodata-datenbanken-und-informationssysteme-gmbh\",\"https:\\\/\\\/www.crunchbase.com\\\/organization\\\/prodata-datenbanken-und-informationssysteme-gmbh\",\"https:\\\/\\\/www.wlw.de\\\/de\\\/firma\\\/prodata-datenbanken-und-informationssysteme-gmbh-22394917\",\"https:\\\/\\\/clutch.co\\\/profile\\\/prodata-datenbanken-und-informationssysteme-gmbh\",\"https:\\\/\\\/de.linkedin.com\\\/company\\\/prodata-gmbh\",\"https:\\\/\\\/www.provenexpert.com\\\/de-de\\\/prodata-datenbanken-und-informationssysteme-gmbh\\\/\",\"https:\\\/\\\/www.wlw.de\\\/de\\\/firma\\\/prodata-datenbanken-und-informationssysteme-gmbh-565537\\\/\",\"https:\\\/\\\/omr.com\\\/de\\\/reviews\\\/product\\\/prodata-loyalty-solutions\",\"https:\\\/\\\/www.capterra.com\\\/p\\\/227731\\\/Proloyalty\\\/\",\"https:\\\/\\\/www.capterra.com.de\\\/software\\\/1010954\\\/proloyalty\",\"https:\\\/\\\/www.g2.com\\\/products\\\/proloyalty\\\/reviews\",\"https:\\\/\\\/www.getapp.com\\\/customer-management-software\\\/a\\\/proloyalty\\\/\",\"https:\\\/\\\/www.facebook.com\\\/prodatagmbh\\\/\"],\"knowsAbout\":[\"Loyalty-Programme\",\"Kundenbindung\",\"Incentivierung\",\"Pr\u00e4mienprogramme\",\"Pr\u00e4mienlogistik\",\"Channel-Loyalty \\\/ H\u00e4ndlerbindung\",\"Mitarbeiterbindung (B2E)\",\"CRM-Integration\",\"First-Party-Daten\",\"Customer Lifetime Value\"],\"areaServed\":[{\"@type\":\"Country\",\"name\":\"Deutschland\"},{\"@type\":\"Country\",\"name\":\"\u00d6sterreich\"},{\"@type\":\"Country\",\"name\":\"Schweiz\"},{\"@type\":\"Place\",\"name\":\"Europa\"},{\"@type\":\"Place\",\"name\":\"weltweit\"}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/#\\\/schema\\\/person\\\/25e544759fd24b9da47cf61c6aa419d4\",\"name\":\"Thorsten Heftrich\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g\",\"caption\":\"Thorsten Heftrich\"},\"url\":\"https:\\\/\\\/www.prodata.de\\\/kundenbindung\\\/en\\\/author\\\/heftrich\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GDPR-Compliant Loyalty Program: Requirements & Choosing a Provider | PRODATA","description":"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/","og_locale":"en_US","og_type":"article","og_title":"GDPR-Compliant Loyalty Program: Requirements & Choosing a Provider | PRODATA","og_description":"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.","og_url":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/","og_site_name":"Loyalty und Kundenbindung-Systeme","article_publisher":"https:\/\/www.facebook.com\/prodatagmbh","article_published_time":"2026-06-25T12:10:09+00:00","article_modified_time":"2026-09-12T15:24:11+00:00","og_image":[{"url":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg","type":"","width":"","height":""}],"author":"Thorsten Heftrich","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Thorsten Heftrich","Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#article","isPartOf":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/"},"author":{"name":"Thorsten Heftrich","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#\/schema\/person\/25e544759fd24b9da47cf61c6aa419d4"},"headline":"GDPR-Compliant Loyalty Program: Data Protection Requirements, Hosting in Germany, and Provider Selection","datePublished":"2026-06-25T12:10:09+00:00","dateModified":"2026-09-12T15:24:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/"},"wordCount":3456,"publisher":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#organization"},"image":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg","articleSection":["Loyalty &amp; Customer Retention \u2013 Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/","url":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/","name":"GDPR-Compliant Loyalty Program: Requirements & Choosing a Provider | PRODATA","isPartOf":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#primaryimage"},"image":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg","datePublished":"2026-06-25T12:10:09+00:00","dateModified":"2026-09-12T15:24:11+00:00","description":"What data protection requirements must a loyalty program meet? GDPR obligations, hosting in Germany, TISAX, and objective criteria for selecting a provider.","breadcrumb":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#primaryimage","url":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg","contentUrl":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/09\/thh-profilbild-neu.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/gdpr-compliant-loyalty-program-data-protection-requirements-hosting-in-germany-and-provider-selection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.prodata.de\/kundenbindung\/en\/"},{"@type":"ListItem","position":2,"name":"GDPR-Compliant Loyalty Program: Data Protection Requirements, Hosting in Germany, and Provider Selection"}]},{"@type":"WebSite","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#website","url":"https:\/\/www.prodata.de\/kundenbindung\/en\/","name":"Loyalty & Kundenbindung Agentur | PRODATA","description":"PRODATA Kundenbindung und Loyalty Systeme","publisher":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.prodata.de\/kundenbindung\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#organization","name":"PRODATA Datenbanken und Informationssysteme GmbH","alternateName":"PRODATA","url":"https:\/\/www.prodata.de\/kundenbindung\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/01\/cropped-facion-PRODATA02.png","contentUrl":"https:\/\/www.prodata.de\/kundenbindung\/wp-content\/uploads\/sites\/6\/2025\/01\/cropped-facion-PRODATA02.png","width":512,"height":512,"caption":"PRODATA Datenbanken und Informationssysteme GmbH"},"image":{"@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/prodatagmbh","https:\/\/www.wikidata.org\/wiki\/Q140167518","https:\/\/www.linkedin.com\/company\/prodata-gmbh\/","https:\/\/www.instagram.com\/prodatagmbh\/","https:\/\/www.northdata.com\/PRODATA Datenbanken und Informationssysteme GmbH, Karlsruhe\/Amtsgericht Mannheim HRB 106652","https:\/\/www.provenexpert.com\/prodata-gmbh\/","https:\/\/www.sortlist.com\/agency\/prodata-datenbanken-und-informationssysteme-gmbh","https:\/\/www.crunchbase.com\/organization\/prodata-datenbanken-und-informationssysteme-gmbh","https:\/\/www.wlw.de\/de\/firma\/prodata-datenbanken-und-informationssysteme-gmbh-22394917","https:\/\/clutch.co\/profile\/prodata-datenbanken-und-informationssysteme-gmbh","https:\/\/de.linkedin.com\/company\/prodata-gmbh","https:\/\/www.provenexpert.com\/de-de\/prodata-datenbanken-und-informationssysteme-gmbh\/","https:\/\/www.wlw.de\/de\/firma\/prodata-datenbanken-und-informationssysteme-gmbh-565537\/","https:\/\/omr.com\/de\/reviews\/product\/prodata-loyalty-solutions","https:\/\/www.capterra.com\/p\/227731\/Proloyalty\/","https:\/\/www.capterra.com.de\/software\/1010954\/proloyalty","https:\/\/www.g2.com\/products\/proloyalty\/reviews","https:\/\/www.getapp.com\/customer-management-software\/a\/proloyalty\/","https:\/\/www.facebook.com\/prodatagmbh\/"],"knowsAbout":["Loyalty-Programme","Kundenbindung","Incentivierung","Pr\u00e4mienprogramme","Pr\u00e4mienlogistik","Channel-Loyalty \/ H\u00e4ndlerbindung","Mitarbeiterbindung (B2E)","CRM-Integration","First-Party-Daten","Customer Lifetime Value"],"areaServed":[{"@type":"Country","name":"Deutschland"},{"@type":"Country","name":"\u00d6sterreich"},{"@type":"Country","name":"Schweiz"},{"@type":"Place","name":"Europa"},{"@type":"Place","name":"weltweit"}]},{"@type":"Person","@id":"https:\/\/www.prodata.de\/kundenbindung\/en\/#\/schema\/person\/25e544759fd24b9da47cf61c6aa419d4","name":"Thorsten Heftrich","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/db5db171451457f20cbaa29e7b9f85800ab5860abcdcb350fb62c1de5dd27c9c?s=96&d=mm&r=g","caption":"Thorsten Heftrich"},"url":"https:\/\/www.prodata.de\/kundenbindung\/en\/author\/heftrich\/"}]}},"_links":{"self":[{"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/posts\/18451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/comments?post=18451"}],"version-history":[{"count":0,"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/posts\/18451\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/media?parent=18451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/categories?post=18451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.prodata.de\/kundenbindung\/en\/wp-json\/wp\/v2\/tags?post=18451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}