A payment receipt, table order or Wi-Fi login is not automatically permission to send marketing. If a café wants to message guests after their visit, it needs a clear process for collecting contact details and respecting each person’s choice.
This is a practical checklist, not legal advice. The Information Commissioner’s Office provides the current electronic mail marketing guidance.
Keep ordering and marketing separate
A guest should be able to complete an order without joining a marketing list. Ask about loyalty after the transaction and explain what the café plans to send.
Do not describe marketing as an order update. A receipt or collection message is different from an offer designed to bring someone back.
Name the café and the channel
The wording should identify the café and say whether messages will arrive by email, WhatsApp or another channel. A general phrase such as “updates from selected partners” is not a clear description of the café’s own messages.
If you offer more than one channel, record the guest’s choice for each channel. Someone may accept email and decline WhatsApp.
Do not preselect consent
When relying on consent, the choice should require a positive action. Do not pre-tick a box or hide the marketing wording inside general terms.
The ICO also describes a limited “soft opt-in” for an organisation’s own similar products and services. It has several conditions, including collecting the details directly during a sale or negotiation and offering a clear opt-out both when details are collected and in every later message. Do not assume every loyalty list qualifies.
Keep a usable record
For each channel, keep enough information to show:
- Who made the choice.
- Which café they agreed to hear from.
- The wording shown at the time.
- The selected channel.
- When and where the choice was recorded.
- Whether and when the person later unsubscribed.
The record should help the café answer a real question, not simply display a green “consented” label.
Make every message identifiable
Marketing should make clear which café sent it. It should also provide a valid, simple way to stop future messages.
Do not require someone to create an account or remember a password to unsubscribe. When they opt out, stop the affected channel promptly and keep enough of a suppression record to avoid adding them back by mistake.
Treat bought or scraped lists as a different risk
An email address on a website or social profile is not proof of marketing consent. The ICO states that the soft opt-in does not cover bought-in lists, and a third-party list must have valid consent that names the sender and covers the method used.
For an independent café, the practical answer is usually simpler: build a first-party list from guests who knowingly choose to hear from that café.
How Café QR handles the choice
Café QR keeps the loyalty invitation separate from payment. After ordering, a guest can choose the café and channel they want to hear from. The café controls its own contacts and remains responsible for the messages it sends.
Read more about the Café QR loyalty programme and our privacy notice.