Customer management in a small business: what to keep and what to delete

Customer management in a small business actually starts with deciding what not to keep. Collect only details that have a clear use, explain to the customer why they are needed, limit access to the employees who need them and decide when old information is deleted. A clean, consented customer list is more useful than a big file where nobody knows anymore who added what and why.

What does customer management in a small business include?

A customer card is not a drawer where you collect every detail you can get. It is a working tool. Before adding a field, you need to know which action it makes possible: identifying a purchase for a return, finding a voucher balance, seeing purchase history, giving consistent service or contacting a customer who agreed to receive messages. If there is no clear answer, you probably do not need the detail.

This distinction matters especially at the counter. When there is a queue, it is easy to ask for a phone number "just in case", add a free-text note or photograph a document and forget about it. Then the information stays in the system, in an old file or on an employee's phone. The business gets no value from it, but still needs to know who sees it, why it is kept and what to do when a customer asks to check or remove it.

Build a minimal customer card. In most small businesses you can start with a name or nickname for identification and one contact detail, and only if there is a use that justifies it. A full address is needed for delivery, not for a purchase at the counter. A full date of birth is not a default just because you want to send a reward. Sometimes a birth month or the customer's own choice is enough for the operational purpose. The decision depends on the real use and on the law that applies to the business.

Start with a map of uses, not a list of fields

Open a short spreadsheet with four columns: the information, the use, who accesses it and the next review date. The line "Phone, finding a receipt and providing service, shift manager, review after 18 months with no activity" is better than a general definition like "for marketing". It tells the team what is allowed and when to stop and ask again.

Go through every place where information enters the business: the register, the ordering website, a paper form, a WhatsApp message, a delivery file and an employee's personal phone. The same customer can appear in five places, with different details. The first goal is not to merge everything at once, but to identify the copies and who holds them. Without this map you cannot delete information reliably or answer a simple question like "where did you keep my number?".

It is worth separating three uses that often get mixed up in small businesses:

• Service for an existing transaction, for example finding a purchase or arranging a pickup.
• Managing an ongoing relationship, for example a customer card and purchase history.
• Advertising, a campaign or an offer sent to a group.

A detail given in order to pick up an order does not automatically become permission to use it for any other purpose. The separation needs to appear both in how the team talks and in the records. That way the employee knows when they are only verifying a number and when they are asking for separate consent for marketing contact.

How do you manage consent without overloading the register?

Good consent starts with a sentence you can understand on the spot. Explain what will be kept, for what purpose and through which channel you intend to make contact. Do not hide a marketing request inside an operational question like "can I have a number for the receipt?". If the customer declines advertising, the sale and the regular service must continue without argument.

On 21 June 2017 the Privacy Protection Authority published a guideline on direct mail and direct mail services (in Hebrew). The guideline deals with the Authority's interpretation of the Privacy Protection Law (חוק הגנת הפרטיות) in this area, so it is a source worth checking before building a contact list or passing it to a provider. In March 2026 an opinion on consent in privacy protection law was also published, sharpening the need to examine whether consent is free, informed and suited to the circumstances.

On the operational side, keep with the consent at least the channel, the wording or version shown, the date of the choice and the current status. An opt-out request needs to update the same record, not stay as a message in an inbox nobody checks. If there are several channels, do not assume that declining email necessarily means the same for every channel. Define in advance how the business handles choices and opt-outs, and check the wording with a professional.

The previous article on building a loyalty club for a small business explains how to choose a reward and measure it. Here the question comes earlier: whether the information that makes the club possible was collected and kept in a way you can explain and manage.

Permissions: every employee should see only what they need

Role-based permission sounds like something for a big organization, but in a small shop it is actually easy to put in place. A seller at the counter may need to find a customer and see a limited purchase history. A manager may need to correct a record or handle a return. Whoever prepares a campaign needs to work with a group defined by suitable consent, not with a free export of the entire customer database.

Start with three questions for each role: can they view, can they edit and can they export. Export is the weak point people tend to forget. A file sent to a home computer to "work on in the evening" is no longer protected only by the register's permissions. Decide who may export, for what purpose, where the file is kept and when it is deleted.

Also check accounts of employees who left, shared devices and passwords handed over verbally. Once a month, go through the user list and remove access that is not needed. After a role change, do not leave previous permissions out of convenience. Ten minutes of regular checking is better than a late investigation of a file nobody remembers downloading.

The KupaLi loyalty club and campaigns page shows a customer card, purchase history and contacting customer groups based on consent. It is a useful link between information and action, but even in an orderly system the responsibility for the process stays with the business: choosing the use, setting permissions and handling opt-out requests.

Set a review and deletion date before the information goes stale

"We'll keep it in case we need it" is not a policy. Set a review point for each type of information that suits the business cycle and the retention duties that apply to you. Delivery details for an open order, purchase history, a voucher balance and a consent record are not the same thing, so there is no reason to give them all the same date.

A review date does not have to mean automatic deletion. It can trigger a decision: whether there is a duty to keep it, whether the customer is still active, whether the detail is needed for service or whether it can be deleted or reduced. If there is an accounting or legal duty to keep a document, do not delete it because of a general customer list rule. Separate the document that must be kept from contact details collected for another purpose.

Choose a pace the business can keep up. Once a quarter, pull a list of customers with no activity in the period you defined and check what use is left. Also deal with files outside the system: old mailing lists, delivery spreadsheets, backups on personal devices and paper notes. Deleting from one screen is not enough if four copies keep circulating.

Write down who approved the deletion and what was removed. The records do not need to be complicated. An action log that shows when the review was done and what was decided is enough. If you do not know which retention periods apply to a certain type of information, stop and get advice before deleting.

What do you do when a customer asks to check, correct or remove their details?

Do not wait for the first request to decide who handles it. Set an address or a responsible person, a reasonable verification route and a list of places that need checking. The employee at the counter needs to know how to pass on the request without asking the customer to tell the whole story again in front of the queue.

Handling starts with accurately identifying the person and the record, without collecting extra information for verification. Then check which details exist, where they came from, what uses they serve and whether there are copies with providers or in internal files. If the request concerns marketing, update the contact status immediately to prevent another message while the check continues.

Practice one case with the team: a customer asks to stop receiving emails but wants to keep her customer card for service. Does the employee know how to separate the two requests? An exercise like this exposes vague definitions long before they turn into a complaint.

A twenty-minute check of your customer list

Pick ten random records and check each one from start to finish. Is it clear why it exists? Is there a detail with no use? Is the consent status understandable? Can a new employee export it? Is there a copy in an external spreadsheet? Could you handle an opt-out request without searching through five message inboxes?

Then choose one action for the coming week. For example, removing permissions for employees who left, merging two delivery files, adding a proper field for the consent source or setting a date to review old records. Do not try to clean up years of information in one day. A steady routine moves faster than a one-off drive after which everyone goes back to the old habits.

What to take to work today

• Define a clear use before adding a field to the customer card.
• Separate service, relationship management and marketing contact.
• Limit viewing, editing and export by role.
• Record consent and opt-outs in one place you can update.
• Set a review date for each type of information and deal with external copies too.
• Practice one customer request to make sure the process really works.

This is a general explanation and not legal advice.