Handling a GDPR erasure request

Question: A customer asks to be deleted. What do you send, and what can you honestly tell them?

The call

DELETE /api/v2.0/stores/{storeId}/members/{memberId}

{ "is_ok": true, "details": "" }

Then clear diller_member_id on your own customer record. STORE_ID is the id you read from GET /stores at setup.

async function eraseLoyaltyMember(customer) {
  if (!customer.dillerMemberId) return;

  const res = await dillerFetch(
    `/api/v2.0/stores/${STORE_ID}/members/${customer.dillerMemberId}`,
    { method: 'DELETE' },
  );
  const body = await res.json();
  if (!res.ok || !body.is_ok) {
    throw new Error(`Diller erasure failed: ${body.details ?? res.status}`);
  }

  await db.customers.update(customer.id, { dillerMemberId: null });
  await audit.log('loyalty.erasure', { customerId: customer.id, at: new Date() });
}

Log it. An erasure you cannot evidence is an erasure you did not do, as far as a regulator is concerned.

What to tell the customer

Not “your data has been deleted.”

The member is marked for deletion and permanently removed after ten days. Until then it still exists.

Accurate wording:

Your request has been registered. Your loyalty membership has been closed and your data will be permanently removed within 10 days.

If your own privacy policy promises immediate erasure, that promise is wrong for the loyalty data and should be corrected.

Erasure is not the same as unsubscribing

Two different requests that customers phrase identically.

They want	Do this	Effect
“Stop emailing me”	`PUT` with `receive_email: false`	Marketing stops. Points, coupons and history survive
“Stop texting me”	`PUT` with `receive_sms: false`	Same
“Delete my account”	`DELETE`	Everything goes, after 10 days

For either unsubscribe, send the other marketing flag unchanged — a PUT that leaves it out sets it to false too, and stops marketing the customer did not ask to stop. Build the body from a fresh read, as in Keeping profiles in sync.

Note that you cannot withdraw consent by sending gdpr_accepted: false — that returns 400, and the error message says so explicitly: “If your goal is to delete the member, please use the DELETE endpoint.”

Data access requests

There is no export endpoint. Assemble a response from:

GET /members/{memberId} — profile, consent, points, segments
GET /members/{memberId}/coupons/ — coupons held
GET /members/{memberId}/stamp-cards — stamp progress
Your own order records, which hold the purchase detail

For transaction history stored in Diller, the merchant retrieves it from their Diller account.

Who is the controller?

The merchant is the data controller. We and you are processors. In practice:

The merchant’s privacy policy governs — link privacy_policy_url.
Erasure requests should reach the merchant, even when they arrive through your shop.
Do not decide on your own what to retain. Ask.