Direct Mail and GDPR: How to Contact Customers in Compliance with the Rules

The study summarises the legal framework for physical direct mail and how it differs from marketing email. Sending a physical postcard by post is not subject to the specific rules of Section 7 of Czech Act No. 480/2004 Coll. governing electronic commercial communications. GDPR still applies because an e-commerce business processes the customer's name, address and potentially other personal data when preparing the mailing.

Separate marketing consent is not automatically required. Under certain conditions, the processing of personal data for direct marketing may rely on the controller's legitimate interest. The relationship with the customer, their reasonable expectations and the proportionality of the processing must be assessed. Customers must be informed transparently and must be able to object to the use of their data for direct marketing.

The study also explains the difference from marketing email, which is subject to both GDPR and Czech Act No. 480/2004 Coll. For existing customers, an opt-out regime may be available under the statutory conditions for offers of the company's own similar products or services.

A separate section covers personalised QR codes. For an open postcard, the study recommends not placing personal or customer data directly inside the QR code. A safer approach is to use a randomly generated pseudonymous token, while the link between the token, the customer and the specific offer remains only in a secure application layer.

After scanning the code, a landing page may display a personalised product selection, an individual discount or another campaign offer, but without further authentication it should not reveal customer data or explain why the offer was created. If personalisation is based on purchase history, preferences or customer segmentation, this is additional processing of personal data that should be included in the GDPR assessment.

In practice, this can mean designing direct mail according to privacy-by-design principles: a physical mailing, a pseudonymised QR token, minimal data on the landing page, transparent customer information and an opt-out mechanism.