Data collection

Small-business owners should proceed with caution when collecting and storing information about customers

When customers rent inflatable units from Arthur McCarthy’s business, they automatically receive a promotion for a rental for the following year.

It’s one way McCarthy uses his customers’ personal data to keep in touch with them and boost sales for his business, DSM Inflatables, which he started in 2016 in West Des Moines after his carnival games business began to decline with the slowing market.

Anytime someone rents an item from DSM Inflatables, McCarthy collects his or her name, mailing address, delivery address, phone number and email if the renter chooses to disclose it. The data is retained in physical
format for three years before it is destroyed. The company does not keep any credit or debit card information, he says.

Many businesses, particularly those with an online presence, collect data, whether it be about trends in the market, customers’ purchases or even details about competitor companies.

“Data can be collected in more ways than ever before, and there’s more ways being added,” says Rebecca Herold of Des Moines, who is known as The Privacy Professor and has advised people about information security, privacy and compliance issues for more than 25 years.

Marketing experts say there are benefits to business owners who collect their customers’ data, while privacy and security experts agree collection needs to be done thoughtfully with a plan to store and protect all data.

Here are five things to ask when considering whether or not to collect customer data:

1. Should you collect data?

The answer is yes, says Kris Winter, the owner of M2K Marketing Group. But she says it can be a loaded question with privacy concerns. Winter’s group advises clients on how to collect and use customer data.

“Keeping a record will help you upsell, cross-sell and provide customized director messaging to your customers based on their purchasing needs,” she says. “People now will rely on and want customized information that meets their particular needs and why they’re doing business with you.”

There are few businesses that don’t collect data or could be collecting it, Herold says.

Even if a business doesn’t think it is, or needs to, collect data, it still is. Any business that accepts money from customers, sends invoices, keeps a record of what it sells, pays employees, purchases equipment or services, and tracks its purchases, is collecting data. Data collection comes down to the bottom line for most businesses, says Denny Fisher, a chief strategist who handles cybersecurity issues for Associated Computer Systems Ltd.

“Most people use it for targeted marketing to determine what products they may or may not sell, to make better decisions and to generate more revenue,” he says.

McCarthy’s business has more than doubled each year since it began in 2016 with 33 events. This year, his company has 250 events scheduled and averages two to three bookings a day.

He says much of this is because of the promotions he offers customers if they return. At the end of each year, he mails a promotional card to anyone whose mailing address is still current for a promotion that is redeemable for the following year. This ranges from $25 off a rental to a free inflatable rental. The first year, all but two of the 33 renters were repeat customers in 2017.

While many businesses are collecting data, Echo Boland has still found success with her cookie and sweets shop in Waukee without doing so. She openedthe Echo’s Cookie Shop storefront four years ago and relies on word of mouth and limited social media to draw in customers.

Boland collects customers’ names, phone numbers and their orders but doesn’t maintain an active database, nor does she reach out to previous customers with targeted advertising.

“I know our usual customers who come in or have come in before,” she says. “I try to make a point to know who they are.”

Business has tripled in the time Boland opened the shop. It’s grown so much that she’s had to stop taking orders for cakes because she could no longer focus on cookies and cake balls and had to turn away customers. She’s also turned down advertising opportunities because she doesn’t want to have to turn away customers from too much demand.

2. What do you need to collect?

Marketing and business experts suggest business owners collect the following:

• Names and contact information, so the business owner can market directly to the individual with personalized communication and to share information about orders or products.

• Transaction history to learn the customer’s preferences, which products they buy, how often they purchase them and how much they spend.

• Communication between the business and the customer to track the frequency of communication and the effectiveness of different types of communication.

• Age, gender, profession, income and hobbies. This information can help complete a clearer picture of the business’ target customer, so the business can better focus its advertising and marketing efforts. Knowing profession can help with pricing.

• Spending habits such as impulse buys and considered purchases. This can help with the position of products within a store.

• Birthday, so the business can send a text, card or even a coupon.

At the very least, business owners should collect customers’ names, email addresses, cell phones and track their purchases, Winter says.

3. How do you collect information?

Experts say it’s important customers do not feel harassed for data or be required to fill out long forms, which could discourage them from making a purchase. Collecting information through various methods a little bit at a time can be less intrusive and time-consuming.

Any business that has a website or social media account may also want to track information about how their customers come to them.

“There’s ways to track how they came to the business,” Winter says. “You know that’s a good channel for you to reach them on and to continue to send messages to them.”

A business owner should use his or her purchasing system or website to track sales, she says. They also can purchase third-party data about consumers that the business owner can crossreference with their own list to learn more about a customer’s buying habits. An online purchasing system can help obtain basic information about the
customer.

Many websites use “cookies” or web beacons or web bugs to learn more about users. A cookie is a small amount of data that is sent to a user’s web browser from a web server and stored on that person’s computer’s hard drive. Web beacons or bugs are 1-by-1 pixels that can relay information from a person’s device back to its source. These provide more insight about the user. One of the more common ways businesses gather customers’ information is through loyalty programs or offers to provide coupons and discounts through an email list. This allows the business to track buying habits and then better market itself to the customer, Fisher says.

“Most businesses want more insight as to how their customers are behaving,” he says. “Anything that would give them any type of behavior: Where you’re going, what type of card you use, how often do you come to their store?”

A loyalty program or competition also can make customers feel as though they are getting something in return for giving up some of their personal information. A recent Pew Research Center poll asked Americans about privacy related questions and found that most weighed the decision on whether to share their information with the value of the benefit they would receive. Many reported they wanted convenient access to information, goods and services, according to Pew, a nonpartisan thinktank in Washington, D.C., that conducts polls, research and analysis about issues, attitudes and trends.

Customer surveys can be helpful to provide the business owner with feedback about the price of the item, how the customer is using it, their satisfaction, the customer’s service/experience and more.

“This is a way to collect more information and help identify the ideal customer,” Winter says.

Most businesses, even small ones, will have a transactional system they use or customer relationship
management software, to track point-of-sale transactions or business-to-business, as well as a website that’ll use analytics, Fisher says. A database software program can help the business owner better manage data, especially as it becomes more detailed, beyond a Microsoft Excel spreadsheet.

4. What do you do with it?

Businesses can be overwhelmed with data, so it’s important to have an organized system for data collection and to know how it can be used, technology experts advise.

Data can be used to track patterns and other information that can be used to develop a strategic marketing plan.

McCarthy also belongs to the Better Business Bureau and utilizes an application called Review Collection to encourage customers to write reviews. He uses his customers’ cell phone numbers to text them the link to the review to provide feedback and suggestions for improvements.

“It’s been a huge success for us,” he says.

The BBB sends McCarthy a monthly report — he also gets one from Google Analytics — to see how many times his business has been searched and how traffic is coming to his website.

Business owners should analyze their customers’ purchases to see if there are any commonalities or trends and to send them reminders or other services, Winter says.

For example, if a business sells lawnmowers, they may want to reach out to customers who bought a mower every so often for a service reminder. If the business studies its data and discovers customers who purchase lawnmowers also purchase another item such as a trimmer, they’ll want to reach out to new lawnmower
purchasers and try to sell them a trimmer, as well.

“You always want to think in terms of what you can cross-sell or up-sell,” Winter says.

Once a business owner has collected enough data to create a profile of his or her company’s ideal customer, he or she can reach out to similar potential customers for similar products, she says.

Data also can show areas where the business needs to do better. If a former customer hasn’t been to the business or made a purchase in a while, the business owner can see this and reach out to that person. The data also will show if a product isn’t selling or if sales have stalled.

A business’ website analytics can show it how traffic arrives at the site. This can help drive future advertising decisions, Winter says. For example, if a majority of people in the past couple of months have stumbled upon the business through Facebook, the business owner may place more money into paid Facebook advertisements to reach a specific audience.

McCarthy also purchases paid advertisements through social media outlets such as Facebook, which conducts its own data collection of users, in order to target specific groups of potential customers such as moms, public events, churches, birthday parties and nonprofit groups.

But business owners should be careful with these marketing decisions as well, as recent reports from Imperva and others show that as much as half of all web traffic isn’t human but rather “bots” that are computer generated and often used fraudulently to boost website traffic. Social media marketing has its flaws as well, which a recent survey by Custard, a British digital marketing company, showed with 75 percent of users admitting to lying
about themselves on social media.

5. How do you keep it safe?

The collection of data is a mostly unregulated area, though that could change with the General Data Protection Regulation that went into effect May 25 in the European Union.

The GDPR is a data privacy law that protects all European Union citizens from privacy and data breaches. It applies to all companies, regardless of location — this includes U.S. companies, that process personal data of EU residents.

Data privacy attorneys recommend all businesses, even small ones, should have a written privacy policy and data practices policy.

The Federal Trade Commission provides business owners with guidelines for securely collecting electronic consumer data with its Fair Information Practice Principles. Businesses that collect customer data need to create a customer information privacy policy and give customers access to it. The policy can contain information about who is collecting the data, how it’s used and with whom it is shared. A business that does not follow its own privacy claims and policies can be found guilty of deceptive practices and fined by the FTC.

Most states, Iowa included, have data breach notification laws. These laws require businesses and entities to notify affected individuals if there is an unauthorized disclosure of certain personal information that includes
the person’s name and social security number, driver’s license number, financial account number, medical information, insurance information, date of birth, mother’s maiden name or DNA. This can vary by state.

Paul Schwegler, the owner of Little Dog Tech in West Des Moines, recommends business owners meet with an information technology professional to ensure they have all data, not just customer information, secure.

Data storage comes down to three basic principles, he says: control where it is, protect where it is and audit it.

All business owners should know where personally identifiable information is stored, whether locally or in a cloud, and how to control the location. For example, having numerous spreadsheets of information that are stored by various sources or individuals or in different locations, is not securing the data.

A business owner needs to set internal policies for data storage and educate employees of those policies, he says. If the owner keeps data locally, he or she needs to have controls on the access to the data. The owner also needs to have agreements with any vendors that may provide cloud storage for data to ensure the information is kept secure.

The third step is to conduct audits to ensure only the appropriate people have access to the secure data, Schwegler says.

Even so, data storage is susceptible to hacking, as many businesses large and small have learned the hard way. As such, any business security plan should address what the business will do in the case of a security breach, Fisher says. This will include how the customer or client will be notified of a breach, as well as how the company will address a breach with the media, vendors and others who are involved. ♦