A customer database is a list of people and companies who bought from you or left their contact details, together with their purchase history, where they came from and what they agreed to receive. An online store builds it from its own channels: checkout, chat, calls, email and account sign-up. Marketing email needs permission the customer gives themselves. Buying a list does not give you that permission.
Most stores do not lack sources; they lose contacts. Numbers stay in a sales rep's personal phone, orders sit in three spreadsheets, and half the buyers never opted in, so you cannot email them. Below: where contacts come from, what EU and US law requires, how to split the database into groups, and how much one email to opted-in customers can bring.
When stores start asking how to build a customer database
Usually when ads get more expensive and repeat orders stay rare. The owner knows that hundreds of buyers went through the store last year, but there is no way to write to them: the contacts are scattered across orders, chat threads and staff phones. They search for "customer database", "how to build a customer base", "how to collect customer information" and "can you buy email lists".
The last one is a trap. In the EU, people on a bought list never agreed to hear from you, and in both the EU and the US mail from an unknown sender lands in spam. A customer database is collected, not bought.
What a customer database should contain
Each record holds more than an email address: it also says where the person came from, what they bought and whether they agreed to marketing.
- Contact details: name, email, phone, messenger, city or country.
- Source: website, marketplace, chat, call, trade show.
- History: orders, amounts, dates, support requests, conversations.
- Consent: what exactly (email, SMS), when, and through which form or channel it was given.
- Status: new, regular, lapsed.
Without history you cannot split the database into groups. Without a consent record you cannot prove you were allowed to send marketing.
Cold, warm and hot contacts
The difference is how well the person knows you and whether they are ready to buy now.
| Contacts | Who they are | What to do with them |
|---|---|---|
| Cold | People who do not know you and never left their details | Introduction: ads; in B2B, cold calls |
| Warm | People who bought, subscribed or sent an inquiry | Email with consent, reminders, offers related to past purchases |
| Hot | People ready to buy now: a full cart, an inquiry, a question in chat | A fast reply and help placing the order |
Growing the database pays best from the warm end: stop losing people who already contacted you, and turn one-time buyers into regulars.
How to collect customer contact information: sources
The main sources are the store's own channels: every order, chat message, call and email already contains a contact. The job is to get all of them into one database.
Your store's own channels
- Checkout. The main source. Next to it, a separate checkbox for marketing email.
- Chat and messengers. A visitor who asked a question and left a phone number is already a hot contact. Do not let it get lost in the thread.
- Incoming and missed calls. A new number is a potential customer, even if they did not buy this time.
- Email and account sign-up. Give people a reason to register: order history, faster checkout, loyalty points.
- Marketplaces. Buyers from there are your customers too, but you may use their contact only within the platform's rules and for the purpose it was passed to you.
Reasons to leave a contact
- A discount or free shipping on the first order for subscribing.
- A back-in-stock alert for an item that is sold out.
- A price-drop alert for an item on the wishlist.
- Something useful: a size chart, a care guide, a buying guide.
For B2B and wholesale
- Requests for the wholesale price list on your website.
- Trade shows and industry events: business cards and forms at the booth.
- Referrals from current wholesale customers.
- Publicly listed company contacts, for cold calls.
What not to do
- Do not buy lists. The people on them never agreed to hear from you, and mailing such a list damages the reputation of your sending domain: mail starts going to spam even for those who did subscribe.
- Do not subscribe people silently. An order lets you contact the customer about that order; it is not permission for marketing.
- Do not hide the unsubscribe link. It goes into every marketing email and works right away.
What the law requires: consent and unsubscribe in the EU and the US
In the EU, a customer's name, email and phone are personal data under the GDPR, and marketing email needs prior consent, with one exception for your own customers. In the US, the CAN-SPAM Act does not require consent before a commercial email, but every message must be honest, carry an opt-out and a postal address, and opt-outs must be honored.
European Union: GDPR and the ePrivacy Directive
- A separate legal basis for each purpose. You process the phone number for delivery because it is necessary to perform the contract (GDPR Article 6(1)(b)). Marketing is a different purpose, and for email it rests on consent (Article 6(1)(a)).
- Consent is an active step. The GDPR defines it as a "freely given, specific, informed and unambiguous" indication given "by a statement or by a clear affirmative action" (Article 4(11)). Recital 32: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." So the box is never ticked in advance.
- You must be able to prove it. Article 7(1): the controller "shall be able to demonstrate" consent. In practice: date, form and wording for every contact.
- Withdrawing is as easy as giving. Article 7(3): "It shall be as easy to withdraw as to give consent." After an objection to direct marketing, the data may no longer be used for it (Article 21(3)).
- Prior consent for marketing email. The ePrivacy Directive (Article 13(1)) allows email for direct marketing only to people who gave prior consent.
- The exception for your own customers. If you got the email address in the context of a sale, you may market your own similar products to that customer, provided they could object free of charge and easily when the address was collected and in every message (Article 13(2)). Each EU country writes this into its own law, so details differ.
- Tell people at collection. Who you are, why you collect the data, on what legal basis and who receives it (GDPR Article 13). Usually this is a privacy policy linked next to the form.
- Answer requests within a month. Requests to access, correct or delete data are answered within one month of receipt; complex cases can be extended by two more months (Article 12(3)).
The GDPR also applies to stores outside the EU when they offer goods to people in the EU (Article 3(2)).
United States: the CAN-SPAM Act
- No prior consent required, but an opt-out is. Every commercial email must clearly explain how to stop receiving marketing email, and the request must be honored within 10 business days.
- Honest headers and subject lines. No false "From" information and no deceptive subject lines; the message must be identified as an ad.
- A valid physical postal address in every message.
- B2B is not exempt. The FTC states the law "makes no exception for business-to-business email".
- You answer for your contractors. If an agency sends on your behalf, both of you can be held responsible.
- Penalties are set per email: on the check date the FTC lists up to $53,088 for each separate email in violation.
Texts and calls follow separate rules in both regions; this article covers email. For your specific case, check with a lawyer.
For the database this means one thing: every contact carries what they agreed to, when and where, and an unsubscribe removes them from marketing right away.
How not to lose contacts
A database grows less from new sources than from no longer losing contacts from the ones you have. Typical leaks:
- Sales reps' personal messengers. A rep leaves, the contacts leave with them.
- Missed calls. The number was not saved and nobody called back.
- Several spreadsheets. Website orders in one, marketplace orders in another, wholesale buyers in a third.
- Duplicates. One customer, three records with different phones, and the purchase history split between them.
- Inquiries without a next step. Someone asked about a product, got an answer and disappeared, and nobody followed up.
How to segment a customer database
Split by purchases: people who have not bought yet, who bought once, who buy regularly, who stopped coming back, and who buy wholesale. Each group gets its own reason for an email.
| Group | What to send |
|---|---|
| Never bought | A first-order discount, answers to doubts: shipping, payment, returns |
| Bought once | Product care, related items, reminders about consumables |
| Regulars | Early access to new arrivals, personal terms |
| Lapsed | What changed in the range, an offer with a reason |
| Wholesale | Price list, new arrivals, shipping terms |
Call scripts for repeat sales are in the article sales scripts for online stores.
How much an opted-in customer database earns
The easiest unit is one email:
Revenue from one email = opted-in contacts × share who ordered × gross profit per order.
Illustrative example for the arithmetic, not market data. 1,000 customers bought from the store in a year, and 600 of them ticked the consent box. An email about an accessory for their previous purchase brought orders from 2% of recipients: 600 × 0.02 = 12 orders. With a gross profit of €25 per order, one email earned 12 × €25 = €300, with no ad spend.
That gives two levers. The first is the consent rate: if the checkbox appears only at account sign-up and not at checkout, a smaller share of buyers will have opted in. The second is the reason for the email: an offer tied to the last purchase interests people more than "everything on sale". How to keep customers coming back between purchases is covered in ecommerce customer service rules.
Customer database in order
When to move the customer database into a CRM
A spreadsheet works while there are a few dozen customers and contacts come from one channel. Once they arrive from the website, marketplaces, messengers and calls, the spreadsheet falls behind, duplicates pile up and nobody records consent.
In Elbuz, orders, emails, chats (Telegram, Viber, WhatsApp, Instagram, Messenger) and calls attach to one customer record, duplicates are found and merged, and the record stores the date and source of consent or unsubscribe. Campaigns go only to people who opted in and skip those who unsubscribed. How it works is on the ecommerce CRM page.
Who does not need it: if all orders come from one website and there are a few a week, a spreadsheet with "source", "consent" and "consent date" columns is enough.
Ecommerce CRMOne customer database with orders, conversations and consent, 14 days free
Frequently asked questions
What is a customer database?
A list of people and companies who bought from you or left their contact details, with purchase history, source and marketing consent. Without history and consent it is just a list of phone numbers: you can neither work with groups nor prove you may send marketing.
How do I build a customer database for an online store?
Collect contacts from orders, chat, calls, email and sign-up into one database, give people a reason to leave a contact and ask for marketing consent separately. Details are in the section on contact sources.
What is the difference between cold and warm contacts?
Cold contacts do not know you and never left their details. Warm contacts already bought, subscribed or sent an inquiry. Hot contacts are ready to buy now.
Can you buy email lists?
It is a bad idea. In the EU, the people on the list did not give you the prior consent the ePrivacy Directive requires for marketing email. In the US, CAN-SPAM has no consent requirement, but mailing bought addresses hurts deliverability for your real subscribers.
Do I need consent to send marketing emails?
In the EU, yes: prior consent, or the exception for your own customers who could refuse at checkout and in every email. In the US, CAN-SPAM requires no prior consent, but every email needs an opt-out and a postal address.
Does GDPR apply to a store outside the EU?
Yes, if the store offers goods to people in the EU: Article 3(2) of the GDPR covers controllers not established in the EU when they process data of people in the EU in connection with such offers.
What software should I use for a customer database?
While contacts are few, a spreadsheet is enough. When they come from the website, marketplaces, messengers and calls, you need a CRM that attaches inquiries and orders to the customer, removes duplicates and stores marketing consent.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 3, 4(11), 6, 7, 12, 13, 21 and recital 32 — eur-lex.europa.eu.
- Directive 2002/58/EC (ePrivacy Directive), Article 13 — eur-lex.europa.eu.
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business — ftc.gov.
Checked on October 31, 2026.
John Smith
Very interesting article! I love collecting client contacts and learning new ways. I love using email newsletters and social media, but it would be great to learn a few more effective ways!