A swag provider should receive the information needed for the next authorized step—not your entire employee directory. Separate gift eligibility, product selection, delivery and reporting into different handoffs. Before launching, agree on the fields each participant receives, how corrections travel through the order, and what happens to each copy when its purpose ends.
A shirt size can be necessary for a decorator. A home address can be necessary for a carrier. Neither fact means the marketing team needs a spreadsheet containing both, along with the employee’s birthday, manager and payroll identifier. The useful question is not simply “Is our provider secure?” It is “Why does this particular person or system need this particular field?”
Publisher perspective: Brand Sauce publishes this guide for company-store buyers. The handoff model and acceptance tests below are editorial recommendations, not a claim about Brand Sauce’s current integrations, retention periods or certifications. Have your security and privacy owners approve the actual arrangement, including any country-specific requirements.
Separate the invitation record from the fulfillment record
Start with an employee-choice campaign. The sponsor needs to identify eligible recipients and communicate the offer. The store needs to recognize an authorized selection. The fulfillment team needs enough information to produce and deliver that selection. Finance needs to reconcile the charge. Those tasks overlap, but they do not require identical records.
For planning purposes, treat them as four records connected by a campaign-specific recipient reference and an order number. Confirm that the provider supports this arrangement before designing around it. A reference is still personal data when it can be linked back to someone; replacing a name with a code is not a promise of anonymity.
This approach follows the general direction of the FTC’s business data-protection guidance: understand information flows, retain information for a legitimate need and limit access. The merchandise-specific implementation below is our proposed operating model, not an FTC-prescribed gifting workflow.
| Handoff | Suggested starting fields | Keep out unless separately justified |
|---|---|---|
| Sponsor to invitation service | Campaign reference, approved recipient reference, invitation destination, eligibility and offer code | Home address, apparel size, salary, performance notes |
| Recipient to order service | Selected product and variant, delivery details, contact fields required for this shipment | Birth date, health explanations, unrelated HR profile |
| Order service to production | Order or batch reference, product, quantity, decoration version and required personalization | Recipient address when production does not also perform dispatch |
| Order service to shipping | Delivery name, validated destination and service-specific required contact information | Gift eligibility rationale, manager comments, salary or recognition history |
| Provider to sponsor reporting | Order reference, campaign, status, charge and approved reconciliation identifiers | Full delivery address and personal messages in routine dashboards |
This is a starting specification, not a universal schema. A supplier that decorates and ships from one facility may need both production and shipping fields. A pickup event may need no home address at all. Require a reason for exceptions and reflect the actual parties doing the work.
Collect delivery information when there is something to deliver
Do not make a preference survey double as a shipping manifest. Before an employee has chosen an item, a home address may create maintenance work without enabling a shipment. Let recipients confirm delivery details during the order process when the approved system supports it. For the earlier research stage, use the separate employee gift preference survey guide.
A hypothetical welcome campaign illustrates the distinction. HR invites an eligible new colleague using an approved contact route. The colleague selects a notebook and confirms a delivery address in the store. HR sees that the gift was selected and dispatched; the shipping party receives the address. The campaign organizer does not need to copy that address into a presentation to prove the gift was sent.
Use an equally deliberate process for recipients without corporate email. Agree on an approved invitation route instead of exporting every personal contact field “just in case.” If a local coordinator helps someone order, define where that assistance occurs and how the coordinator’s temporary notes are removed.
Explain the handoff in plain language before collection: who operates the ordering experience, what information is needed for delivery, where employees can correct it and where to ask questions. Do not call an ordering form anonymous when a selected item will be connected to a name and destination.
Write a field contract before sending a file
A field contract is a short agreed specification for one transfer. It prevents “send us your employee list” from becoming an open-ended request. Give each field a name, purpose, format, required or optional status, source of truth and correction owner.
For example, a destination-country field might be required at ordering because it determines whether the chosen product and shipping service are available. A department field might be unnecessary for production but necessary in a separate sponsor billing export. A phone number should have a documented delivery or support purpose, not be marked mandatory merely because a generic template includes it.
- Define missing-value behavior. An absent optional phone number should not be replaced with someone else’s number. A missing required destination should create a held order, not an invented address.
- Reject unexpected columns. If an upload contains payroll or medical fields, stop and request a corrected file through the approved process rather than silently passing those fields downstream.
- Specify duplicate handling. Reimporting the same campaign recipient should not create a second invitation or gift entitlement unless that is intentional.
- Control free text. Replace “anything we should know about you?” with a narrow field whose purpose is clear. Do not ask employees to explain a medical reason for choosing a different product.
- Separate optional personalization. A printed first name may be part of the manufacturing instructions. That does not make the employee’s full HR name necessary on every production report.
Ask the provider to return an example accepted record and an example rejected record using fictional data. Review the error report as well as the successful upload: a rejection email that reproduces the full source row can create another unnecessary copy.
Map the whole handoff chain, including support
The storefront may not be the last destination. Ask which parties handle invitations, hosting, decoration, packing, transport and support, and which information each receives. Record relevant processing locations and onward transfers for review rather than assuming a store’s web domain reveals where work occurs.
Give every transfer a named business owner. That owner should know how the recipient list is approved, how the transfer channel is authorized, and who confirms acceptance. A shared folder with an unclear audience is not a completed handoff simply because an upload succeeded.
Support deserves its own row in the map. A damaged-item photo may include a shipping label. A screen recording may reveal another open browser tab. Ask for the smallest useful evidence and provide a route for correcting accidental disclosures. When documenting a case internally, link the restricted case record rather than attaching the entire conversation to every status update.
Also ask what the software records automatically. The OWASP Logging Cheat Sheet advises excluding or appropriately handling sensitive information such as access tokens and sensitive personal data in logs. For your acceptance review, inspect a sample import error and support log with the technical owner. The goal is useful diagnostics without copying complete recipient records into debugging output.
Decide which system wins when details change
Data minimization still needs reliable order matching. A smaller file is not helpful if nobody can tell which order it updates. Keep stable order references, document authoritative fields and establish a correction cutoff for each fulfillment stage.
Suppose an employee changes a delivery address after selecting a gift. Ask whether the change updates only a saved profile, the specific open order, or both. Then ask whether the order has already reached the shipping system. Do not tell the employee a parcel has been redirected merely because the storefront now displays the new address.
Use a closed-loop correction: request received, affected order identified, fulfillment party confirms whether the change is still possible, and the employee receives the outcome. Where a change cannot be made, support should explain the available next step under the order’s terms.
Keep eligibility changes separate. Ending someone’s store access does not automatically cancel an accepted shipment, erase a carrier record or settle a refund. Our company-store access and offboarding guide covers that permissions decision. This handoff plan should record where the remaining order information lives.
Agree on deletion by record type, not one blanket promise
“We delete everything after the campaign” is too vague to evaluate. An unused invitation, a completed shipping label, an unresolved support case and an accounting record have different purposes. Ask for a retention schedule that names each record type, its owner, its trigger and any approved exception.
NIST’s Privacy Framework FAQ describes policies and capabilities for reviewing, transferring, correcting and deleting data, including retention management. Use that as a discussion framework; it does not supply a universal merchandise retention deadline or establish that a provider is certified.
| Record | Decision to agree | Evidence to request |
|---|---|---|
| Invitation upload and temporary working files | When accepted imports and unused campaign lists can be removed | Import reference, cleanup owner and completion record |
| Active order and shipping information | What remains available for fulfillment and defined service needs | Record-specific schedule and restricted access roles |
| Support attachments | When the case purpose ends and what exceptions remain | Case-close disposition without republishing the attachment |
| Invoices and reconciliation data | Which fields must remain under the approved recordkeeping policy | Retention basis and a report containing only required fields |
| Backups and downstream copies | How routine expiry, restoration and onward deletion are handled | Documented process, limitations and responsible party |
Set actual periods with the appropriate recordkeeping and privacy owners. Do not invent a 30-day rule because it sounds reassuring. Ask how a restored backup is prevented from quietly reintroducing data scheduled for deletion. If a downstream carrier or another party retains records under its own obligations, describe that limitation instead of promising deletion everywhere.
On-demand, bulk and hybrid programs need different data maps
On-demand production avoids preassigning every item before employees choose, but individual home shipments still require recipient-level fulfillment information. It is not inherently a privacy guarantee. Confirm the handoff for each product route, especially when different items use different producers.
Bulk office delivery can reduce the external need for individual home addresses. It may be a good fit for a stable group attending one event or collecting standard goods at a staffed location. However, a named size roster or pickup checklist can still exist internally. Assign custody and disposal of those records too.
A hybrid program should document both routes. For example, office attendees collect from a batch while remote staff order individual deliveries. The office coordinator needs a pickup process; the remote shipping provider needs destination details. Combining both into one master export is convenient but should not be the default handoff.
Run a fictional-recipient walkthrough before launch
Use approved test records and a non-production ordering path. These checks validate the agreed workflow; they are not a penetration test or a substitute for vendor security review.
- Upload a permitted invitation record and confirm exactly which fields appear to the invitation operator.
- Submit an extra, prohibited field and confirm it is rejected or handled under the agreed exception process.
- Place a test selection and inspect the separate production, shipping and sponsor reporting views.
- Change the test destination and establish which systems changed and who acknowledged the update.
- Close the test campaign and request the agreed cleanup evidence, including temporary exports.
- Confirm that retained transaction records remain usable for their approved purpose without restoring an unnecessary full profile.
Record gaps as launch decisions with owners. A provider-supported manual process can be acceptable for a small campaign if its responsibilities are explicit. Do not describe a manual cleanup task as an automated retention feature. When evaluating Brand Sauce company-store solutions or another provider, request the actual supported workflow and any additional service costs in writing.
Frequently asked questions
Does a swag provider need our complete employee directory?
Not by default. Start with the approved campaign audience and the fields required for the agreed service. If an integration requests broader access, ask the technical owner to explain the scope and whether a narrower supported configuration works.
Can employees enter their own addresses?
That can reduce manual copying when the selected system supports recipient entry. It does not eliminate the need to review storage, downstream transfers, corrections and deletion. Confirm the full route, not just the form.
Should managers receive employee gift-selection reports?
Match the report to the management task. An unresolved-order list may be useful for support; a complete roster of personal addresses and apparel sizes usually answers a different question. Prefer campaign summaries where individual details are unnecessary, and review small-group reports for unintended disclosure.
What should we take away from the vendor meeting?
A field-level transfer specification, a list of participating parties, a correction workflow, a record-specific retention schedule and evidence from a test journey. Those artifacts make the data arrangement reviewable before a real employee’s details enter the program.
Primary sources checked September 29, 2026. Examples are hypothetical; no customer results, security certifications or universal legal compliance claims are implied.
