How to Collect Customer Contacts the Right Way (With Their Consent)

The short answer

Ask before you save anyone's number or email, say clearly what you'll use it for, and let them say no just as easily as yes. A list built that way is smaller than a bought or scraped one — and it actually works, because every name on it chose to be there.

Why a bought list is worthless, not just risky

Somewhere in every city there's someone selling "10,000 verified customer numbers." It sounds like a shortcut. It isn't. Nobody on that list is expecting to hear from you, so your message reads as a stranger's message — which is exactly what it is. Open rates collapse, WhatsApp numbers get reported, and the time you spent sending it is gone. A list of 50 real customers who said yes is worth more than a list of 5,000 strangers, because the 50 already trust you enough to have handed over their number.

And there's a legal side too. Morocco's personal-data law, Law 09-08, and its regulator, the CNDP (the national commission that oversees how personal data is collected and used), exist precisely because a phone number or an email address is personal information — not a free resource to trade. This is general guidance, not legal advice, and the practical version any small business needs is simple: if you didn't get a clear yes from the person, you don't have permission to hold their information for marketing. If you want the specifics for your situation, cndp.ma is the place to check, not a forwarded WhatsApp message from someone selling a list.

The one habit that fixes almost everything: ask, and say why

Consent isn't a form to be scary about — it's one sentence, said out loud or printed on a sign: "Can I add you to our list? We only send [new arrivals / appointment reminders / weekly specials], and you can leave any time you like." That's it. Say what they're signing up for, and say that leaving is easy. People say yes to that far more often than you'd expect, because it removes the fear that they're about to be spammed forever.

Collecting contacts from walk-ins

Imagine a small hair salon that wants to text clients when a slot opens up. A sign-up sheet at the register works, but a QR code on a small table stand works better — the client scans it, fills a 15-second form on their own phone, and nobody has to read anyone's handwriting. Whichever method you use, the request should carry three things:

• What you'll actually send them (be specific — "appointment reminders," not "updates")
• How often, roughly (once a week, not every day)
• How to stop it (reply STOP, or just tell you next time they're in)

A small reason to sign up — first pick of a new time slot, a birthday reminder, a loyalty stamp — raises how many people say yes, without needing to be a discount. Whatever incentive you choose is yours to decide; just keep the ask and the opt-out equally visible.

Collecting contacts from DMs and comments

This is where most businesses accidentally cross a line without meaning to. Someone messages your Instagram asking "is this in stock?" — you now have their handle and enough to reply. That is a normal service conversation, and answering it needs no special consent. But moving that same person onto your broadcast list for future promotions is a different action, and it deserves its own, separate yes: "Want me to let you know when we restock? I'll only message for that." If they say yes, that's consent for the list. If they just wanted their question answered, leave them there — replying to one message doesn't sign anyone up for the next fifty.

What to actually record

Field	Why it matters
Name	So a message doesn't read like it was sent to a number, not a person
Phone or email	Whichever channel they actually said yes on — don't assume the other one is fair game too
Language	Arabic, French, or English — guessing wrong reads as not paying attention
Date and source of consent	Proof of when and where they agreed, in case you're ever asked
Opt-out status	The moment someone says stop, this field is what keeps them off the next send

Where to put it so it's actually useful

A spreadsheet with those five columns is a completely legitimate customer list for a small business — it costs nothing and it works. The only rule is to keep it current: update it the same day someone opts in or out, not "whenever there's time," because a list that's three months out of date is quietly rebuilding the same trust problem as a bought one. For a business juggling walk-ins, DMs, and a growing plan calendar all at once, the QIYADA and SULTA plans bundle a CRM with AI lead tracking that timestamps and organizes this automatically as messages come in — worth a look once a spreadsheet starts feeling like a second job. See what's on each plan on the pricing page.

Bought list vs. earned list

	Bought or scraped list	List built on consent
Who's on it	Strangers to your business	People who already chose you
Expected open rate	Very low	Meaningfully higher
Risk of complaints/reports	High	Low — they asked to be there
Legal footing	Shaky at best	Solid, with proof of consent
Grows over time	No — it's a fixed, ageing file	Yes — every walk-in and DM adds to it

Your checklist

• A short, spoken or printed ask that says what you'll send and how often
• A visible, easy way to opt out on every message
• A record of name, contact, language, and consent date — for every person on the list
• Replying to a DM does not equal adding someone to a broadcast list — ask separately
• The list gets updated the same day someone opts in or out, not "eventually"

FAQ

Does handing me a business card count as consent to message them later?

No. A business card is an introduction, not permission to add someone to a marketing list. If you want to message them again, ask — even a quick "mind if I text you when we get new stock in?" is enough.

Do I need consent just to answer someone who messaged me first?

No — replying to a question someone sent you is an ordinary conversation, not marketing. Consent only becomes necessary the moment you want to add them to a list for future messages they didn't ask for.

What's the minimum I should keep as proof of consent?

The date, the channel (in person, DM, sign-up form), and roughly what they agreed to receive. A spreadsheet row is enough for a small business — you don't need anything fancier than that.

Do this now

Pick one channel — the one where you get the most walk-ins or DMs — and write the one sentence you'll say or print this week: what you'll send, how often, and how to stop. That single sentence is the whole foundation of a list that actually works.

If a spreadsheet is starting to feel like a full-time job, the QIYADA and SULTA plans add a CRM with AI lead tracking that keeps this organized as it grows. Get in touch and we'll take a look at what you're already collecting before suggesting anything new.