The Payment Terminal as a Join Key: Why Card Tokens Are the Secret to Unified Customer Data

Linking in-store transactions to online profiles needs one value that exists in both places. For card payments, the strongest candidate is an approved, non-payment reference derived from the card, which is why retailers look at the card token as a join key. On its own, that token recognises a returning card, not a person; it becomes part of a unified customer profile once the customer enrols with an identifier such as a phone number or email address, and your customer data platform (CDP) matches the two.

Key takeaways

• The card is the identifier most in-store customers already carry. Cards accounted for 64% of all UK payments in 2025, according to UK Finance.
• A card token is a join key for a credential, not a person. Tokens can be restricted to one merchant, device or payment scenario, and wallets use device-specific numbers.
• One consented enrolment completes the join. A phone number or email address given once links the card reference to an online profile.
• Tokenisation reduces exposure, not obligations. PCI DSS still applies wherever account data is handled, and a linkable token is personal data under UK GDPR.

How we put this article together

This article draws on guidance from EMVCo, the PCI Security Standards Council and the Information Commissioner's Office (ICO), the developer documentation of three customer data platforms, and Zeal's own product documentation. We checked every source on 10 October 2026. Zeal provides value-added services that recognise customers on payment terminals, so we have a commercial interest in this approach, and where we describe Zeal we describe what our own documentation says. Nothing here is legal advice.

Why linking in-store transactions to online profiles is hard

Online, every visit leaves identifiers behind: a login, a cookie, an email click. In store, the payment flow carries what the acquirer needs to authorise and settle the sale, not an identity your CRM or CDP can use. So the same customer can be well known on your website and anonymous at the counter.

The opportunity is that most in-store customers already present the same thing every time they pay. UK Finance reports that card payments accounted for 64% of all UK payments in 2025, debit cards alone for 54%, and contactless methods for 39%. The Bank of England puts cash at 8% of payments by volume in 2025, against 58% in 2009.

The traditional bridges, such as a loyalty card, an app scan, an email address at checkout or a receipt upload, all ask the customer to do something extra. As Zeal's own loyalty page puts it, "Most schemes ask the customer to do something extra at the busiest moment of the transaction."

What makes a good join key?

A join key is a value that appears in two datasets and lets you match records between them. For in-store and online customer data, a good join key is present at both ends, stable over time, specific enough not to merge different people, lawful to use and safe to store. Table 1 compares the usual candidates.

Table 1. Candidate join keys for in-store and online data

Table 1 is our own analysis of the sources cited in this article.

Using the card token as a join key

In Zeal's reference architecture, the join happens in five steps, while the payment application keeps control of the payment throughout:

1. The customer pays as usual. The approved payment application keeps control of card reading, authorisation and payment security.
2. A non-payment reference is made available. The approved integration provides a reference for the eligible card, not the card number. Zeal's privacy policy describes a tokenised payment card identifier rather than a full card number.
3. The reference is checked against profiles. A separate value-added services layer looks for a linked loyalty or customer profile.
4. New customers can join once. With Zeal Loyalty Link, an unregistered customer can enter a phone number on the terminal, receive an SMS enrolment link and be recognised on later eligible visits.
5. Later visits flow to the profile. Each identified visit can then be sent to a CRM or CDP; Zeal's Segment connector page describes each identified transaction being sent "as a profile update and an in-store event".

In identity-resolution terms, the card reference is the in-store key and the phone number or email address is the bridge to online records. Zeal's architecture documentation is careful about what a match means: "A match can indicate that an eligible credential has returned. It does not necessarily identify a named person, and wallet re-provisioning or credential changes may affect continuity."

Where a card token join breaks

Payment tokens are designed for security, not for marketing, so a join built on them has edges you should plan for:

• Tokens are domain-restricted. EMVCo says an EMV Payment Token "should not be usable beyond a specific merchant, device or payment scenario". The same card can therefore appear under different references in different contexts.
• Wallets add their own numbers. Apple explains that Apple Pay creates a "device-specific Device Account Number", so a phone and the plastic card behind it may not share a reference.
• A Payment Account Reference can help. EMVCo defines PAR as "a way to link transactions that use EMV Payment Tokens with the PAN for which the Payment Tokens have been issued", and lists "some PAN-based loyalty systems" among the services it supports. Whether you receive one depends on your payment partners.
• Tokens are not always in use. The PCI Security Standards Council's FAQ 1326 notes that accepting chip or mobile payments "is not an indication that Payment Tokens are necessarily in use".
• People share and replace cards. Reissued cards, second cards and shared cards all split or merge identities.

The practical response is to let one profile hold several card references, to treat a match as a returning credential rather than a verified person, and to give customers a way to correct or unlink a card.

Connecting payment terminals to customer data platforms

A CDP's job is to resolve identities across sources, which is why it is the natural place to land in-store events. Each vendor describes the same idea in its own words.

Table 2. How three CDPs describe identity resolution

Source: each vendor's documentation, checked 10 October 2026. Treasure Data became Treasure AI on 20 April 2026.

For a card-present event to merge with an online profile, it needs to arrive carrying an identifier the CDP already knows, such as the profile ID created at enrolment or the phone number the customer gave. Amperity's documentation makes the same point about loyalty: "Sometimes what is known is a durable identifier, such as a loyalty account ID." Zeal publishes connector pages for 16 CRM and CDP destinations, and says each connection is activated on request.

What a unified customer profile changes in retail payments

Once in-store visits land on the same profile as online behaviour, a retailer can act on both. Zeal's Salesforce connector page lists four uses: "Trigger a journey after a first in-store visit, suppress a discount email to someone who bought in store yesterday, measure the in-store effect of an online campaign, and build lapsed-customer segments that include the shop floor."

Branded apps can carry the same identity across channels. In September 2024, for example, we launched Dara's Ice Cream app with delivery, pickup and pay in-store, so rewards follow the customer whether they order through the app or in person.

Omnichannel payment data integration for PSPs

For payment providers, omnichannel payment data integration is a value-added service on the terminal estate they already run. A McKinsey survey found that 70% of the small businesses it surveyed use at least one value-added service from their payments provider. PSPs deploy the SDK through their terminal management systems, and the payment application, routing and settlement stay with the existing payment partners.

The compliance boundary: PCI DSS, tokenisation and UK GDPR

Joining card-present and online data touches two regimes at once, and neither treats a token as a free pass.

• PCI DSS scope. PCI SSC FAQ 1326 says an EMV Payment Token used under the EMVCo specification "is not considered Account Data" for merchants and acquirers. It also says "PCI DSS still applies anywhere Account Data is stored, processed, or transmitted", and that connected systems remain in scope. In Zeal's reference architecture, the recognition flow excludes the PIN, CVV, full PAN, payment cryptograms and payment keys, and tokenisation does not automatically remove an implementation from PCI DSS scope.
• Personal data. The ICO's pseudonymisation guidance says pseudonymised data "is personal data in the hands of someone who holds the additional information", and describes tokenisation as replacing identifiers with randomly generated tokens. Its guidance on identifiers, currently under review after the Data (Use and Access) Act, adds: "If you can distinguish an individual from other individuals, then that person is 'identified' or is 'identifiable'."
• A DPIA. The ICO's DPIA guidance requires a data protection impact assessment if you plan to "match data or combine datasets from different sources", which is exactly what a join key does.
• Lawful basis and marketing. Choose and document a lawful basis for each purpose under the ICO's guide to lawful basis, and remember that marketing by email or text normally needs consent under PECR.

Before you build, ask your provider which reference you will receive, its token domain, how wallets behave, which systems sit inside PCI DSS scope, and who answers access and deletion requests.

What we have learned about joining in-store and online data since 2019

I co-founded Zeal with Bellal Mohamed in 2019, and I have spent seven years on one question: how to make the payment terminal useful for more than taking payment without touching the payment itself. We built the core technology in 2020 and 2021, when Visa recognised Zeal as an up-and-coming solution. We then spent two years, 2022 and 2023, testing it in real-world pilots with Ingenico as a strategic partner, and merchant feedback from those pilots led to key improvements. Since 2024 we have added partnerships with Castles and other industry partners.

In my experience, three practices decide whether a join key holds up:

• We confirm the terminal first. In my experience, supported models vary by payment provider, so we check the exact model before anything is switched on.
• We deploy through the payment provider. Zeal reaches terminals through our partners' terminal management systems; merchants install nothing.
• We agree the data before deployment. Integration and customer-data requirements are settled with each partner up front.

The results so far: more than 30,000 merchants activated on Zeal across payment providers, seven live UK payment partners (Adyen, DNA Payments, Elavon, Lloyds Cardnet, NMI, Viva Wallet and Worldpay) and 4 million payment terminals in our partners' signed activation pipeline. We have raised $14 million in total, and the team won Team of the Year at the UK FinTech Awards 2026. Table 1 is our own analysis; Table 2 quotes each vendor's documentation.

Frequently asked questions

Is a card token the same online and in store?

Usually not. EMV Payment Tokens are restricted to a merchant, device or payment scenario, and wallets such as Apple Pay use a device-specific Device Account Number. A Payment Account Reference can link tokens to the underlying card where your payment partners provide one, so ask what is available before you design the join.

Can you link in-store transactions to online profiles without an app?

Yes, if the customer enrols once through another route. With Zeal Loyalty Link, an unregistered customer can enter a phone number on the payment terminal and follow an SMS enrolment link; later eligible card payments can then be recognised and sent to the CDP against the same profile.

Is a payment token personal data under UK GDPR?

It can be. The ICO says pseudonymised data is personal data in the hands of someone who holds the additional information, so a token linked to a loyalty profile or CRM record should be treated as personal data, with a lawful basis, notices and retention rules.

Does tokenisation take a recognition system out of PCI DSS scope?

Not automatically. PCI SSC FAQ 1326 says an EMV Payment Token is not account data for merchants and acquirers, but PCI DSS still applies anywhere account data is stored, processed or transmitted, including connected systems. Scope has to be assessed for the actual implementation.

What is omnichannel payment data integration?

It means bringing card-present payment events into the same customer records as online and app activity, usually through a customer data platform. The card reference identifies the in-store side, and enrolment plus identity resolution connect it to the online profile.

Sources

• UK Finance, UK Payment Markets 2026 summary (19 August 2026).
• Bank of England, The promise to pay: what backs banknotes? (17 September 2026).
• EMVCo, EMV Payment Tokenisation.
• PCI Security Standards Council, FAQ 1326: How does PCI DSS apply to EMVCo Payment Tokens? (May 2015).
• Apple, Apple Pay security and privacy overview (28 April 2026).
• Information Commissioner's Office, Pseudonymisation, What are identifiers and related factors?, Data protection impact assessments, A guide to lawful basis (updated 2 April 2026) and PECR electronic mail marketing rules.
• Twilio Segment, Identity Resolution Overview; Amperity, Identity resolution summary; Treasure AI, ID Unification and rebrand announcement (20 April 2026).
• McKinsey and Company, As ISVs disrupt payments, can merchant acquirers stay relevant? (22 September 2022).

About the author

Omar Ebeid is Co-founder and CEO of Zeal, which he founded with Bellal Mohamed in 2019. He holds an MSc in Entrepreneurship from the University of Bath and won the Vice-Chancellor's Award at the University of Surrey. Under his leadership Zeal won Team of the Year at the UK FinTech Awards 2026 and Platinum at the Juniper Research Future Digital Awards 2023, and has raised $14 million in total, including a $10 million pre-Series A round announced on 9 September 2026. Connect with Omar on LinkedIn.