Loyalty scheme privacy terms

A loyalty scheme collects every purchase a member makes and uses the record to decide what to offer them, which is profiling under the law whether the business calls it that or not; it also sends marketing, shares data with the app provider and often with partners, and keeps the record long after the member last shopped. The privacy terms tell members what the scheme does with their data, state the basis for the scheme and the separate consent for the marketing, explain the tiers and the targeted offers, name the partners and say what happens when a member leaves. For £595, fixed, with delivery in five working days, I draft the privacy notice and the cookie notice for the business and set out how the consent mechanism should work.

Who this is for

Retailers, cafes and restaurants, salons, gyms, pharmacies, hospitality groups and any business in England and Wales running a points, stamps, rewards or membership scheme on a card or an app.

What matters in loyalty scheme privacy terms

What a loyalty scheme collects and why it is profiling

Being the controller, the business is required by Article 13 of the UK GDPR to tell members what the scheme collects (identity and contact details, the card or app identifier, every transaction with its items, value, time and location, app usage and location where the app collects it, redemptions and preferences) and what it does with it, and using the purchase history to build a picture of the member and target offers is profiling under Article 4(4), which the terms should describe in words a member would recognise ('we look at what you buy to choose the offers we send you') rather than hide; profiling the member did not expect is the complaint, and the terms are where the expectation is set.

The scheme terms and the privacy terms as two documents

The scheme's terms and conditions govern the contract (how points are earned and spent, the value of a point, expiry, the business's right to change the scheme, fraud), while the privacy terms govern the data, and the two should be separate documents that refer to each other, because consent to the data processing cannot be buried in the contract terms and the contract terms should not be changed by a privacy notice update; where the business's general privacy notice already covers customers, the loyalty privacy terms sit as an annex to it.

The lawful basis for the scheme and the consent for the marketing

The processing the scheme needs (recording transactions, calculating points, redeeming rewards, preventing fraud) rests on the membership contract under Article 6(1)(b) of the UK GDPR, the analysis of purchase history to personalise offers within the scheme rests on legitimate interests under Article 6(1)(f) with the interest stated and the member's right to object honoured (or on consent, where the business prefers to ask), and the marketing emails and texts that carry the offers need consent or the soft opt-in under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, which joining the scheme does not itself provide; the sign-up should keep the three apart (join the scheme; agree to personalised offers; agree to receive them by email and text), because a scheme that treats joining as consent to everything has consent to nothing.

Tiers, offers and the decisions the scheme makes about members

Allocating members to tiers, choosing which offers they see, pricing differently for members and non-members and flagging accounts for fraud are decisions based on profiling, and the terms should explain them; where a decision is taken solely by automated means and has a legal or similarly significant effect (closing an account for suspected fraud, refusing a benefit of real value), Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025 requires safeguards (the member is told, can make representations, can obtain human intervention and can contest), and the terms should say how, while ordinary offer selection falls short of that threshold and needs transparency and the right to object; special category data inferred from purchases (health conditions from pharmacy items, religion from food) should not be used for targeting unless the business has a condition under Article 9 and has said so.

Partners, the app and the data that leaves the scheme

The terms should name the categories of recipient: the app and scheme platform provider (a processor under Article 28, often hosted abroad under the safeguards Article 46 requires), the payment provider where the card is linked, the email and text platforms, the analytics providers, and any partners who fund or honour rewards (who are controllers for what the member does with them and should receive only what the partnership needs); where the scheme is run jointly with partners who share the data for their own purposes, an arrangement under Article 26 is needed and its essence stated; and the app's cookies and tracking need consent under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, which the consent guidance covers.

Leaving the scheme, retention and the points that expire

The terms should state the retention (the transaction history for the membership and for a stated period after the last activity, with dormant accounts closed on notice, the record then anonymised for the business's statistics or deleted, and payment records kept for tax law), how a member closes the account and what happens to unredeemed points (under the scheme terms), how a member objects to profiling or withdraws marketing consent without leaving the scheme, the rights the individual has (to access, correct, erase, restrict, port and object), the way to exercise them, the month the business has to respond, and the route to the Information Commissioner's Office; the Data Protection (Charges and Information) Regulations 2018 require registration with the Information Commissioner's Office where the fee applies, and the notice can give the number, and the operational note lists the sign-up changes the terms assume.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Is a loyalty scheme profiling?

It is, where the purchase history is used to choose the offers a member sees, and the terms should say so in words the member would recognise. The basis is legitimate interests or consent, with the right to object, and the marketing that carries the offers needs its own consent or the soft opt-in.

Does joining the scheme count as marketing consent?

It does not. The sign-up should separate joining, agreeing to personalised offers and agreeing to receive them by email or text, because a scheme that treats joining as consent to everything has consent to nothing.

Can we share members' data with the partners who provide rewards?

Only what the partnership needs, with the partners named in the terms as controllers for their own use, and a joint controller arrangement where the scheme is run together. The terms and the partnership agreement should say the same thing.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for an e-commerce website
• Email marketing and consent for a small business

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.