Reviewing a loyalty scheme provider's terms

A loyalty scheme provider runs the points, the app and the member database for a retailer, and its terms decide whether the members and their data belong to the retailer or to the provider, who is responsible for the marketing consents, who carries the liability for unredeemed points, and what the retailer is left with if it changes provider. The provider's terms answer each of those, and the answers decide what the retailer owns. I review the terms from the retailer's side and return them marked up with a written explanation of the changes and which ones a provider will accept, for a fixed fee of £495 in three working days.

Who this is for

Retailers, hospitality groups, salons, gyms and online businesses in England and Wales engaging a provider to run a loyalty programme, a rewards app, a stamp card scheme, a coalition programme or a points and prizes scheme, and want to own the customer relationship it creates. The retailer and the provider are businesses; the members are consumers whose data and consents are the scheme's whole value.

What to look for in a loyalty scheme provider's terms

Who owns the members and their data

The member database is the asset the scheme builds, and the terms should say that member data belongs to the retailer, that the provider processes it as the retailer's processor under Article 28 of the UK GDPR and the Data Protection Act 2018, and that the provider may not use it for its own purposes, for other retailers or for a coalition programme without the retailer's agreement. The review checks whether the provider's terms make it a controller in its own right, which lets it keep the members when the retailer leaves, and asks for the data to be exportable in a usable format during the term and on exit.

Consents, marketing and profiling

The scheme sends offers by email, SMS and push notification, which require consent or the soft opt-in under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and it profiles members to target offers, which must be explained in the retailer's privacy information and, where decisions are solely automated with significant effects, is restricted by Article 22 of the UK GDPR. The review checks who obtains and records consent, in whose name, whether the provider's own marketing to members is excluded, and that the provider's app and sign-up flow give the privacy information the retailer is responsible for.

Points liability, expiry and the value you are promising

Points and rewards are the retailer's liability to members, and the terms decide how they are valued, when they expire and who carries the cost of redemption. The review checks the member terms the provider drafts for the retailer to publish, which must be fair under the Consumer Rights Act 2015 and cannot let the retailer withdraw or devalue points without notice or reason without risking the grey list in Schedule 2, and asks for the provider's terms to record how points are accounted for, how expiry is notified to members, and who bears the cost of rewards the provider funds or sources.

Prize draws, competitions and promotions

Schemes run prize draws, competitions and instant wins, and a promotion with a prize that requires payment to enter and is decided by chance is a lottery under the Gambling Act 2005 unless it falls within a free-entry or skill exemption. The review checks that the provider's promotional mechanics stay within the exemptions, that the promotion terms comply with the CAP Code and the Digital Markets, Competition and Consumers Act 2024 rules on misleading practices, and that responsibility for a promotion's compliance sits with the party that designs it.

Points as payment, vouchers and e-money

Where points can be converted into a stored value that members spend across retailers, the scheme may involve the issue of electronic money regulated under the Electronic Money Regulations 2011, unless the limited network exclusion applies. The review checks the mechanics of redemption, whether the provider or the retailer would be the issuer, and whether the scheme has been designed to stay within the exclusion, so that the retailer is not operating a regulated payment product without knowing it.

Fees, exclusivity, term and exit with your members

The provider charges a set-up fee, a monthly fee per location or per member, transaction fees and charges for messages, and its terms will run for a minimum term with exclusivity. The review checks the fee changes and the term, asks for exclusivity to be limited to the scheme itself, and concentrates on exit: export of the member database with the consents and their dates, transfer of the points balances, a run-off period during which the app continues, the provider's deletion of the data afterwards, and the provider's obligation not to contact the members. The Late Payment of Commercial Debts (Interest) Act 1998 applies to the provider's fees.

What it costs

Standard review, £495. Marked-up document and a written explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the contract review page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• Your own contract returned with my amendments as tracked changes, plus a clean version with every change accepted, ready to send to the other side
• Comments in the document where a point needs explaining
• A written explanation of what I have changed and why, by email or as an attachment if it is lengthy, marking the points I would hold firm on and the ones that are negotiable
• A view on what is normal market practice and what is the other side pushing their luck
• One round of follow-up questions by email, included

What is not included

• Negotiating directly with the other side, which I quote separately once I know who is on the other side. Where the other side is willing to share a live document, I can work in that document directly
• Drafting a replacement contract from scratch
• Advice on the law of any jurisdiction other than England and Wales
• Tax, accounting or regulatory advice
• Disputes about a contract that is already signed

Questions I am often asked

If we leave the provider, do we keep our members?

Only if the terms make the member data yours and give you an export right with the consents attached. Provider terms that make the provider a controller in its own right let it keep the members. The review checks the terms and asks for ownership, export and a prohibition on the provider contacting members after exit.

Who is responsible for the marketing consents?

You are, as the controller in whose name the marketing is sent, even though the provider collects and records the consents. The review checks that the sign-up flow obtains consent in your name and records it, and that the provider is obliged to give you the consent records.

Can we cancel members' points?

Only in accordance with the member terms, which must be fair, and a right to withdraw or devalue points without notice is unlikely to be enforceable. The review checks the member terms the provider has drafted and asks for expiry and changes to be on notice with reasons.

Related guidance and services

• Contract review, £495, the service this page describes
• Data protection agreements and privacy terms, £795
• Terms and conditions drafting, £995
• Reviewing a marketing agency contract before you sign
• Reviewing an EPOS or till system contract

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.