A loyalty program collects personal data — at minimum name, email or phone, and purchase patterns. Fully legal, but it requires the foundation to be in order.
The five minimum requirements
- Clear consent text in the signup form — the customer must actively opt in.
- Privacy policy explaining what you store and for how long.
- Customer ability to download or delete their data — Loyaltey has this built in.
- Data Processing Agreement (DPA) with Loyaltey — we have a standard one available.
- Data deletion after 36 months of inactivity unless the customer renews.