Glossary
How does the Privacy Act 2020 apply to loyalty programmes?
The Privacy Act 2020 governs how a New Zealand business collects, uses, stores and discloses personal information, which includes everything a loyalty programme holds about a customer. The practical rules are: collect only what you need, say what it is for, keep it secure, and let people see and correct it.
Running a loyalty programme means holding personal information, and that brings obligations regardless of how small the business is.
The practical shape
Collect only what you actually need. Be clear at the point of collection about what it is for. Keep it secure. Let people access and correct what you hold about them. Do not keep it longer than you need it.
The most common failure
Collecting a date of birth, a phone number and an address because the form allowed it, with no use for any of them. Every extra field is something to protect and something to explain.
Using a platform does not transfer the duty
Your provider handles a great deal of this on your behalf, but the relationship with your customer, and the obligation, remain yours.
Common questions
Does a loyalty programme make me a data controller?
It makes you an agency holding personal information, with the obligations that follow. Using a platform does not transfer those obligations away from you.
Is this legal advice?
No. This is a plain-language summary. Get advice for your own circumstances.