Loyalty programmes and the Privacy Act 2020

Running a loyalty programme means holding personal information about your customers. That brings obligations, and they apply to a two-person cafe as much as to a chain.

This is orientation, not advice.

Collect only what you need

The most common mistake is collecting a date of birth, a phone number and an address just because the form had space for them. Then never using any of it.

Every extra field is something you have to protect, explain, and eventually delete. If you cannot say what you would do with it, do not ask for it.

Say what it is for, when you ask

At the point of collection, not buried in a policy nobody opens. “We use this to track your stamps and let you know when a reward is ready” is a complete and honest purpose statement.

Joining is not consent to marketing

This is the distinction that gets businesses into trouble.

A customer who scanned a code to collect stamps has agreed to a loyalty programme. Treating that as permission to send promotional email is a stretch that regulators do not accept. Ask separately, and make it a real choice.

Make withdrawal as easy as joining

Difficult unsubscribes generate complaints, are usually non-compliant, and concentrate the people who want out into the metrics you are using to judge success.

Let people see and correct what you hold

People can ask what you hold about them and ask you to correct it. Know how you would answer that before somebody asks.

Do not keep it forever

Personal information you no longer need should not still be sitting there. Decide a retention period rather than defaulting to permanent.

The upside worth naming

Handled properly, this is one of the few ways a small hospitality business builds a direct relationship with customers that does not depend on somebody else’s algorithm. That is worth protecting carefully rather than treating as a compliance chore.