# Loyalty programmes and the Privacy Act 2020

Collect only what you need, say what it is for at the point you collect it, keep it secure, and let people see and correct it. Joining a loyalty programme is not by itself consent to receive marketing, and using a platform does not transfer your obligations to that platform.

Source: https://fidella.app/guides/loyalty-and-the-privacy-act
Last reviewed: 2026-08-31

---

Running a loyalty programme means holding personal information about your
customers. That brings obligations, and they apply to a two-person cafe as much
as to a chain.

This is orientation, not advice.

## Collect only what you need

The most common mistake is collecting a date of birth, a phone number and an
address just because the form had space for them. Then never using any of
it.

Every extra field is something you have to protect, explain, and eventually
delete. If you cannot say what you would do with it, do not ask for it.

## Say what it is for, when you ask

At the point of collection, not buried in a policy nobody opens. "We use this to
track your stamps and let you know when a reward is ready" is a complete and
honest purpose statement.

## Joining is not consent to marketing

This is the distinction that gets businesses into trouble.

A customer who scanned a code to collect stamps has agreed to a loyalty
programme. Treating that as permission to send promotional email is a stretch
that regulators do not accept. Ask separately, and make it a real choice.

## Make withdrawal as easy as joining

Difficult unsubscribes generate complaints, are usually non-compliant, and
concentrate the people who want out into the metrics you are using to judge
success.

## Let people see and correct what you hold

People can ask what you hold about them and ask you to correct it. Know how you
would answer that before somebody asks.

## Do not keep it forever

Personal information you no longer need should not still be sitting there.
Decide a retention period rather than defaulting to permanent.

## The upside worth naming

Handled properly, this is one of the few ways a small hospitality business
builds a direct relationship with customers that does not depend on somebody
else's algorithm. That is worth protecting carefully rather than treating as a
compliance chore.