Define each party’s role
The business usually decides why member data is used, while the technology provider processes it under documented instructions. This division should be explained and covered by an appropriate agreement.
Collect only what the programme needs
Request information required for the card, rewards and selected communications. Keep programme membership separate from consent to marketing messages.
- Clear information at sign-up
- Recorded consent where required
- Defined retention periods
- Access and deletion process
Design for member rights
Members should be able to understand, correct and request deletion of their data. Document suppliers, security measures and incident procedures as well. Seek legal validation before launch.