Glossary
What is data processor?
A data processor handles personal data on behalf of a controller and only under its instructions; a loyalty platform is a processor acting for the business that uses it.
The relationship is governed by a data processing agreement, which sets out what the processor may do, which sub-processors it uses, where data is stored, and what happens when the contract ends. Any loyalty vendor operating in the EU should publish both a DPA and a current sub-processor list.
What must a processor agreement cover?
What the processor may do with the data, which sub-processors it uses, where the data is stored, what security it applies, how it assists with data subject requests, and what happens at the end of the contract.
Any loyalty vendor operating in the EU should publish both a data processing agreement and a current sub-processor list. If neither is available on request, that is a meaningful signal about how the vendor treats the obligation.
Who are the sub-processors in a loyalty programme?
Typically an SMS provider, a hosting provider, and the wallet platforms themselves. Each handles some part of the customer's data on the loyalty platform's behalf, and each should be named rather than described generically.
A business remains responsible for its customers' data across that whole chain, which is why the list matters more than it first appears.
What happens to the data if the contract ends?
The processor must delete or return it on the controller's instruction. Confirm the format while your account is still active: the columns vary between platforms, and stamp balances are not always included.
See also
- Data controller: The data controller is the organisation that decides why and how personal data is processed; in a loyalty programme this is the business running the programme, not the software vendor.
- GDPR consent: GDPR consent is the freely given, specific and recorded permission a business must obtain before processing an EU customer's personal data for a loyalty programme.
Further reading
GDPR and loyalty programmes: what a small business must do
The practical compliance checklist for running a digital loyalty programme in the EU: lawful basis, consent for marketing, retention limits and data subject rights.
What your loyalty programme terms and conditions need to say
The clauses a small business's loyalty terms need, the ones that cause disputes when they are missing, and why expiry is the most important decision in the document.