Rules and ethics
Part of Why loyalty marketing rules and ethics matter for UK schemes
Writing a loyalty marketing disclosure policy without hiding the small print
A practical loyalty marketing disclosure policy guide with reusable wording, clear reward terms and UK rules for marketing, data sharing and promotions.
What to take away
- A shopper in England should see how a reward is earned, what it is worth and which conditions apply before handing over an email address.
- Your disclosure policy is an internal document telling staff and partners what must be shown and when.
- Electronic mail marketing is governed by PECR; the ICO's Direct Marketing Guidance explains how to apply the rules, including when consent is required.
- Sharing member data with a coalition needs a lawful basis under UK GDPR and the Data Protection Act 2018, and clear notice; see the UK loyalty marketing regulations guide.
- The CMA can act where scheme terms mislead members, so the policy must match what a reasonable shopper understands.
For example, a retailer running a points card in Leeds might promise "£5 back" at the till while the minimum spend appears only after sign-up. A disclosure policy exists to close that gap.
Who does this policy actually protect?
It protects members, staff and platform partners at once. Members get a fair picture before they commit, and staff get one rulebook instead of ad hoc judgement calls. Partners in a referral network get written boundaries on what can be claimed about a shared reward.
If your scheme runs through a loyalty platform such as LoyaltyLion, check that member-facing copy matches the scheme's actual earning, expiry and referral rules. Platform settings do not replace the operator's disclosure policy.
Disclosure policy vs privacy notice
Disclosure policy
- Focus
- Commercial claims
- Covers
- Limitations in marketing
- Risk if conflated
- Missed disclosures
Privacy notice
- Focus
- Personal data use
- Covers
- How data is used
- Risk if conflated
- Missed data rights
A policy is not a privacy notice. The privacy notice explains how personal data is used. The disclosure policy explains which commercial claims and limitations must appear in customer-facing material. Teams that conflate the two miss disclosures sitting outside data protection.
For the wider statutory picture, including rules beyond England, keep the UK compliance guide beside this policy as your reference point.
What must the policy cover in England?
Start with the four facts a member needs before joining: how rewards are earned, what they are worth in pounds, when they expire and what voids them. Add referral mechanics, because a bonus paid to the referrer is a commercial message.
Four facts before joining
- How rewards are earned
- What they are worth in pounds
- When they expire
- What voids them
Then set the standard for prominence. A condition buried in a PDF is not disclosed in any meaningful sense. Material conditions should appear at the point of decision, whether that is a checkout page or a referral email.
Example disclosure to adapt: “Join [scheme name] and earn [earn rate] on eligible purchases. Each [points or units] is worth £[cash value] towards [redemption]. Rewards expire [expiry rule]; we may cancel them if [specific voiding conditions]. If you refer a friend, [referrer reward] is paid when [trigger], and [friend reward] applies when [trigger].”
Put the key terms beside sign-up and complete every bracket with the scheme's actual rules. Link to the full terms nearby, but do not use that link as a substitute for disclosing material conditions at the point of decision.
The direct marketing provisions in the Digital Economy Act 2017 sit in this enforcement backdrop, and are worth reading before you sign off on how consent is captured. Individual cases need a qualified adviser.
How do you handle shared data in coalitions?
A coalition or partner referral network moves member data between organisations. The policy should name who receives what, why and for how long, and document each party's role and lawful basis under UK GDPR and the Data Protection Act 2018. It should also explain how a member leaves a shared scheme and what happens to points already held.
The ICO's Data Sharing Code of Practice is a statutory code setting out accountability steps to work through, including purpose limitation and a documented arrangement between parties. Give each step a named owner in your policy so nobody assumes another team has handled it.
Where a partner sends marketing on your behalf, the policy should require that the partner's identity and the commercial nature of the message are obvious. For reward claims in adverts and marketing emails, also check the Advertising Standards Authority's CAP Code. Our companion piece on data protection in loyalty schemes covers the lawful basis questions underneath.
How do you test the policy before launch?
Score every new scheme or campaign against all six criteria in the rubric: earn rate, expiry, conditions, referral, data sharing and withdrawal. Agree a pass mark in advance, for example 12 out of 18.
| Criterion | What good looks like | Score 0-3 |
|---|---|---|
| Earn rate | Value in pounds before sign-up | |
| Expiry | Time limit at the point of decision | |
| Conditions | Minimum spend and exclusions in plain words | |
| Referral | Referrer reward and commercial intent clear | |
| Data sharing | Recipients named in member-facing copy | |
| Withdrawal | Leaving a shared scheme in one step |
Keep the completed rubric with the campaign record. If a regulator asks how a claim was presented, a dated score sheet shows a considered process. Misleading-practices rules were set out in the Consumer Protection from Unfair Trading Regulations 2008 (CPUTR); the current UK regime is in the Digital Markets, Competition and Consumers Act 2024. Check consumer terms for fairness and transparency under the Consumer Rights Act 2015. The Competition and Markets Authority can enforce consumer-protection rules. A missed disclosure can lead to complaints, corrective action or enforcement; consequences depend on the facts, so get qualified advice.
Common questions
Does this policy apply across the UK?
The consumer and data protection duties described here apply UK-wide. Some enforcement detail and court procedure differ in Scotland and Northern Ireland, so check locally before relying on this as complete for those jurisdictions.
How often should the policy be reviewed?
At least every twelve months, and immediately after any change to reward values, expiry rules or partner data flows. A policy that lags behind the scheme creates a false record of compliance.
Can a platform provider supply the policy text?
A provider can supply a template, but the operator stays accountable for what members are told. Adapt any template to your reward mechanics before publishing it.
What happens if a disclosure is missed?
The ICO can act on direct marketing breaches and the CMA on misleading commercial practices. The usual remedy is a correction plus a process fix, but each case needs a qualified adviser.
