Loyalty software: questions to ask suppliers

What to take away

The Data (Use and Access) Act 2025 changed how marketing data can be reused, so supplier due diligence now starts with data handling, not features.
Most platforms price on active members or monthly tracked contacts, so model both a quiet month and a peak month.
Referral attribution is the weakest part of many loyalty suites, so ask for a live demonstration before you shortlist.
Get each supplier's ICO direct marketing position in writing before you sign.

The data-handling questions to ask

The Data (Use and Access) Act 2025 sits alongside UK GDPR; it does not replace it. For loyalty programmes, ask how the platform supports your organisation's data-protection obligations, including recording the purpose, source and date of consent where you rely on consent. The platform's records can support your process, but do not transfer your responsibilities as controller.

Ask each supplier what lawful basis its platform can record for a contact, how consent is captured where you rely on it, and how a withdrawal is processed. Ask how changes to a contact's preferences are recorded and applied to marketing activity.

Ask for a walkthrough of the preference centre. Check how a change of preference flows into segments and campaigns, and whether the supplier can show you an audit trail of the change.

The criteria that separate suppliers

Five criteria for scoring suppliers

Consent and data handling
Referral attribution
Pricing basis
Integration with ecommerce and CRM
Export terms

Weight each criterion before you see a demonstration, so the last vendor does not set your priorities by default. Two reviewers scoring separately will surface disagreements early.

Questions to put to every supplier

Which data will you process, and will you act as our processor, controller or both for each activity?
What lawful basis can the platform record, and how does it handle consent records, withdrawals and preference-centre changes?
If you act as our processor, will the contract include the UK GDPR Article 28 terms, and how are sub-processors and changes to them disclosed?
Where will our data be hosted, how will you notify us of a personal data breach, and what support do you provide for a Data Protection Impact Assessment (DPIA)?
Are you registered with the ICO or exempt, and can you provide details we can check on the ICO register?
Do you hold ISO 27001 certification or provide a SOC 2 report, and what systems and services does that assurance cover?
Can we export member and referral data as CSV or through an API, is export self-service or on request, and are there export or exit fees?
What counts as a billable member or contact, do inactive records count, and how do charges change at tier boundaries or during peak periods?
How are reward value, funding and payout handled; when are rewards held or released, what triggers a clawback, and how is VAT on rewards treated?
Is attribution based on cookies, server-side tracking or both; what lookback window applies, and how do you handle cross-device referrals and deduplication?
How do you detect self-referrals, duplicate accounts and other referral abuse, and do you use device fingerprinting?
Which integrations and internal tasks are needed for implementation, migration and testing, and what milestones, support and training are included?
What are the contract term, renewal and termination conditions, and what happens to our data and reward liabilities when the contract ends?

The ICO's Direct marketing guidance is a useful reference for the controls you need to evidence. Ask for a sample export and a demonstration of CSV and API access, including whether extraction is self-service or on request and whether any format, frequency or exit fees apply.

If you want the wider selection process before scoring vendors, our loyalty marketing tools and supplier guide covers scoping, budgeting and contracting in order.

A worked comparison table

The table below uses hypothetical platform archetypes and illustrative figures, not named suppliers or market price benchmarks. Use it to identify pricing models to question, not to estimate what a real supplier will charge.

Worked supplier comparison table

Platform A (points suite)

Pricing basis: Active members
Cost at 5,000 members: £450 a month
Referral attribution: Cookie-based
Consent records: Standard
Data export: CSV on request
Typical setup time: 4 to 6 weeks

Platform B (referral-first)

Pricing basis: Tracked referrals
Cost at 5,000 members: £380 a month
Referral attribution: Server-side, member-linked
Consent records: Standard
Data export: Self-service
Typical setup time: 2 to 3 weeks

Platform C (composable)

Pricing basis: Monthly tracked contacts
Cost at 5,000 members: £520 a month
Referral attribution: Add-on module
Consent records: Configurable per purpose
Data export: API and CSV
Typical setup time: 8 to 12 weeks

Platform A (points suite)

Pricing basis: Active members
Example cost at 5,000 members: £450 a month
Referral attribution: Basic, cookie-based
Consent records: Standard
Data export: CSV on request
Typical setup time: 4 to 6 weeks

Platform B (referral-first)

Pricing basis: Tracked referrals
Example cost at 5,000 members: £380 a month
Referral attribution: Server-side, member-linked
Consent records: Standard
Data export: Self-service
Typical setup time: 2 to 3 weeks

Platform C (composable)

Pricing basis: Monthly tracked contacts
Example cost at 5,000 members: £520 a month
Referral attribution: Requires add-on module
Consent records: Configurable per purpose
Data export: API and CSV
Typical setup time: 8 to 12 weeks

Use the table only to identify the differences you need to resolve in a like-for-like view. If one supplier quotes per member and another per contact, ask each vendor to re-quote against your own list size, with the tier boundary stated.

Where referral tools differ from points suites

Points suites treat referral as one campaign type inside a rewards engine. Referral-first tools treat the member link as the core object, so attribution, fraud checks and reward release sit around it. If referral drives your acquisition, the second model usually fits better.

What to ask about pricing mechanics

Ask whether inactive members count towards the fee, how a contact is defined, what happens when you cross a tier, and whether add-ons or usage charges apply. Ask how reward value is funded and paid, when rewards are held or released, what triggers clawbacks, and how VAT on rewards is treated. Get answers in writing against your own volumes and programme rules.

Implementation risk you should price in

Setup is where comparisons quietly break. Ask what internal development, integration, migration and testing work is required, which tasks the supplier owns, and what support and training are included. Our breakdown of loyalty marketing tool implementation covers the migration and testing stages that tend to overrun.

Migration is the step that catches teams out. Historic points balances, expired vouchers and duplicate member records all need a decision before cutover.

Ask the supplier to set out the implementation milestones, the work required from your marketing and technical teams, and the assumptions behind its delivery plan. Check that your team has capacity for those tasks before agreeing a cutover date.

Common questions

Should I compare suppliers on features or on data handling first?

Data handling first. A feature gap can be worked around, but weak consent records create a problem you cannot fix from your side.

How many suppliers should reach the shortlist?

Three is workable for most teams. Two makes price comparison weak, and five or more stretches the evaluation without adding much.

Does a cheaper referral tool always cost less overall?

No. A lower licence fee can be offset by add-on modules, integration work or manual reporting. Compare total cost over 12 months, not the headline monthly price.

What should the contract say about data export?

It should name the file format, the frequency and the notice period, and confirm there is no exit fee for taking member data with you. Settle this before signature, not at renewal.