Loyalty software vendor due diligence without guesswork

What to take away

Which data protection questions must a vendor answer?

Start with roles. Under UK GDPR the retailer is normally the controller and the platform a processor, so the contract needs Article 28 terms. Ask where member records are stored, which sub-processors touch them, and how deletion works when the contract ends.

Request the relevant Record of Processing Activities and latest penetration test summary, and ask whether the vendor holds current ISO/IEC 27001 certification or can provide a SOC 2 report; check the scope, date and exclusions. Ask for breach history and the incident-response clause: a processor must notify the controller without undue delay, while the controller must notify the ICO without undue delay and, where feasible, within 72 hours of awareness if the breach is likely to risk people's rights and freedoms. Confirm who reports through the ICO's personal data breach reporting service and how the vendor will support that process.

Check international transfers. Where a restricted transfer is involved, ask whether it relies on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to EU Standard Contractual Clauses (SCCs), and request the relevant assessment and signed terms.

Retention schedules matter as much as storage location. Ask how long behavioural data is held after a member stops transacting, and how quickly the platform answers access or erasure requests.

If you are still mapping the market, our loyalty marketing tools and supplier guide compares how platform categories differ on data handling.

For a concrete shortlist, a UK buyer could assess loyalty software providers such as Eagle Eye, LoyaltyLion, Antavo, Yotpo and Voucherify. These are examples, not recommendations; verify each product's current fit and contracting entity. Send each the same evidence schedule: ask for its data locations and sub-processors, transfer safeguards, Article 28 terms, PECR controls, security evidence, breach process and data-exit arrangements. Request supporting documents or a clear ‘not held/not applicable’ response, then score the evidence rather than the sales claims.

How do communications rules affect the shortlist?

Direct marketing by email and text, plus marketing calls, is regulated under the Privacy and Electronic Communications Regulations 2003 (PECR), alongside UK GDPR where personal data is used. The Information Commissioner's Office (ICO) is the regulator and publishes relevant guidance; the Communications Act 2003 is not a substitute for checking PECR. Any vendor sending campaign messages on your behalf must show how consent or another applicable PECR route is captured, stored and withdrawn.

Ask to see a sample consent record from a real campaign. If the vendor cannot show timestamps and source, the audit trail is guesswork. Where soft opt-in is claimed, the vendor should show how the exemption applies to existing customers rather than to a bought list.

For referral mechanics, confirm how a referred friend's details are handled before that friend opts in. Referral data is still personal data.

What should the scoring rubric contain?

Score each vendor out of five on the criteria below, weight the categories, and record the evidence behind every mark. A worked example: a team paying £2,500 a month might weight data protection at 30 per cent, because a failed audit costs more than the licence.

Keep the evidence file with the scores; it shortens the conversation when finance asks why a vendor won.

Which commercial terms cause trouble later?

Watch auto-renewal clauses, minimum spend commitments and data extraction fees. Ask what happens to member records if you leave, and how long the vendor retains them afterwards.

Confirm who owns scheme configuration and custom code. Ownership should sit with you. Check the vendor's filed accounts and any recent change of control before you sign a three-year term.

How do you check the vendor's market position?

Ask for two references of similar size and sector, then call them without the vendor on the line. Ask what broke during implementation, how quickly it was fixed, and what change requests cost after go-live.

Read the vendor's own documentation on integration limits rather than relying on sales claims. For planning, the DMA's customer engagement key trends briefing covers where engagement is heading.

What does implementation due diligence cover?

Ask for the implementation plan with named owners and dates. Confirm who configures earn and burn rules, who tests them, and what acceptance looks like.

Sandbox access should be available before contract signature, so ask early. Acceptance criteria should include a migration rehearsal on anonymised data and sign-off from the team who will run the scheme day to day.

Our walkthrough of loyalty marketing tool implementation covers the stages where projects usually slip, including data migration and staff training.

Set acceptance criteria against real scheme journeys: enrolment, earning and redeeming rewards, referral attribution, consent withdrawal and data export. Ask the vendor to demonstrate each in the sandbox and record pass or fail before go-live.

Common questions

How long should due diligence take?

Allow four to six weeks for a mid-market scheme: two weeks gathering evidence, two weeks on scoring and references, and the rest on contract review.

Do we need a Data Protection Impact Assessment?

Often yes, particularly where profiling or large-scale member tracking is involved. Your data protection lead decides, and the vendor should supply what the assessment needs.

What disqualifies a vendor immediately?

Refusal to provide Article 28 terms, no named sub-processors, or no documented exit route for member data. Any of these makes the contract unworkable in England.