Compliance and security.

Reward Loyalty includes controls that can support a GDPR program, including configurable cookie consent, member email preferences, data export, business-level deletion, account deletion, scoped partner data, activity logs, and security monitoring.

The operating organization still determines lawful purpose, roles, retention, contracts, subprocessors, configuration, staff practice, and security. Read the GDPR operating guide. This answer is not legal advice.

The member privacy area supports a data download, deletion of the member’s data with one business, and deletion of the complete member account. Each action has the documented scope and confirmation flow.

Review member privacy and data controls and document how the operator handles backups, external systems, retention, and disputes.

The operator secures the server, domain, mail, backups, administrator access, secrets, updates, integrations, logging, monitoring, and incident response. Reward Loyalty provides application controls and health information; it does not operate the buyer’s infrastructure.

Use the security monitoring guide as one part of the operating process.