Retail and consumer brands

Brands and retailers running apps, loyalty programmes and customer databases.

In short

Retailers need separate customer consent for marketing, and agreements with every vendor that runs it.

Retailers and consumer brands collect customer data through apps, websites, loyalty programmes and in-store systems. Under the DPDP Act, customers need a clear notice for each purpose.

Most brands rely on several vendors to run their marketing, including CRM platforms, analytics tools and agencies. Each vendor that processes customer data needs an agreement that limits how the data is used and requires it to be deleted when the work ends.

Loyalty programmes raise their own questions about points, expiry and changes to the scheme. The programme terms, the privacy policy and the app store listing all need to describe the same practices.

What usually comes up

• Customer data and marketing consent
• Loyalty programme terms
• Agreements with marketing and analytics vendors

Under the DPDP Act

Consent for marketing must be separate from what is needed to complete a purchase, and customers must be able to withdraw it as easily as they gave it.

What our work involves

• Notice and consent for customer and marketing data
• Loyalty programme terms
• Agreements with marketing, analytics and CRM vendors
• Privacy policies and terms of use for apps and websites

Related areas of work

• Data protection and privacy
• Privacy policies and terms of use
• Commercial contracts and review

Notes on this

• The Consent Box That Cures Nothing (2026-10-05)