Roles
The organisation using Incentively is normally the controller of recipient and campaign data because it determines the campaign purpose, eligibility, communications and retention. Incentively Limited normally acts as its processor when hosting, matching, allocating and delivering rewards on its instructions.
Incentively Limited acts as an independent controller for its own business administration, service security, legal compliance, account management and direct relationship with registered Incentively users.
Organisation responsibilities
- Have a lawful basis and provide an appropriate privacy notice before uploading or collecting personal data.
- Use only data that is adequate, relevant and necessary.
- Keep eligibility data accurate and avoid uploading special-category or highly sensitive information unless expressly agreed and legally justified.
- Configure retention, access and communications appropriately.
- Respond to data-subject requests and notify Incentively where assistance is needed.
Our processor commitments
- Process customer data only on documented instructions, including the service configuration and contract.
- Apply confidentiality, access controls and appropriate technical and organisational security.
- Control sub-processors and require suitable data-protection terms.
- Assist with rights requests, security incidents, deletion and compliance information where reasonably required.
- Delete or return customer data at the end of the service, subject to lawful retention and backups.
Data separation
Campaign data remains associated with the relevant organisation. A registered recipient’s Incentively account is separate: the organisation does not own the person’s password, unrelated rewards, unrelated brand relationships or platform preferences.
Anonymous identifiers
Where campaigns use employee or reference numbers, organisations should upload identifiers without names or other direct identifiers unless a separate lawful workflow has been agreed. Incentively is designed to avoid unnecessarily pairing anonymous eligibility numbers with personal profiles.
Data processing agreement
Business customers should enter into the applicable Incentively Data Processing Agreement as part of their service terms. Contract-specific terms take priority over this public summary.
Last updated: 18 July 2026. Policies may be updated as the service, law or suppliers change. Material changes will be communicated where required.