50% off

Half price through October on Basic and Pro plans. New customers only. See pricing

Back to Help Hub
Security & ComplianceGuide3 min readUpdated 2026-09-28

What Legal, Privacy and Compliance Rules Should I Consider for a Referral Program?

Use a practical checklist for referral-program privacy, marketing, rewards, data retention, campaign terms and jurisdiction-specific review.

Send this article context to support so a human can pick up quickly.
Browse topics and support
Need help applying this to your account?

Contact support and we will keep this article attached to your request.

Overview

Before you launch a referral program, check the privacy, marketing, consumer, reward, and data-retention rules that apply to your organisation and audience. Referral Factory gives you the platform and campaign controls. It cannot decide whether your specific campaign is lawful.

Start with the information you collect

List the information your campaign collects from referrers and leads, such as names, email addresses, IP information, referral details, qualification data, and reward data. For each type, decide why you need it, who can access it, and how long you will keep it.

Tell people what to expect

Explain what happens when someone joins, which messages they may receive, how referrals qualify, and how rewards work. Use Terms & Conditions in Campaign Settings for campaign-specific rules, and make sure your privacy notice describes the actual journey.

Check marketing and reward rules

Before launch, confirm that:
your emails and referral invitations follow the rules that apply to your audience;
your reward eligibility, expiry, cancellation, and refund wording is clear;
the campaign is allowed in each country or market where you promote it; and
your customers and referral partners know what is not allowed.
Also review any tracking pixel, analytics tool, CRM connection, or reward provider you add to the campaign.

Get help when you need it

Referral Factory's Privacy and Cookie Policy, Data Processing Addendum, and General Terms explain the platform's privacy and data-processing terms.
Rules vary by country, industry, audience age, reward type, and marketing channel. Ask your own legal or privacy team to review the campaign when the situation is complex.
If GDPR applies to your organisation or audience, review Referral Factory’s GDPR guidance alongside your own legal advice.
Still need help?

Send this article to support

A human can review the article you were reading and help with the exact next step.

Article feedback

Did this answer your question?

Your vote helps support spot weak articles, fix missing steps, and decide when a person should step in.