Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Loloyal is a Shopify loyalty, rewards and referral app that lets stores run points programs, VIP tiers and referral links. Its on store widget sets cookies to identify loyalty members, track referrals and remember reward state, and it stores customer loyalty data. Under the GDPR and the ePrivacy Directive, its non essential cookies require prior consent and member data must be handled lawfully.
Loloyal is a loyalty and rewards application for Shopify and other ecommerce platforms, developed by Channelwill. It lets merchants reward customers with points, run VIP tiers, offer referral links and send reward reminders. Shoppers interact with a loyalty widget on the storefront and through a customer account.
The Loloyal widget sets cookies to identify a loyalty member, attribute referrals to the customer who shared a link and remember the state of rewards and points. It processes customer data such as name, email, order history and points balance, and may read device data like IP address and browser to support referral tracking.
The referral and member identification cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. The loyalty member data is personal data under the GDPR, so you need a lawful basis, usually contract or consent for the loyalty program, and clear information for participants.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Load the Loloyal widget through a Consent Management Platform so its referral and analytics cookies are set only after consent. A cookie strictly needed to show a logged in member their points may be treated as functional. Inform shoppers about the loyalty program, log consent, and allow refusal of non essential tracking.
Loloyal is operated by Channelwill and may use infrastructure outside the European Economic Area, including Asia. Member and referral data may therefore be transferred outside the EEA, and because those locations may lack an EU adequacy decision, the transfers must rely on Standard Contractual Clauses with a Transfer Impact Assessment.
List the Loloyal cookies and domains in your cookie policy and gate the non essential ones behind consent. Sign a data processing agreement, define a lawful basis and retention for the loyalty data, and inform members how the program uses their data. Put SCCs and a Transfer Impact Assessment in place and review the integration after updates.
Websites using Loloyal must obtain user consent under GDPR regulations.
DPIA considerations
Loloyal sets cookies and processes customer data such as name, email, order history and points balance. Key DPIA considerations: (1) the referral and member identification cookies are not strictly necessary identifiers requiring consent; (2) the loyalty program profiles customers through points, tiers and referrals; (3) data may be transferred outside the EEA, requiring safeguards; (4) a lawful basis and retention must be set. A DPIA is advisable.
Sample consent text
We use Loloyal for our loyalty and referral program. The Loloyal widget sets cookies, processes your member and order data and may process data outside the EEA. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
loloyal.comcdn.loloyal.comapi.channelwill.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| loloyal_member | Functional / Analytics | 1 year | Identifies a loyalty member and remembers the state of their points and rewards. |
| loloyal_referral | Attribution / Advertising | 90 days | Stores a referral identifier so a reward can be credited to the customer who shared the link. |
Loloyal uses cookies for user preferences — inform visitors with a consent banner.
Loloyal sets cookies to identify a loyalty member, attribute referrals and remember reward and points state. The referral and member identification cookies are not strictly necessary, so they require consent, while a cookie needed to show a logged in member their points may be treated as functional.
Yes for the non essential cookies. The referral and analytics cookies Loloyal sets need prior consent under the GDPR and the ePrivacy Directive, so they should not load until the shopper accepts. A functional cookie for a logged in member can be treated differently.
Consent under Article 6(1)(a) GDPR covers the non essential cookies. Running the loyalty program for members who joined it relies on contract under Article 6(1)(b), or on consent. You should give clear information about how points, tiers and referrals use personal data.
Yes. Loloyal is operated by Channelwill and may process data outside the EEA, including in Asia, where an EU adequacy decision may not exist. Transfers must therefore rely on Standard Contractual Clauses with a Transfer Impact Assessment, and you should document the recipients.
A DPIA is advisable because the loyalty program profiles customers through points, tiers and referrals and may transfer data outside the EEA. Documenting the purposes, the profiling, the retention and the transfer safeguards supports Article 35 GDPR compliance.
Add Loloyal through a CMP that blocks referral and analytics cookies until consent, keep any functional member cookie separate, and inform shoppers about the loyalty program. Sign a data processing agreement, define retention, put SCCs in place for the transfer, and disclose cookies and recipients.
Other loyalty and rewards apps include Smile.io, Yotpo Loyalty, LoyaltyLion and Rivo, some of which process data in the EU or US under clearer transfer terms. All set loyalty and referral cookies and store member data, so consent gating and clear information remain essential.
Describe the Loloyal cookies, their purpose and duration, list the Loloyal domains, and state that member and referral data may be processed outside the EEA. Explain the loyalty program and the transfer safeguards in your privacy notice and keep both aligned with the integration.