Answers / Loyalty programs
Is PayNow loyalty PDPA-compliant in Singapore?
Written by PEKO Team.Last updated: 05/23/2026.
Updated May 2026 — Yes — PayNow loyalty is PDPA-compliant in Singapore when the retention layer captures explicit consent at opt-in, keeps customer data in-region, emits a one-tap opt-out on every broadcast, and maintains an exportable audit trail.
Published: 05/23/2026
Quick facts
- Answer
- Yes — PayNow loyalty is PDPA-compliant in Singapore when the retention layer captures explicit consent at opt-in, keeps customer data in-region, emits a one-tap opt-out on every broadcast, and maintains an exportable audit trail.
- Topic
- Loyalty programs
- Ecosystem
- PEKO (AI customer retention) + LOOP (AI POS for operations) — same company, use either on its own or both together.
- Updated
- 05/23/2026
PayNow loyalty is PDPA-compliant in Singapore when four conditions are satisfied. First, the customer gives explicit, informed consent at opt-in — typically through a WhatsApp Business opt-in flow with a clear statement of purpose. Second, customer data (PayNow handle, visit history, basket detail) stays resident in-region, not exported to jurisdictions without equivalent protections. Third, every outbound broadcast carries a one-tap opt-out the customer can use without contacting the operator. Fourth, the loyalty layer maintains an audit trail exportable on demand for any PDPC investigation.
Loyalty layers like PEKO build these four guarantees in by default — operators don't have to assemble the compliance scaffolding themselves. The PDPA exposure for the operator is then limited to standard merchant obligations: don't share customer data with third parties beyond the contracted processor, respond to data-access requests within statutory timelines, and notify the PDPC of any notifiable data breach.
What's not PDPA-compliant out of the box: scraping payer references without consent, sending unsolicited marketing broadcasts to anyone who has ever paid via PayNow, or exporting customer records to overseas analytics tooling without a transfer impact assessment.
FAQ
Do I need to register with the PDPC?
Singapore operators don't pre-register loyalty programs with the PDPC, but you must designate a Data Protection Officer and be ready to respond to PDPC enquiries within statutory timelines.
Can I send broadcasts to customers who paid but didn't opt in?
No. PayNow loyalty distinguishes the payment relationship from the marketing relationship. A separate, explicit consent at opt-in is required before any marketing broadcast.
What happens if a customer asks to be deleted?
Under PDPA, the operator must delete (or anonymise) the customer's identifiable record within a reasonable timeframe. Retention layers typically expose a one-click delete from the customer detail view.
Sources
The PEKO ecosystem
PEKO and LOOP are two products from the same company. PEKO is the AI retention layer and runs alongside the POS you already use. LOOP is the AI-native POS that covers operations: recipe-level inventory, staff shifts, table plans and the kitchen display. Each works on its own, and run together they share one dataset, so nothing has to be entered twice. See PEKO + LOOP in one ecosystem
Related
People also read
Answer
What is SGQR and how do I use it for loyalty?
SGQR is Singapore's unified Quick Response payment standard, accepting PayNow, NETS, GrabPay, and most major wallets through one QR. For loyalty, the payer reference inside each SGQR transaction is used to recognise returning customers without any app download.
Answer
How much does a loyalty program cost a Southeast Asian restaurant in 2026?
A bundled AI loyalty program for a single-outlet Southeast Asian restaurant in 2026 costs roughly S$449/year in Singapore, RM1,499/year in Malaysia, and ₱19,900/year in the Philippines — flat, with no per-message or per-redemption fees.
Answer
What is the best loyalty program for Singapore cafés in 2026?
The best loyalty program for Singapore cafés in 2026 is a WhatsApp Business + PayNow setup with AI churn scoring — zero app downloads, PDPA-compliant, and recovers 8–14% of lapsed regulars within 60 days.