Fundle.ai: Consent Based Loyalty Data Management for Privacy First Retail

Consent as the Foundation of Privacy First Loyalty Platforms

The instinct in Indian retail has always been to maximise data collection at the point of enrolment and worry about permissions later. This made sense when CRM was primarily used for monthly SMS campaigns and annual birthday offers. The modern loyalty stack — integrating AI-driven personalisation, WhatsApp conversational commerce, geo-fenced push notifications and cross-brand analytics — operates on data flows that are materially different from what a customer expects when they hand over their phone number at a Reliance Trends cashier.

Consent, properly architected, is not a gate that reduces data collection — it is a filter that increases data quality. When a customer at a Pantaloons store explicitly opts into personalised fashion recommendations, exchanges their size and style preferences, and acknowledges that their purchase history will be used for AI-driven outfit suggestions, that data point carries a fundamentally different commercial value than a phone number scraped into a bulk SMS list. The consent signal itself is a data asset.

A privacy-first loyalty platform structures consent across three tiers. First, operational consent: the data strictly necessary to run the programme — points balance, transaction history, redemption mechanics. This is the baseline and should require the lightest, clearest disclosure. Second, engagement consent: permission to send personalised communications across specific channels — SMS, email, WhatsApp, app push. Each channel must carry a separate, revocable consent flag. Third, analytics consent: permission to use behavioural data for profiling, segmentation and third-party analytics partnerships. This tier requires the most explicit disclosure and carries the highest value for the brand.

The DPDP Act's requirement that consent be 'free, specific, informed and unambiguous' maps neatly onto this three-tier architecture. Brands that conflate all three tiers into a single 'I agree to terms' checkbox at POS enrolment are not just legally exposed — they are building on a foundation that will collapse the moment a customer exercises their right to withdraw consent or access their data. The right architecture separates these tiers technically and contractually from day one, enabling surgical consent management without disrupting the programme's core operational integrity.

Legal Obligations Under DPDP and Other Applicable Laws

The Digital Personal Data Protection Act 2023 is the governing framework, but Indian retail CMOs and CIOs need to hold four additional legal instruments in mind simultaneously. The Information Technology Act 2000 (and its 2011 SPDI Rules) still governs sensitive personal data like financial information stored within loyalty platforms. RBI's Payment Aggregator guidelines govern any loyalty-adjacent stored-value or co-branded wallet functionality. TRAI's Commercial Communication regulations govern SMS and voice-based loyalty communications — and carry their own consent and DND-scrubbing obligations entirely separate from DPDP. For mall operators running common-area Wi-Fi with loyalty sign-on, DOT's licensing conditions add another layer.

Under the DPDP Act specifically, retail brands operating loyalty programmes are classified as Data Fiduciaries with obligations across seven dimensions: lawful purpose, valid consent, data minimisation, accuracy, storage limitation, reasonable security safeguards and grievance redressal. For most mid-size Indian retail chains — think a 150-store ethnic wear brand or a regional pharmacy chain operating under Apollo's franchise model — the storage limitation and consent withdrawal obligations are the hardest to operationalise. A customer who joined a loyalty programme in 2019 and has been inactive for 36 months has a legal right to erasure under DPDP. Do your systems support that today?

The Act also introduces the concept of 'deemed consent' — data processing that is reasonably necessary to fulfil a service the customer explicitly requested — but retail brands frequently misread this as a blanket exemption for loyalty data processing. It is not. Deemed consent under DPDP applies to the minimum data required to fulfil the specific service, not to downstream profiling, cross-brand data sharing or behavioural analytics. Brands like Cafe Coffee Day or Manyavar that have historically used loyalty data to power broadly targeted advertising campaigns need to re-evaluate whether those campaigns rest on valid legal bases.

Penalties under the DPDP Act scale with the severity of the violation and the size of the data fiduciary. For large retail conglomerates — Reliance Retail, Shoppers Stop, Future-era entities — the ₹250 crore cap per violation category means a single non-compliant campaign touching 5 million loyalty members could trigger a penalty that eclipses an entire year of loyalty programme ROI. The Data Protection Board's enforcement mechanism, while still being operationalised by the Ministry of Electronics and IT, will almost certainly prioritise large consumer-facing data fiduciaries in its first enforcement cycle — the same brands running India's largest loyalty programmes.

Technologies Supporting Scalable Consent Collection in Indian Retail

The consent management problem in Indian retail has a technology dimension that is frequently underestimated. A mid-size mall operator running a coalition programme across 80 brand tenants — each with their own POS (POSist, Petpooja, Wondersoft, GoFrugal) — faces a consent data synchronisation challenge that cannot be solved with a spreadsheet or a basic CRM field. Consent state must propagate in real time from the point of capture to every downstream system that touches that customer's data: the loyalty engine, the CDP, the campaign management platform, the data warehouse and any third-party analytics partner.

The technical stack for consent-first loyalty has four core components. First, a Consent Collection Layer integrated directly into POS, mobile app onboarding and web enrolment flows. This layer must support the specific UX patterns mandated by DPDP — plain-language disclosure, channel-by-channel toggles, no pre-ticked boxes, no consent bundled with programme terms. For brands using Wondersoft or GoFrugal at POS, this requires either native SDK integration or a middleware API layer that captures consent at the terminal and pushes it to a central consent ledger in real time.

Second, a Consent Ledger — an immutable, time-stamped record of every consent event: given, withdrawn, modified, re-granted. This is not a CRM field. It is an append-only data store with cryptographic integrity guarantees, queryable by customer ID, consent type, channel, timestamp and version of the privacy notice presented at the time of consent. When the Data Protection Board asks you to prove that customer X gave WhatsApp marketing consent on date Y under privacy notice version Z, your answer needs to come from this ledger in seconds, not from a manual CRM query.

Third, a Consent Propagation Engine that distributes consent state changes to all downstream systems in real time. When a customer withdraws email consent through a self-service portal at 11 PM, the email campaign scheduled for 6 AM the next day must not reach them. This requires event-driven architecture — Kafka or equivalent — connecting the consent ledger to the campaign management platform (MoEngage, WebEngage, or equivalent), the CDP and the POS loyalty lookup. Brands relying on batch-sync processes with 24-hour latency are operating a consent management system that cannot meet DPDP's practical requirements.

Fourth, a Re-Permission Workflow Engine that proactively manages consent lifecycle — identifying members whose consent is approaching expiry, triggering contextually appropriate re-permission moments (post-purchase thank you, birthday communication, anniversary of enrolment) and logging outcomes back to the consent ledger. Competitors like Capillary, EasyRewardz and Antavo have begun adding consent fields to their CRM schemas, but none have built a native, event-driven consent propagation architecture designed specifically for the Indian regulatory environment.

User Experience Considerations in Consent Capture for Indian Retail

The most common mistake Indian retail brands make in consent UX is conflating legal compliance with user experience quality. A legally compliant consent flow can still be confusing, coercive or so cumbersome that it drives enrolment abandonment — and a consent flow that drives 30 percent enrolment abandonment is not a compliance success, it is a business failure. The goal is consent flows that are legally watertight and that a 45-year-old customer at a Lenskart store in Tier 2 India finds genuinely intuitive.

Language is the first battlefield. DPDP requires consent to be in 'clear and plain language' — and for Indian retail, this means regional language support is not optional. A loyalty programme enrolling customers in Tamil Nadu, Karnataka and Maharashtra needs consent disclosures in Tamil, Kannada and Marathi respectively. Presenting a legal disclosure in English to a customer whose primary language is Telugu is not 'clear and plain language' as the Act intends it. Brands operating at national scale need a consent localisation strategy across at least eight languages to cover 80 percent of their enrolment touchpoints.

The second UX consideration is progressive disclosure. Presenting all three consent tiers simultaneously at POS enrolment creates cognitive overload and consent fatigue, reducing the quality of consent given. Best practice — validated by GDPR-era European retail data — is to capture Tier 1 operational consent at enrolment, then introduce Tier 2 engagement consent in the first post-enrolment communication (when the customer has already had a positive interaction with the programme), and introduce Tier 3 analytics consent as a value-exchange proposition (e.g., 'Share your style preferences and earn 200 bonus points').

The third consideration is channel parity. A customer who gives WhatsApp consent at a Select CITYWALK kiosk and then withdraws it through the brand's mobile app must experience that withdrawal as instant and total. If they receive a WhatsApp message 48 hours after withdrawal, the brand has failed both legally and experientially — and in the social-media era of Indian retail, that failure will be public. The UX of consent withdrawal must be as friction-free as the UX of consent granting. Self-service consent dashboards, accessible from the loyalty app home screen and not buried in a settings sub-menu, are the minimum standard for a 2025 Indian retail loyalty programme.

KPIs to Track in a Consent Based Loyalty Data Programme

Most Indian retail loyalty programmes track the standard engagement KPIs — enrolment rate, active member rate, redemption rate, revenue per loyalty member. A consent-first programme needs a parallel set of consent health KPIs that are reported at the same frequency and with the same seriousness as commercial metrics. Without these, consent management becomes a compliance project that no one owns commercially.

The five consent KPIs every Indian retail CMO should track monthly: first, Consented Member Rate by tier — what percentage of your total loyalty base has valid, recorded consent at each tier? A programme with 5 million enrolled members but only 2 million with valid Tier 2 engagement consent has a reach problem that no campaign optimisation will fix. Second, Consent Withdrawal Rate — monthly withdrawals as a percentage of total consented base by channel. A spike in WhatsApp withdrawal rate following a campaign is a leading indicator of content relevance failure, not just a consent metric. Third, Re-Permission Conversion Rate — of members contacted for consent renewal, what percentage re-consented? This metric is a proxy for overall programme NPS and should be benchmarked by channel, tier and regional cohort.

Fourth, Consent Age Distribution — what is the median age of your consent records? DPDP does not specify a fixed consent expiry period, but programme best practice (and data quality hygiene) suggests that consents older than 24 months should be actively renewed, particularly if the programme's data processing scope has expanded since the original consent was given. A consent given for a basic points programme in 2021 does not cover AI-driven personalisation or cross-brand analytics introduced in 2024. Fifth, Data Subject Request (DSR) Resolution Time — the average time to fully resolve access, correction and erasure requests. DPDP requires timely resolution; industry benchmark for high-performing programmes is under 72 hours for access requests and under seven days for erasure.

These five KPIs, reported monthly to the CMO and CIO and quarterly to the Board's audit committee, create the governance infrastructure that turns consent management from a legal department project into a commercially owned capability. Brands that achieve this governance maturity — Tanishq's Encircle programme and Lenskart's Club programme are the closest Indian retail analogues today — will build data assets that are both more valuable and more defensible than competitors whose data lakes rest on legally questionable consent foundations.

How Fundle solves this

Fundle was built from its first architecture decision around a single principle: customer data has no value without the trust that underlies it. The Fundle AI Platform is India's only loyalty and customer engagement infrastructure that treats consent management not as a compliance module bolted onto a points engine, but as the foundational data layer on which every personalisation, campaign and analytics capability rests. Fundle ConsentFirst — the consent management layer within the Fundle Loyalty Platform — manages consent for over 270 Indian retail brands ensuring compliant loyalty programme operations at scale.

Fundle Mall Loyalty and Fundle Brand Loyalty both ship with a native three-tier consent architecture pre-integrated with India's most widely deployed POS systems — including GoFrugal, POSist, Petpooja and Wondersoft. The consent collection layer captures granular, purpose-bound consent at every touchpoint, pushes events to an immutable consent ledger in real time and propagates consent state changes to the campaign management layer within seconds. For a mall operator like a Phoenix Marketcity or a Select CITYWALK running 80+ brand tenants on a common loyalty programme, this means a single withdrawal at a tenant's POS instantly suppresses all downstream Fundle-managed communications across all tenants — in the same event loop.

Fundle AI Agents operationalise the consent lifecycle management playbook described in this article. Fundle Agentic AI monitors consent age, triggers re-permission workflows at configurable intervals and selects the re-permission channel based on the member's highest-confidence consent state — never attempting re-permission on a channel where consent has been withdrawn. Fundle AI Workflow orchestrates the full consent lifecycle across enrolment, engagement, re-permission and erasure, generating audit-ready reports exportable directly for Data Protection Board submissions. Competing platforms — Capillary, EasyRewardz, Antavo, Xeno — have added consent fields; none have built consent as a first-class, event-driven, auditable infrastructure layer.

Vineet Narang's founding vision for Fundle was that Indian retail's data advantage should be earned through transparency, not extracted through opacity. The Fundle AI Platform turns DPDP compliance from a cost centre into a product differentiator: brands that can prove to their customers that consent is real, specific and revocable will win the trust that converts loyalty programme membership into genuine lifetime value. In an Indian retail market where 67 percent of customers say they would share more data if they understood how it was used, the consent-first brand does not just avoid regulatory penalty — it captures a data asset that the non-compliant brand can never match.