What the Tills Remember: Auditing Your Supermarket Loyalty Data in 2026
You know the drill: a beep at the till, a small discount, and a receipt that says you saved £3.40. What that beep also does is add another line to a profile that can stretch back years. In the UK, supermarket loyalty schemes are some of the most detailed consumer databases going — not because they know your name, but because they know what you bought, when, where, and what coupon made you come back.
This is not a conspiracy. It is a trade. You get lower prices and points; the supermarket gets a picture of your household. The useful question is what that picture looks like, who else sees it, and how to shrink it without giving up the savings. Here is how to audit your own loyalty ledger in 2026.
The card is the key, not the lock
A Clubcard or Nectar card on its own is a number. Link it to an account, an email, a delivery address, a banking app or a fuel purchase and it becomes a key to a fairly intimate file: basket-level purchase history, store visits, coupon redemptions, and sometimes app location data. Tesco's insight arm, dunnhumby, and Sainsbury's Nectar360 are the best-known examples, but every major scheme does some version of this.
The terms usually allow the supermarket to share data with partners and advertisers in aggregated or pseudonymised form. That does not always mean your name and address are sold on. It does mean your shopping patterns can be grouped, modelled, and used to decide which coupons you get, which products are pushed to you, and which personalised offers appear in an app. Under UK GDPR, pseudonymised data is still personal data if it can be linked back to you — and it often can.
What you can ask for — and what to expect
Under UK GDPR you have a right of access. A subject access request (SAR) is free, and the retailer has one month to respond, extendable by two months if the request is complex. You can ask for:
- a copy of your personal data;
- the purposes of processing;
- the categories of recipients;
- how long they keep it;
- the logic behind any profiling or automated decision-making that affects you.
Ask specifically for loyalty account data, app data, coupon and marketing profiles, and any data shared with third parties. Ask for it in a commonly used electronic format. You do not need a solicitor and you do not need to use a special form, though many retailers have a privacy portal that speeds things up.
The Saturday-morning audit
Set aside an hour. This is dull, but it is your data.
- List every card and app. Clubcard, Nectar, Asda Rewards, Morrisons More, My Waitrose, Co-op. Include the ones in your phone wallet that you forgot about.
- Find the privacy centre. Look for 'privacy', 'data', 'advertising preferences' or 'personalisation' in the account settings. Screenshot the current settings before you change anything.
- Send the SAR. Use the retailer's privacy portal or email the privacy team. Keep a copy. Ask for the data in a portable format.
- Read the file for surprises. Look for linked cards you do not recognise, old addresses, fuel purchases, app location history, and segments such as 'family shopper' or 'premium ready-meal buyer'. These labels are often the most revealing part.
- Switch off what you do not need. Turn off personalised advertising, location access, Bluetooth, and 'improve our services' toggles where they exist. These are usually separate from the discount itself.
- Separate the identities. Use a dedicated email address for loyalty accounts. Do not link your card to social logins. If a scheme asks for a phone number, consider whether you need to give it.
- Repeat annually. Profiles drift. A yearly check is enough for most households.
The awkward bit: the discount depends on the card
This is the catch. Clubcard Prices and Nectar Prices are not just rewards; they are the price you pay for being identifiable at the till. You can shop without a card, but you will often pay more. The realistic aim is not zero data — it is less data, and less sharing.
A few practical compromises:
- Use a physical card rather than the app if you do not need the app's features. The app can collect more: location, device identifiers, push-notification engagement.
- Do not scan receipts or take surveys for bonus points unless the reward is worth the extra data.
- Check whether the scheme lets you opt out of personalised offers while keeping the base card. Some do; some bury it.
- If you use a delivery pass or online account, remember that online baskets are even more detailed than till receipts.
How the big schemes compare
The exact settings change, so treat this as a map of where to look rather than a permanent verdict.
| Scheme | What it tends to track | Where to look | Watch for |
|---|---|---|---|
| Tesco Clubcard | Till baskets, coupons, fuel, app use; insight via dunnhumby | Account > Privacy and marketing preferences | Clubcard Prices need the card; app permissions are separate |
| Sainsbury's Nectar | Basket data, Nectar Prices, personalised points; Nectar360 advertising | Nectar account > Preferences | Linked partners can add data; check personalised offers |
| Asda Rewards | App-first missions, basket data, cashpot | App > Account > Privacy | App permissions and notifications are part of the profile |
| Morrisons More | Card/app purchases, coupons, fuel | Account > Marketing preferences | Check whether fuel and grocery profiles are linked |
| My Waitrose | Card purchases, coupons, online account | Account > Privacy | Fewer gamified missions, but still basket-level |
| Co-op | Membership card, app, offers | Membership account > Preferences | Member pricing and app use can be separate profiles |
If the file looks wrong
You can ask for correction, deletion in some circumstances, and restriction of processing. You can also object to processing based on legitimate interests. If a retailer ignores your request or fobs you off, complain to the Information Commissioner's Office (ICO). The ICO's website has a simple complaints route, and retailers tend to take it seriously.
The loyalty card is not evil. It is a discount scheme with a memory. The point of this audit is to make that memory a bit shorter, a bit less joinable, and a lot less mysterious. Do it once, set a reminder, and get on with your shopping.
