> ## Documentation Index > Fetch the complete documentation index at: https://docs.paylead.fr/llms.txt > Use this file to discover all available pages before exploring further. # Onboarding compliance > What your enrollment, consent and unsubscribe screens must show and collect so that a Paylead service runs on a compliant basis, in opt-in and opt-out models. Before a [Consumer](https://docs.paylead.fr/glossary.md#consumer) enrolls in a Paylead service, your app has to inform them, collect their acceptance, and later let them manage their consents and leave. These rules apply to every [Program Manager](https://docs.paylead.fr/glossary.md#program-manager) that integrates [Perks](https://docs.paylead.fr/glossary.md#perks) or [Loyalty](https://docs.paylead.fr/glossary.md#loyalty), whether the Consumer opts in or the service is activated by default. ## Who owns what * **The Program Manager** holds the contractual relationship with its customers. It writes the terms and conditions (T\&Cs) of the [Program](https://docs.paylead.fr/glossary.md#program) and owns the onboarding interface. * **Paylead** provides, on request, a privacy policy template and a map of the topics your T\&Cs must cover. Paylead is not a party to the T\&Cs between you and the Consumer. * **Both** act as joint data controllers for the processing the Program requires. Send your T\&Cs and your privacy policy to your Paylead account manager once they are written. ## Legal elements to handle Only the T\&Cs, which include the banking secrecy waiver, are accepted. The privacy policy is brought to the Consumer's attention, and each optional consent is collected separately, through a positive action. The table below covers Perks, for both [Cashback](https://docs.paylead.fr/glossary.md#cashback) and vouchers. | Element | Nature | Expected action | Required | When | | - | - | - | - | - | | Service T\&Cs | Contract | Accepted through a positive action (unticked checkbox) | Yes | At enrollment, then available at any time | | Transaction sharing with Paylead (banking secrecy waiver) | Contract and mandatory GDPR information | Accepted with the T\&Cs in the same checkbox, and stated explicitly on the enrollment screen | Yes | At enrollment | | Privacy policy | Information document | Read, never accepted through a checkbox | Yes | At enrollment, then available at any time | | Targeted [Offers](https://docs.paylead.fr/glossary.md#offer) based on spending habits | Mandatory GDPR information | Explicit first-level statement on the enrollment screen | Yes | At enrollment | | Service notifications | Legitimate interest | No consent, but the Consumer can turn them off | No | Not applicable | | Marketing communications | Specific consent or legitimate interest | Collected or not, depending on the legal basis; the Consumer can turn them off | No | At enrollment or later | Two rules apply across services: * **One service, one collection.** Perks and Loyalty each need their own acceptance and consents. A consent given for one service is never reused for another, even for the same purpose. * **Always reachable.** The T\&Cs and the privacy policy stay available at any time from the customer area or the app settings. ## Mandatory statements Two pieces of information appear directly on the enrollment screen, visible without a click. Never leave them only in the privacy policy. 1. **Transaction sharing and analysis.** The service relies on sharing the Consumer's transaction history with Paylead (up to 12 months), then their new transactions as they occur, and on analyzing them. 2. **Targeted Offers.** The service shows personalized Offers, defined from the Consumer's spending habits. Computing which Offers a Consumer is eligible for is part of performing the contract. Your [Segments](https://docs.paylead.fr/glossary.md#segment) go through a compliance check by Paylead before they are provisioned (see [Assign Segments](https://docs.paylead.fr/program/user-journey/guides/manage-consumers.md#assign-segments-perks-optional)). > [!WARNING] > > Never tell the Consumer that their data "will not be shared with third parties for marketing purposes": it misrepresents how merchant Cashback works. Never describe the data as anonymized either. Paylead pseudonymizes it. ## Opt-in enrollment In the opt-in model, the Consumer actively chooses to join the service. This is the model Paylead recommends, since the service is optional. **1. Present the Program** One or more screens explain how the service works and what the Consumer gains. Showing 4 to 6 logos of partner [Brands](https://docs.paylead.fr/glossary.md#brand) that currently have an Offer clearly raises the enrollment rate. ![Mobile screen titled Cashback on all your transactions, showing six partner Brand logos with their Cashback rates, three steps explaining how the service works, and a Get started button](https://mintcdn.com/paylead-04d0cbf1/19UvKToh-utGRNsg/images/program/onboarding-compliance/program-presentation.png?fit=max\&auto=format\&n=19UvKToh-utGRNsg\&q=85\&s=3718e95e81c1c56aa76167e1326a5693) Program presentation screen with six partner Brand logos **2. Show the mandatory statements** Display the [transaction sharing and targeted Offers statements](#mandatory-statements). **3. Link to the privacy policy** Show a summary on screen and a direct link to the full document. **4. Link to the T\&Cs** Add a direct link. The T\&Cs describe enrollment, how [Rewards](https://docs.paylead.fr/glossary.md#reward) are created and paid out, and how the Consumer leaves the service. **5. Collect acceptance** One unticked checkbox covers acceptance of the T\&Cs and the banking secrecy waiver. Follow it with a button whose label states the action, such as **Accept**, and remind the Consumer that clicking it means acceptance. ![Mobile screen titled Turn on cashback, showing the transaction sharing and targeted Offers statements, an unticked checkbox accepting the terms and conditions including transaction sharing, and an Accept button with a reminder that tapping it means acceptance](https://mintcdn.com/paylead-04d0cbf1/19UvKToh-utGRNsg/images/program/onboarding-compliance/acceptance.png?fit=max\&auto=format\&n=19UvKToh-utGRNsg\&q=85\&s=228020b7c8d3c331461fda99a3ba5c73) Mandatory statements and acceptance on the enrollment screen **6. Offer the optional consents** Collect each optional consent separately, for example marketing communications when they rely on consent. **7. Activate the service through the API** Create the Consumer, enroll them in the service, then share their transaction history. See [Consumer lifecycle](https://docs.paylead.fr/program/user-journey/guides/manage-consumers.md) for the calls. **8. Set the Consumer's expectations** Tell the Consumer that their targeted Offer catalog will keep improving over the next 36 hours, while Paylead computes it. ## Opt-out activation In the opt-out model, the service is active by default for eligible customers because it is part of an existing banking offer, for example Cashback included in the account agreement. The flow depends on whether the customer already banks with you when the service launches. **Existing customers** * **Notify the T\&Cs update**, with the T\&Cs and the privacy policy attached. * **Include the mandatory statements** in the notification: transaction sharing with Paylead and personalized Offers. * **Give at least 30 days' notice** before activation. During that period, the customer can refuse the service. You can instead run a strong opt-in: the service stays suspended for each customer until they accept it. **New customers** * **Include the Cashback T\&Cs in your general T\&Cs**, stating clearly that the service involves sharing transactions with Paylead. * **Present Cashback before the T\&Cs are accepted**, with the first-level statements on transaction sharing and personalized Offers, and a link to the privacy policy. ## Manage consents after enrollment The Consumer can grant or withdraw each consent at any time, from a single section that is easy to reach. * **One toggle per consent-based processing.** How many depends on the processing your privacy policy defines. For a consent Paylead records, such as `SMART_RANKING`, send the change through the API (see [Smart Ranking consent](https://docs.paylead.fr/program/user-journey/guides/manage-consumers.md#smart-ranking-consent-perks-optional)). * **Withdrawal only affects future use.** Rewards already earned are kept and paid out as usual. * **Group the essentials.** Put the T\&Cs, the privacy policy and the unsubscribe button in the same section. ## Unsubscribe The Consumer can unsubscribe at any time, in a few steps, from the customer area. Before the Consumer confirms, show a dialog that tells them what they lose. Its content depends on your Program's payout model: see [Rewards in flight at off-boarding](https://docs.paylead.fr/program/user-journey/guides/manage-consumers.md#rewards-in-flight-at-off-boarding). Once the Consumer has left every Paylead service, off-board them through the API. Reward generation stops immediately, and their data is handled as described in [Data retention after off-boarding](https://docs.paylead.fr/program/user-journey/guides/manage-consumers.md#data-retention-after-off-boarding). ## What's next > **[Share transactions](https://docs.paylead.fr/program/user-journey/concepts/transaction-lifecycle.md)** > > Push the Consumer's transaction history and keep their feed current. > **[The WebApp](https://docs.paylead.fr/program/user-journey/concepts/web-app.md)** > > Delegate part of the Consumer journey to an embedded webview.