Tetiana Kremnova
You did a step in the right direction by unchecking the "i have read and accept term of use" pre-checked chekbox but you did two step backwards with this "when you tap the button, all the checkboxes will be checked automatically".
According to GDPR "consent must be explicitly obtained" and checking automatically the checkboxes does not mean that the consent was given. If you want to be compliant the first checkbox should say "I have read and accept terms of use and privacy policy", the second field should be about getting communications from us.
That separation is NEEDED because you need one consent to process user's data to create the loyalty card and another one to communicate with the user.
Think about realy loyalty cards, the ones in the real world. User gives you his details to get the card but can also decide if he wants to receive emails from us.
I understand that communicating with the user is part of our proposition so if he doesn't opt in to receive communications from us you could refuse the service but AT LEAST you should remove the automatically check of checkboxes to be compliant.
Link to skool discussion: https://www.skool.com/boomerangme/im-not-sure-the-new-form-is-not-gdpr-compliant