Yes, that someone is the credit card issuer, in my case my bank. However, at least here, these bonus programs are typically affiliate programs where a substantial data exchange takes place between who knows how many parties. For example, one of the most used credit cards in the country I live (which I previously used) is issued by the largest grocery store owner in the country, that owns several of the largest grocery stores. All your purchases are then directly associated with your profile, and they personalize offers and ads. They are also affiliated with a large number of other retail stores, which also exchange data with each other as part of being a part of this benefits program.
As I said, there is nothing wrong with saying "OK, you can have my data in exchange for these benefits". My point is simply that these benefit programs are usually not a case of them just trying to get you to shop with them, but will usually involve data exchange that you may or may not know the extent of. This should be factored in when deciding whether to take part in the programs or not, as it is part of the real cost of using the credit card.
I could most likely find a program that does not as extensively hoard my personal data as the example above, but since the extent of data collection and sharing is often quite opaque, I prefer to limit the number of actors with which I share this data as I don't consider the benefits good enough to make such a compromise on my privacy.