Blue Light Card respects your privacy and is committed to protecting your personal data.
This notice explains how we collect and use your personal data when you use our websites or mobile apps (together our “sites”), use our services or otherwise contact us.
Our sites are not to be used by children, and we do not knowingly collect personal data about children.
Please read this privacy notice together with any other notice that we give you so that you fully understand how and why we use your data. This notice adds to those other notices but does not replace them.
Blue Light Card means
If you are a member or user in the UK, Blue Light Card Ltd is the controller of your personal data.
If you are a member or user in Australia, depending on the processing that we are carrying out, either Blue Light Card Ltd in the UK or Blue Light Card Pty Ltd in Australia will be the entity responsible for your personal information. This is because some of our services that involve processing your personal information are provided centrally by Blue Light Card Ltd in the UK.
Blue Light Card Ltd is compliant with UK GDPR and Blue Light Card Pty Ltd is compliant with the Privacy Act1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles.
Your rights, and our obligations, may differ depending on whether you are in the UK or Australia. Where that happens, we explain the difference in Appendix 1 (UK Addendum) and Appendix 2 (Australia Addendum) of this notice.
We have appointed a data protection officer (“DPO”) to deal with questions about this notice and requests to exercise your legal rights. You can contact the DPO at:
Blue Light Card Ltd, Charnwood Edge Business Park, Syston Road, Leicester, United Kingdom, LE7 4UZ
The process for complaining about a data protection issue, and your rights, will differ depending on whether you are in the UK or Australia. If you are in the UK, please see Appendix 1 (UK Addendum). If you are based in Australia, please see Appendix 2 (Australia Addendum).
We review this privacy notice regularly.
This notice was last updated on 21/07/2026.
It is important that the personal data we hold about you is accurate and up to date. Please tell us if your personal data changes during your relationship with us. You can update some of your details in the ‘personal information’ section of your account on our sites.
Our sites may include links to third-party websites, plug-ins and applications. If you click those links or enable those connections, third parties may collect or share data about you. We do not control those third-party sites and are not responsible for their privacy notices. When you leave our sites, we encourage you to read the privacy notice of the website or app that you visit.
We may process the following types of personal data about you:
We also collect, use and share aggregated data (such as statistical or demographic data) for any purpose. Aggregated data may come from your personal data, but is not personal data because it does not identify you. If we combine aggregated data with your personal data so that you can be identified, we treat the combined data as personal data and use it under this notice. We may share anonymised data with other companies to help them improve their services, understand how effective their services and offers are, and to recruit new prospects and/or retail partners.
We do not ask for, use or intentionally collect special categories of personal data (also called 'sensitive information') such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health or genetic and biometric data. If you give us any special category data, we will delete this in line with our retention policies.
Sometimes the law, or a contract we have with you, requires you to give us personal data. If you do not provide the information we ask for, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide goods or services).If that happens, we may cancel a product or service you have with us, but we will tell you at the time.
We may collect data from and about you:
After you first sign in, you may choose to sign into our app using your fingerprint or a facial recognition scan. Any personal data included in that process is collected and processed on your device in line with the relevant third party’s own policies and procedures. We do not receive or process that personal data.
We work with several affiliate networks to provide our service. We will usually be a controller with those affiliate networks (to the extent that the classification of a 'controller' is relevant) under the relevant data protection laws for the purpose of tracking commission payable by advertisers to us, mainly through cookies, third-party tracking pixels, and other tracking technologies (please see our cookies policy for details). Where an affiliate network acts as an independent controller for some processing, you may exercise your rights either against us, as explained in this notice, or against the affiliate network, using the privacy notice for that network. The networks listed in the original notice are:
We also work with additional affiliate networks beyond those listed above, including affiliate networks based in Australia. If you have questions about those networks, please contact our DPO at dpo@bluelightcard.co.uk.
We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose is listed below. Usually, we rely on the following:
Where you have freely consented, in a specific, informed and unambiguous manner, before we use your data, for example, if you subscribe to product notifications by email or you consent to our use of cookies and other online tracking technologies when using the cookie banner on our site. You can withdraw your consent at any time in the ‘marketing preferences’ section of your account on our sites, using the cookie banner on our sites, or contacting us (see "Your rights" below).
Where we need to process your personal data to perform a contract with you or to take steps (at your request) before we enter into a contract with you. Where we rely on this basis and you do not give us the information we need, we will not be able to perform the contract.
Where processing is necessary for our legitimate interests and your own interests and fundamental rights do not override those interests. Before we rely on this basis, we consider and balance the possible impact on you (positive and negative). You can ask us for more information about how we carried out that balancing exercise for particular activities.
Where we need to use your personal data to comply with a legal or regulatory obligation. If we rely on this basis and you do not provide the information we need, we may be unable to fulfil a right you have or meet an obligation we owe to you, or we may need to take extra steps such as informing law enforcement, a public authority or applying for a court order.
The table below describes the ways we plan to use your personal data and any of the lawful bases we rely on to do so. The same processing activity may sometimes rely on more than one lawful basis, depending on the purpose. If you would like more details about the specific lawful basis we rely on, where more than one is listed below, please contact us.
| Purpose / Activity | Lawful basis for processing | Type(s) of personal data processed |
|---|---|---|
| To contact you about registering as a member in response to a referral from an existing member. | Necessary for our legitimate interests (to develop our products/services and grow our business) | Identification data; Contact details |
| To register you as a member | Performance of a contract with you | Identification data; Employment related information; Financial data; Contact details |
| To provide our service to you | Performance of a contract with you | Identification data; Employment related information; Financial data; Contact details; Transaction data; Usage data |
| To check your identity, age, and current or former employment documents so we can confirm that you are eligible for our service | Performance of a contract with you | Identification data Employment related information Contact details |
| To manage payments, fees and charges to collect and recover money owed to us | Performance of a contract with you Necessary for our legitimate interests (to recover debts owed to us) |
Identification data Employment related information Financial data Contact details Transaction data |
| To provide your physical membership card | Performance of a contract with you Necessary for our legitimate interests (to deliver items due to you) |
Identification data Employment related information Financial data Contact details Transaction data |
| To tell you about, and deliver, items you win or receive through one of our promotions | Performance of a contract with you Necessary for our legitimate interests (to deliver items due to you) |
Identification data Employment related information Financial data Contact details Transaction data |
| To manage our relationship with you, including: 1. telling you about changes to our terms or this notice; 2. arranging refunds where applicable; and 3. sending other service messages to you | Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records up to date and study how customers use our products/services) |
Identification data Employment related information Financial data Contact details Transaction data Opinion data Preferences data Technical browsing data Usage data |
| To let you buy or use digital shopping cards bought through our sites | Performance of a contract with you | Identification data Employment related information Financial data Contact details Transaction data Technical browsing data Usage data |
| To let you take part in prize draws, ticket ballots, gift giveaways or other competitions or promotions | Performance of a contract with you Necessary for our legitimate interests (to study how customers use our products and services, to develop them and grow our business) |
Contact details Opinion data |
| To let you complete surveys or reviews of our products and services | Necessary for our legitimate interests (to study how customers use our products and services, develop them and grow our business) | Opinion data Usage data |
| To invite you to take part in prize draws, ticket ballots, gift giveaways or other competitions or promotions | Necessary for our legitimate interests (to develop customers and grow our business); Unless you have previously opted out of such messages, in which case we rely on consent | Contact details Opinion data Preferences data |
| To invite you to complete surveys or reviews of our products and services | Necessary for our legitimate interests (to study how customers use our products and services, to develop them and grow our business) | Contact details |
| To let you take part in our loyalty and rewards programmes, including tracking qualifying transactions and providing you with rewards and recognition for your loyalty | Performance of a contract with you Necessary for our legitimate interests (to study how customers use our products and services, develop them and grow our business) |
Identification data Contact details Transaction data Usage data |
| To look at how you use our service so we can decide whether you are eligible to join our member panel or online community forum, and to invite you to take part | Necessary for our legitimate interests (to study how customers use our products and services, develop them and grow our business) | Identification data; Financial data; Contact details; Transaction data; Preferences data; Usage data |
| To run and protect our business and our sites (including troubleshooting, data analysis, testing, system maintenance, support, reporting and data hosting) | Necessary for our legitimate interests (for running our business, providing administration and IT services, network security, preventing fraud, and dealing with business reorganisation or group restructuring); Necessary to comply with a legal obligation | Identification data Employment related information Financial data Contact details Transaction data Technical browsing data Usage data |
| To provide a secure service and secure sites | Necessary for our legitimate interests (to keep your data secure); Necessary to comply with a legal obligation | Identification data Employment related information Financial data Contact details Transaction data Technical browsing data |
| To personalise your service, including giving you relevant site content, rewards, offers, discounts, marketing communications and advertisements | Where personalisation has a legal effect or similarly significant effect, consent For all other instances, necessary for our legitimate interests (to ensure that you receive relevant communications and content) |
Identification data Financial data Transaction data Preferences data Technical browsing data Usage data |
| To measure or understand how effective our marketing and advertising is, including pay-per-click advertising | Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy) | Identification data Opinion data Preferences data Technical browsing data Usage data |
| To use analytics to improve our sites, products/services, marketing, customer relationships and experiences | Necessary for our legitimate interests (to define customer types for our products and services, keep our sites updated and relevant, develop our business and inform our marketing strategy) | Identification data; Transaction data; Opinion data; Preferences data; Technical browsing data; Usage data |
| To make suggestions and recommendations to you about goods or services that may interest you | Necessary for our legitimate interests (to ensure that you receive relevant communications and content) | Identification data Contact details Transaction data Opinion data Preferences data Technical browsing data Usage data |
| To prevent fraud relating to products and services sold or used by us (or by third parties) | Necessary for our legitimate interests (to ensure that our services are used as intended); Compliance with a legal obligation | Identification data Employment related information Financial data Contact details Transaction data Usage data |
| To place orders with suppliers and manage payments to suppliers | Performance of a contract with you; Necessary for our legitimate interests (to buy goods and services for our business) | Identification data Financial data Contact details Transaction data Usage data |
| To calculate commission payable by our retail partners | Consent (where required when we use cookies or similar technologies); Necessary for our legitimate interests (to determine the attribution of commission following the redemption of a discount code, voucher or other offer type) | Financial data Transaction data Usage data |
| To deal with member questions, complaints and requests | Performance of a contract with you; Compliance with a legal obligation; Necessary for our legitimate interests (to provide a good service to members) | Identification data; Employment related information; Financial data; Contact details; Transaction data; Opinion data; Usage data |
| To send marketing communications by email, SMS, other forms of electronic mail, push notifications and in-account notifications | Consent, unless we can rely on the soft opt-in and you have not opted out, in which case we rely on necessary for our legitimate interests (to improve our service offering to you) | Identification data Contact details Technical browsing data Preferences data Usage data |
| To source and manage relationships with retail partners | Performance of a contract with you; Necessary for our legitimate interests (to improve our service offering to you) | Identification data Employment related information Transaction data Usage data |
| To share information with other companies in our group so we can provide an integrated service to members and support cross-company training and operational development | Necessary for our legitimate interests (to improve our service offering to you or to improve our business) | Identification data Employment related information Opinion data Usage data |
| To source and manage relationships with businesses whose employees, volunteers and/or members may be eligible to use our service | Performance of a contract with you; Necessary for our legitimate interests (to improve our service offering to you) | Identification data Employment related information Contact details Usage data |
| To comply with our legal obligations | Necessary to comply with a legal obligation | Identification data Employment related information Financial data Contact details Transaction data Preferences data Usage data |
| To audit our services and sites | Compliance with a legal obligation; Necessary for our legitimate interests (to ensure that we manage our service and sites in a compliant way) | Identification data; Employment related information; Financial data; Contact details; Transaction data; Usage data |
| To use automated systems or machine learning systems to carry out or help with any of the other purposes described in this table | Consent (if needed); Performance of a contract with you; Necessary for our legitimate interests (to improve our service offering to you); Compliance with a legal obligation | Identification data; Employment related information; Financial data; Contact details; Transaction data; Technical browsing data; Preferences data; Opinion data; Usage data |
We may use your personal data to work out which products, services or offers may interest you. This is known as “profiling”. We use profiling to decide which products, services and offers are likely to be relevant to you.
We give you choices about how we use your personal data for marketing and advertising.
If you have downloaded our app, and opted in to push notifications, we will send you push notifications. If you do not want to receive push notifications, you can change your preferences on your device settings or by updating your marketing preferences in your profile on our sites.
You can ask us to stop sending you marketing messages at any time by logging into your account on our sites and checking or unchecking relevant boxes in your marketing preferences, by clicking the ‘unsubscribe’ link in our marketing emails, or by contacting our member services team.
We may use automated processing or automated decision-making when providing services to you. How we do this depends on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum). If you are in Australia, see Appendix 2 (Australia Addendum).
Cookies are small text files stored by your device when you visit our sites. Cookies and tracking technologies allow information collected on one page or in one app session to be stored and used later, so websites and apps can provide a more personalised experience.
Our sites use cookies and tracking technologies. For more information about the cookies we use, please see our cookies policy.
We use social media platforms, including Meta (Facebook and Instagram) and TikTok, to build audiences for retargeting and lookalike advertising campaigns and to analyse engagement data. You can also ‘like’ or 'follow' our sites and service on those platforms using a button on our site.
For personal data processed for those purposes, we act as a joint controller with Meta and TikTok under the relevant data protection laws. We have entered into addendums with Meta Ireland, available here: Facebook, TikTok Information Technologies, available here: TikTok, and Youtube (via Google), available here: Google to set out each parties responsibilities as part of this joint processing.
More information on how Meta Ireland processes personal data, including the legal basis it relies on and how to exercise your rights against Meta Ireland, is available in Meta Ireland's Privacy Policy at https://www.facebook.com/about/privacy.
More information about how TikTok processes personal data, including the legal basis it relies on and how to exercise your rights against TikTok, is available in TikTok's Privacy Policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en.[AS1]
More information about how YouTube processes personal data, including the legal basis it relies on and how to exercise your rights against Youtube, is available in Google's unified Privacy Policy at https://policies.google.com/privacy.
More information about how Reddit processes personal data, including the legal basis it relies on and how to exercise your rights against Reddit, is available in Reddit's Privacy Policy at https://www.reddit.com/policies/privacy-policy.
We may share your personal data within our corporate group. This includes:
We may share your personal data with service providers who act as data processors for us, for the purposes described in this notice. These providers may help us with:
We may share information with our professional advisors (including our lawyers, auditors and insurers).
We may use automated methods (including machine learning or artificial intelligence systems) to process your personal data. For more information ‘Automated processing and automated decision making’ below.
When you click through to a retail partner's website or app (such as a comparison partner, energy partner or otherwise), that partner collects and controls any personal data you provide to it directly, under its own privacy notice.
We may disclose personal data if the police or other law enforcement agencies asks us to do so.
In some cases, we may share personal data with social media companies (such as Meta and Tiktok) so that we can show you relevant advertisements.
When you make a payment, your payment data is processed by our payment processor, on our behalf. Our payment processor also independently uses your payment data for its own purposes, including fraud detection, regulatory compliance and the improvement and development of its own products and services. You can read our payment processor's privacy policy here: stripe.com/gb/privacy .
Other payment methods are available on our sites such as Apple Pay and Google Pay.Those payment providers process your personal data under their own privacy policies, which are available on their own websites.
We may also share your personal data with third parties if we choose to sell, transfer or merge parts of our business or assets, or if we seek to acquire other businesses or merge with them. If our business changes in that way, the new owners may use your personal data in the same way described in this notice.
We will also disclose your personal data where we have a legal obligation to do so.
Data processing outside of your jurisdiction
Some of the disclosures described above involve recipients located outside your jurisdiction.
How we deal with transfers of personal data outside your jurisdiction depends on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum) for transfers outside the UK. If you are in Australia, see Appendix 2 (Australia Addendum) for transfers outside Australia.
We have put appropriate technical and organisational security measures in place to help prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed. We also limit access to your personal data to employees, agents, contractors and other third parties acting as our processors who have a business need to know it.
We have procedures to deal with suspected personal data breaches and where the law requires it, will notify you and any relevant regulator.
We use Transport Layer Security (TLS) to confirm our identity to your app or browser and to encrypt data sent between you and us.
We keep your personal data only for as long as is reasonably necessary to fulfil the purposes for which we collected it, including to meet legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for longer if there is a complaint, or if we reasonably believe there is a chance of legal proceedings relating to our relationship with you.
When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the personal data, the possible risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes in another way, and the legal, regulatory, tax, accounting and other requirements that apply.
Depending on where you are located, you may have certain rights under data protection laws in relation to your personal data. The rights available to you will differ depending on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum). If you are in Australia, see Appendix 2 (Australia Addendum).
If you want to exercise one of your rights, please contact us at dpo@bluelightcard.co.uk, submit a support ticket through our website or mobile apps, or if you are not logged in, use the contact form on our main homepage. If you want to exercise your right of access, we also provide a button in the My Account section on our website to enable you to easily request your personal data.
We do not sell products, or provide services, to children, or market to children.
Our site, apps and services are for adults and young people aged 16 and over. We do not knowingly collect personal data from anyone under 16.
You must provide your date of birth so that we can check that the products and services we advertise are suitable.
This Appendix gives additional information required under UK data protection laws, including the UK GDPR. It applies to you if you are located in the UK, and adds to the rest of this notice.
We may use several programs and applications which use machine learning and other AI-based forms of automated processing, or which amount to automated (or substantially automated) decision-making to support some parts of our operations.
Automated decision-making happens when an electronic system uses personal information to make a decision without (or with minimal) human involvement, and that decision has legal effects or similarly significant effects on an individual. Where we use automated methods (including machine learning or artificial intelligence systems) to process your personal data, we will comply with our transparency and other obligations under the UK GDPR.
Whenever we transfer your personal data outside the UK, we make sure it receives a similar level of protection by using safeguards required by law. For example:
If you ask to access, correct or delete personal data, we may take reasonable steps to check your identity before we give you access or take any other action. This helps protect your information.
You do not have to pay a fee to access your personal data or exercise your other rights. However, where the law allows it, we may charge a reasonable fee, for example if your request is clearly unfounded, repetitive or excessive, or where charging is necessary to cover our reasonable costs of giving you access.
Please note that in some situations the law does not require us to comply with your request.
We try to respond to all legitimate requests within one month. If your request is particularly complicated, or you have made several requests, it may take longer. If that happens, we will let you know and keep you updated.
You may have the right to ask for a copy of the personal data we hold about you, to check that we are processing it lawfully, or to ask us to correct it. This helps you make sure incomplete or inaccurate data is corrected, although we may need to check that the new data you give us is accurate.
You may have the right to ask us to correct personal data we hold about you. This allows you to have incomplete or inaccurate data corrected, although we may need to verify the accuracy of the new data you provide.
You may have the right to ask us to delete or remove personal data where there is no good reason for us to keep processing it. You may also have this right where you successfully object to processing (see below), where we may have processed your information unlawfully or where we must erase your personal data to comply with local law. However, there may be legal reasons why we cannot always comply with your request, and we will tell you if that applies.
You may have the right to ask us not to process your personal data for marketing purposes. We will tell you (before collecting your data) if we plan to use your data in that way. You may also have the right to object where we process your personal data on the basis of legitimate interests (see the table under ‘Specific uses of information you provide to us’ above) unless there are compelling reasons for the processing.
You may have the right to ask us to suspend the processing of your personal data if you want us to confirm the data's accuracy, if our use of the data is unlawful but you do not want us to erase it, if you need us to keep the data even though we no longer need it because you need for legal claims, or if you have objected to our use of your data, but we need to check whether we have overriding legitimate grounds to use it.
You may have the right to ask us to provide your personal data to you, or to a third party you choose, in a structured, commonly used, machine-readable format. This right only applies to automated information that you originally consented for us to use, or where we used the information to perform a contract with you.
Where applicable, you will have one month from the date we notify you that automated decision-making has taken place to make representations, challenge the decision, and/or ask us to make a new decision that is not based only on automated decision-making. Please also see the 'Automated decision-making' section above.
Where we rely on your consent to process personal data, you may have the right to withdraw that consent at any time. This will not affect any processing that was lawful before you withdrew consent. If you withdraw consent, we may not be able to provide some products or services to you, and we will tell you if that is the case at the time. You can also use our cookie banner to withdraw your consent to, or disable, processing of personal data included in cookies.
You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at www.ico.org.uk for data protection issues. However, in the first instance, please contact our DPO (dpo@bluelightcard.co.uk) so that we can understand and deal with your concerns. We will acknowledge your complaint within 30 days of receiving it and, without undue delay, take appropriate steps to investigate and respond to your complaint.
