Blue Light Card respects your privacy and is committed to protecting your personal data.
This notice explains how we collect and use your personal data when you use our websites or mobile apps (together our “sites”), use our services or otherwise contact us.
Our sites are not to be used by children, and we do not knowingly collect personal data about children.
Please read this privacy notice together with any other notice that we give you so that you fully understand how and why we use your data. This notice adds to those other notices but does not replace them.
Blue Light Card means
If you are a member or user in the UK, Blue Light Card Ltd is the controller of your personal data.
If you are a member or user in Australia, depending on the processing that we are carrying out, either Blue Light Card Ltd in the UK or Blue Light Card Pty Ltd in Australia will be the entity responsible for your personal information. This is because some of our services that involve processing your personal information are provided centrally by Blue Light Card Ltd in the UK.
Blue Light Card Ltd is compliant with UK GDPR and Blue Light Card Pty Ltd is compliant with the Privacy Act1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles.
Your rights, and our obligations, may differ depending on whether you are in the UK or Australia. Where that happens, we explain the difference in Appendix 1 (UK Addendum) and Appendix 2 (Australia Addendum) of this notice.
We have appointed a data protection officer (“DPO”) to deal with questions about this notice and requests to exercise your legal rights. You can contact the DPO at:
Blue Light Card Ltd, Charnwood Edge Business Park, Syston Road, Leicester, United Kingdom, LE7 4UZ
The process for complaining about a data protection issue, and your rights, will differ depending on whether you are in the UK or Australia. If you are in the UK, please see Appendix 1 (UK Addendum). If you are based in Australia, please see Appendix 2 (Australia Addendum).
We review this privacy notice regularly.
This notice was last updated on 21/07/2026.
It is important that the personal data we hold about you is accurate and up to date. Please tell us if your personal data changes during your relationship with us. You can update some of your details in the ‘personal information’ section of your account on our sites.
Our sites may include links to third-party websites, plug-ins and applications. If you click those links or enable those connections, third parties may collect or share data about you. We do not control those third-party sites and are not responsible for their privacy notices. When you leave our sites, we encourage you to read the privacy notice of the website or app that you visit.
Information we collect
We may process the following types of personal data about you:
We also collect, use and share aggregated data (such as statistical or demographic data) for any purpose. Aggregated data may come from your personal data, but is not personal data because it does not identify you. If we combine aggregated data with your personal data so that you can be identified, we treat the combined data as personal data and use it under this notice. We may share anonymised data with other companies to help them improve their services, understand how effective their services and offers are, and to recruit new prospects and/or retail partners.
We do not ask for, use or intentionally collect special categories of personal data (also called 'sensitive information') such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health or genetic and biometric data. If you give us any special category data, we will delete this in line with our retention policies.
Sometimes the law, or a contract we have with you, requires you to give us personal data. If you do not provide the information we ask for, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide goods or services).If that happens, we may cancel a product or service you have with us, but we will tell you at the time.
We may collect data from and about you:
After you first sign in, you may choose to sign into our app using your fingerprint or a facial recognition scan. Any personal data included in that process is collected and processed on your device in line with the relevant third party’s own policies and procedures. We do not receive or process that personal data.
Affiliate Networks
We work with several affiliate networks to provide our service. We will usually be a controller with those affiliate networks (to the extent that the classification of a 'controller' is relevant) under the relevant data protection laws for the purpose of tracking commission payable by advertisers to us, mainly through cookies, third-party tracking pixels, and other tracking technologies (please see our cookies policy for details). Where an affiliate network acts as an independent controller for some processing, you may exercise your rights either against us, as explained in this notice, or against the affiliate network, using the privacy notice for that network. The networks listed in the original notice are:
We also work with additional affiliate networks beyond those listed above, including affiliate networks based in Australia. If you have questions about those networks, please contact our DPO at dpo@bluelightcard.co.uk.
Specific uses of information you provide to us
How we use your personal data
We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose is listed below. Usually, we rely on the following:
Consent
Where you have freely consented, in a specific, informed and unambiguous manner, before we use your data, for example, if you subscribe to product notifications by email or you consent to our use of cookies and other online tracking technologies when using the cookie banner on our site. You can withdraw your consent at any time in the ‘marketing preferences’ section of your account on our sites, using the cookie banner on our sites, or contacting us (see "Your rights" below).
Performance of a contract with you
Where we need to process your personal data to perform a contract with you or to take steps (at your request) before we enter into a contract with you. Where we rely on this basis and you do not give us the information we need, we will not be able to perform the contract.
Necessary for our legitimate interests
Where processing is necessary for our legitimate interests and your own interests and fundamental rights do not override those interests. Before we rely on this basis, we consider and balance the possible impact on you (positive and negative). You can ask us for more information about how we carried out that balancing exercise for particular activities.
Necessary to comply with a legal obligation
Where we need to use your personal data to comply with a legal or regulatory obligation. If we rely on this basis and you do not provide the information we need, we may be unable to fulfil a right you have or meet an obligation we owe to you, or we may need to take extra steps such as informing law enforcement, a public authority or applying for a court order.
Purposes for which we will use your personal data
The table below describes the ways we plan to use your personal data and any of the lawful bases we rely on to do so. The same processing activity may sometimes rely on more than one lawful basis, depending on the purpose. If you would like more details about the specific lawful basis we rely on, where more than one is listed below, please contact us.
We may use your personal data to work out which products, services or offers may interest you. This is known as “profiling”. We use profiling to decide which products, services and offers are likely to be relevant to you.
We give you choices about how we use your personal data for marketing and advertising.
If you have downloaded our app, and opted in to push notifications, we will send you push notifications. If you do not want to receive push notifications, you can change your preferences on your device settings or by updating your marketing preferences in your profile on our sites.
You can ask us to stop sending you marketing messages at any time by logging into your account on our sites and checking or unchecking relevant boxes in your marketing preferences, by clicking the ‘unsubscribe’ link in our marketing emails, or by contacting our member services team.
Automated processing and automated decision making
We may use automated processing or automated decision-making when providing services to you. How we do this depends on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum). If you are in Australia, see Appendix 2 (Australia Addendum).
Cookies
Cookies are small text files stored by your device when you visit our sites. Cookies and tracking technologies allow information collected on one page or in one app session to be stored and used later, so websites and apps can provide a more personalised experience.
Our sites use cookies and tracking technologies. For more information about the cookies we use, please see our cookies policy.
Social Media
We use social media platforms, including Meta (Facebook and Instagram) and TikTok, to build audiences for retargeting and lookalike advertising campaigns and to analyse engagement data. You can also ‘like’ or 'follow' our sites and service on those platforms using a button on our site.
For personal data processed for those purposes, we act as a joint controller with Meta and TikTok under the relevant data protection laws. We have entered into addendums with Meta Ireland, available here: Facebook, TikTok Information Technologies, available here: TikTok, and Youtube (via Google), available here: Google to set out each parties responsibilities as part of this joint processing.
More information on how Meta Ireland processes personal data, including the legal basis it relies on and how to exercise your rights against Meta Ireland, is available in Meta Ireland's Privacy Policy at https://www.facebook.com/about/privacy.
More information about how TikTok processes personal data, including the legal basis it relies on and how to exercise your rights against TikTok, is available in TikTok's Privacy Policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en.
More information about how YouTube processes personal data, including the legal basis it relies on and how to exercise your rights against Youtube, is available in Google's unified Privacy Policy at https://policies.google.com/privacy.
More information about how Reddit processes personal data, including the legal basis it relies on and how to exercise your rights against Reddit, is available in Reddit's Privacy Policy at https://www.reddit.com/policies/privacy-policy.
Disclosure and sharing of your information
We may share your personal data within our corporate group. This includes:
We may share your personal data with service providers who act as data processors for us, for the purposes described in this notice. These providers may help us with:
We may share information with our professional advisors (including our lawyers, auditors and insurers).
We may use automated methods (including machine learning or artificial intelligence systems) to process your personal data. For more information ‘Automated processing and automated decision making’ below.
When you click through to a retail partner's website or app (such as a comparison partner, energy partner or otherwise), that partner collects and controls any personal data you provide to it directly, under its own privacy notice.
We may disclose personal data if the police or other law enforcement agencies asks us to do so.
In some cases, we may share personal data with social media companies (such as Meta and Tiktok) so that we can show you relevant advertisements.
When you make a payment, your payment data is processed by our payment processor, on our behalf. Our payment processor also independently uses your payment data for its own purposes, including fraud detection, regulatory compliance and the improvement and development of its own products and services. You can read our payment processor's privacy policy here: stripe.com/gb/privacy .
Other payment methods are available on our sites such as Apple Pay and Google Pay.Those payment providers process your personal data under their own privacy policies, which are available on their own websites.
We may also share your personal data with third parties if we choose to sell, transfer or merge parts of our business or assets, or if we seek to acquire other businesses or merge with them. If our business changes in that way, the new owners may use your personal data in the same way described in this notice.
We will also disclose your personal data where we have a legal obligation to do so.
Data processing outside of your jurisdiction
Some of the disclosures described above involve recipients located outside your jurisdiction.
How we deal with transfers of personal data outside your jurisdiction depends on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum) for transfers outside the UK. If you are in Australia, see Appendix 2 (Australia Addendum) for transfers outside Australia.
Data security
We have put appropriate technical and organisational security measures in place to help prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed. We also limit access to your personal data to employees, agents, contractors and other third parties acting as our processors who have a business need to know it.
We have procedures to deal with suspected personal data breaches and where the law requires it, will notify you and any relevant regulator.
We use Transport Layer Security (TLS) to confirm our identity to your app or browser and to encrypt data sent between you and us.
Data retention
We keep your personal data only for as long as is reasonably necessary to fulfil the purposes for which we collected it, including to meet legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for longer if there is a complaint, or if we reasonably believe there is a chance of legal proceedings relating to our relationship with you.
When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the personal data, the possible risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes in another way, and the legal, regulatory, tax, accounting and other requirements that apply.
Your rights
Depending on where you are located, you may have certain rights under data protection laws in relation to your personal data. The rights available to you will differ depending on whether you are in the UK or Australia. If you are in the UK, see Appendix 1 (UK Addendum). If you are in Australia, see Appendix 2 (Australia Addendum).
If you want to exercise one of your rights, please contact us at dpo@bluelightcard.co.uk, submit a support ticket through our website or mobile apps, or if you are not logged in, use the contact form on our main homepage. If you want to exercise your right of access, we also provide a button in the My Account section on our website to enable you to easily request your personal data.
Other matters
Use of our site and services by children
We do not sell products, or provide services, to children, or market to children.
Our site, apps and services are for adults and young people aged 16 and over. We do not knowingly collect personal data from anyone under 16.
You must provide your date of birth so that we can check that the products and services we advertise are suitable.
Appendix 1: UK Addendum
This Appendix gives additional information required under UK data protection laws, including the UK GDPR. It applies to you if you are located in the UK, and adds to the rest of this notice.
Automated decision-making
We may use several programs and applications which use machine learning and other AI-based forms of automated processing, or which amount to automated (or substantially automated) decision-making to support some parts of our operations.
Automated decision-making happens when an electronic system uses personal information to make a decision without (or with minimal) human involvement, and that decision has legal effects or similarly significant effects on an individual. Where we use automated methods (including machine learning or artificial intelligence systems) to process your personal data, we will comply with our transparency and other obligations under the UK GDPR.
Data processing outside of the UK
Whenever we transfer your personal data outside the UK, we make sure it receives a similar level of protection by using safeguards required by law. For example:
Your rights
If you ask to access, correct or delete personal data, we may take reasonable steps to check your identity before we give you access or take any other action. This helps protect your information.
You do not have to pay a fee to access your personal data or exercise your other rights. However, where the law allows it, we may charge a reasonable fee, for example if your request is clearly unfounded, repetitive or excessive, or where charging is necessary to cover our reasonable costs of giving you access.
Please note that in some situations the law does not require us to comply with your request.
We try to respond to all legitimate requests within one month. If your request is particularly complicated, or you have made several requests, it may take longer. If that happens, we will let you know and keep you updated.
Access to your personal data
You may have the right to ask for a copy of the personal data we hold about you, to check that we are processing it lawfully, or to ask us to correct it. This helps you make sure incomplete or inaccurate data is corrected, although we may need to check that the new data you give us is accurate.
Correction of your personal data
You may have the right to ask us to correct personal data we hold about you. This allows you to have incomplete or inaccurate data corrected, although we may need to verify the accuracy of the new data you provide.
Erasure of your personal data
You may have the right to ask us to delete or remove personal data where there is no good reason for us to keep processing it. You may also have this right where you successfully object to processing (see below), where we may have processed your information unlawfully or where we must erase your personal data to comply with local law. However, there may be legal reasons why we cannot always comply with your request, and we will tell you if that applies.
Objection to processing
You may have the right to ask us not to process your personal data for marketing purposes. We will tell you (before collecting your data) if we plan to use your data in that way. You may also have the right to object where we process your personal data on the basis of legitimate interests (see the table under ‘Specific uses of information you provide to us’ above) unless there are compelling reasons for the processing.
Request restriction of processing
You may have the right to ask us to suspend the processing of your personal data if you want us to confirm the data's accuracy, if our use of the data is unlawful but you do not want us to erase it, if you need us to keep the data even though we no longer need it because you need for legal claims, or if you have objected to our use of your data, but we need to check whether we have overriding legitimate grounds to use it.
Request to transfer your personal data
You may have the right to ask us to provide your personal data to you, or to a third party you choose, in a structured, commonly used, machine-readable format. This right only applies to automated information that you originally consented for us to use, or where we used the information to perform a contract with you.
Rights regarding automated decision-making
Where applicable, you will have one month from the date we notify you that automated decision-making has taken place to make representations, challenge the decision, and/or ask us to make a new decision that is not based only on automated decision-making. Please also see the 'Automated decision-making' section above.
Withdraw consent at any time
Where we rely on your consent to process personal data, you may have the right to withdraw that consent at any time. This will not affect any processing that was lawful before you withdrew consent. If you withdraw consent, we may not be able to provide some products or services to you, and we will tell you if that is the case at the time. You can also use our cookie banner to withdraw your consent to, or disable, processing of personal data included in cookies.
Complaints
You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at www.ico.org.uk for data protection issues. However, in the first instance, please contact our DPO (dpo@bluelightcard.co.uk) so that we can understand and deal with your concerns. We will acknowledge your complaint within 30 days of receiving it and, without undue delay, take appropriate steps to investigate and respond to your complaint.
Appendix 2: Australia Addendum
This Appendix gives additional information required under the Privacy Act in Australia, including the Australian Privacy Principles (APPs). It applies to you if you are located in Australia, and adds to the rest of this notice
Automated processing and automated decision making
We may use several programs and applications which use machine learning and other AI-based forms of automated processing, or which amount to automated (or substantially automated) decision-making to support some parts of our operations.
In those circumstances, personal information may be processed in connection with such tools. Your personal information may also be used together with the outputs of these tools (and other AI tools).
The level of human involvement varies depending on the use case, and can range from partial human oversight to full human oversight and approval.
Data processing outside of Australia
Personal information may be transferred outside of Australia to Blue Light Card Ltd (our group company in the UK). We may also transfer personal information to recipients outside of Australia, including recipients in the US, UK, and EU.
Whenever we transfer your personal information outside of Australia, we ensure a similar level of protection is provided by taking safeguards required by law. For example, we will take reasonable steps to ensure overseas recipients do not breach the APPs.
Your rights
Under the Privacy Act, you have the right to ask for access to personal information that we hold about you and to ask us to correct it. In some circumstances, the law does not require us to give you access to or correct your personal information.
There is no charge for asking for access to your personal information, but we may ask you to cover our reasonable costs of giving you access (such as photocopying costs or costs for time spent gathering large amounts of material).
We will respond to your requests within a reasonable time and take all reasonable steps to ensure that the personal information we hold about you remains accurate, and up to date.
Complaints
If you are concerned about how we handle your personal information, or you want to exercise your rights under the Privacy Act, please contact us first at dpo@bluelightcard.co.uk. We will consider your complaint and decide whether it needs further investigation, and we will tell you the outcome at the time.
If you are not satisfied with our response, or we do not respond within a reasonable time, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, or contact an external advisor about other possible options.