Effective date: 10/11/2026
This policy explains how SUBTVU Ltd collects, uses, shares and retains personal information when you use the Defence Community Discounts website and mobile app (the Platform). Defence Community Discounts is a service operated by SUBTVU Ltd (company number 09758453). In this policy, “we”, “us” and “our” mean SUBTVU Ltd. It also explains how personal information is handled when you access Student Perks through the Platform.
1 Who we are
SUBTVU Ltd is responsible as controller for the personal information it uses to provide and manage the Defence Community Discounts Platform, including app accounts and core Platform activity.
Company number: 09758453Postal contact: SUBTVU Ltd, Vox Studios, Unit W205, 1–45 Durham St, Vauxhall, London, SE11 5JH.Privacy contact: [email protected]
Student Perks Ltd operates the Perks service and is the merchant of record for purchases. Its privacy policy explains its use of personal information for that service: https://studentperks.co.uk/privacy-policy. Section 6 explains the relationship and data exchange.
2 How we collect personal information
We collect information when you create or use an account, provide your mobile number for SMS verification during account creation, enter a verification code, choose to confirm your location on a military base, answer polls, browse offers, earn or redeem points, contact us, or use our website and app. We also receive relevant service information from Student Perks and use cookies and app software development kits (SDKs), subject to the choices described below.
3 Information we collect
• Account and profile information: name, email address, the verification code you used to confirm your eligibility, preferences and account identifiers, where required by the feature you use.
• Technical and usage information: IP address, device and operating system information, app identifiers, session records, pages or offers viewed and interactions with Platform features.
• Crash and performance information: crash and performance reports from the app, sent without your name or email address, so we can fix problems. You can turn these off in Settings.
• Authentication and notification information: you can register or sign in using Apple, Google or email. When you use Apple or Google, we receive the account information needed to authenticate you, such as an account identifier and the name or email address made available by that provider. We also collect your mobile number and process verification information using Google’s Firebase Authentication to send and check an SMS verification code when you create an account. We process information needed to manage email sign-in and device tokens used to deliver push notifications.
• Google sign-in and Firebase provide account authentication, SMS verification, push notifications and crash and performance reporting as described in this policy. – Google Privacy Policy – Firebase privacy information – Google account connections
• Apple sign-in enables account registration and authentication using your Apple account. – Privacy Policy– Manage your Apple account
• Location information: if you choose to confirm your eligibility by showing that you are on a military base or barracks, we use your device’s precise location, with your permission through your device settings, only to check that you are there. We do not store your device’s location, but we record which base you connected to and when. This is optional. You can withdraw location permission in your device settings at any time.
• Support, rewards and Perks information: enquiries, poll responses, preferences, points earned and redeemed, relevant order or refund status, gift cards, wallet information and attribution data exchanged with Student Perks.
You must be aged 16 or over to register with our website or mobile app. Please do not register if you are under 16.
4 Why we use information and our lawful bases
We use personal information only where we have an applicable lawful basis. The basis depends on the purpose:
• Providing an account and requested features: contractual necessity where the information is needed to deliver the service you request, including SMS verification at account creation, checking your eligibility using your verification code or, if you choose, your location, and access to Perks features.
• Handling support: contractual necessity for enquiries about your service, or our legitimate interest in answering other enquiries and resolving issues.
• Security and fraud prevention: our legitimate interests in protecting users, accounts and the Platform, and compliance with legal obligations where applicable.
• Service improvement and performance analysis: consent for Google Analytics linked to your account, which is off unless you turn it on. Our legitimate interest in understanding and improving the Platform for anonymous usage statistics counted in our own systems and for crash and performance reports, which are on unless you turn them off. You can change these choices at registration or in Settings.
• Personalising content and offers: our legitimate interest in providing relevant Platform content where appropriate, or consent where required. You may object to processing based on legitimate interests.
• Marketing emails, promotional push notifications, in-app marketing messages and invite and referral link attribution: consent, which you can give or withdraw at registration or in Settings. Service messages necessary to administer your account or requests are distinguished from promotional communications.
• Points and rewards: contractual necessity to administer the points scheme under the relevant terms, with separate consent for any optional marketing. This includes calculating points from qualifying purchases and referrals, maintaining balances, and administering redemptions and corrections.
• Legal and regulatory requirements: compliance with applicable legal obligations, including responding to valid requests from authorities.
Where we rely on legitimate interests, we assess the necessity of the processing and its impact on your rights and reasonable expectations.
5 Personalisation and marketing choices
We may use your selected interests, favourites and interactions to personalise content, offers and features. This may include grouping users by interests or activity. We do not use solely automated decisions that produce legal or similarly significant effects on you.
You choose whether to receive offers and perks by email, push notification and in-app message when you register. You can change this at any time in Settings, unsubscribe from marketing emails using the link in the email, or contact [email protected]. Device settings also let you manage push notifications. Withdrawing consent does not affect processing that was lawful before withdrawal.
If you object to direct marketing, we stop using your information for that purpose, including related profiling. We may keep a minimal suppression record to ensure we continue to respect your choice.
Consent to Defence Community Discounts marketing does not automatically constitute consent to marketing from Student Perks, retailers or sponsors. Any required permissions are obtained separately and identify the relevant organisation.
6 Student Perks and sharing personal information
We provide the Platform through which you access Perks. Student Perks Ltd operates the Perks service, sells and fulfils eligible purchases, and manages related payment and refund processes.
SUBTVU Ltd acts as controller for its Platform purposes. Student Perks Ltd acts as a separate controller where it determines how personal information is used to operate its service, including transactions and fulfilment. Each company is responsible for its own processing.
To provide integrated features, we may share your email address, Defence Community Discounts user or session ID, relevant order details and support information with Student Perks. Student Perks may return relevant purchase, gift card or wallet status, refund status and support information so that we can display your Perks activity and help resolve enquiries. Attribution information may also be exchanged to measure eligible referrals, campaigns and purchases.
Student Perks explains payment handling, fulfilment, refunds and its own retention arrangements at https://studentperks.co.uk/privacy-policy. For Student Perks privacy enquiries, contact [email protected]. We will help identify the appropriate company for a request and coordinate where necessary.
We may also share relevant information with:
• Hosting, authentication, SMS delivery and verification, analytics, notification, email, payment and support providers that help operate the Platform. These are Google Cloud (hosting and database), Firebase (sign-in, SMS verification, push notifications, crash and performance reports and Google Analytics), Intercom (support, in-app messages, marketing emails and push notifications), Mandrill (transactional emails such as account, order and deletion emails), and Stripe and TrueLayer (payments). We share your mobile number and necessary verification information with Google’s Firebase Authentication service to send and validate account-verification messages. Google also stores authentication phone numbers to improve spam and abuse prevention across its services, including Firebase.
• Attribution partners as described in section 7, including Branch for invite and referral links and, where used, affiliate networks, subject to required consent.
• The organisation that supplied your verification code, which can see which accounts have used that code to verify.
• Professional advisers, authorities or other recipients where necessary to comply with law, protect rights or deal with a business transfer, subject to applicable safeguards.
We do not sell your personal information. We may provide genuinely anonymised or aggregated campaign statistics to partners where individuals are not identifiable.
7 Cookies and tracking technologies
We use cookies and similar technologies, including app SDKs, for login and security, feature delivery, performance monitoring, analytics and attribution. We obtain consent before storage or access that requires it. Where a legal exception applies, we meet its conditions and provide any required information and means to object.
You can manage your tracking choices when you register and at any time in Settings. Analytics (Google Analytics linked to your account) and invite and referral links are off unless you turn them on. Usage statistics, which count how screens and perks are used without linking this to your account, and crash reports, which are sent without your name or email address, are on unless you turn them off. Browser and device settings provide additional controls. Refusing optional tracking should not prevent use of features that do not require it.
We may measure link clicks in our emails, using tracked links, to understand campaign performance. Where consent is required for this tracking, we obtain it before enabling the tracking. You can unsubscribe from marketing emails using the link in each email or contact [email protected] about your tracking choices.
We use Branch for deep linking and attribution. Depending on the function and configuration, it may process technical identifiers, IP addresses, device information and referral sources to route you to content and measure campaign performance. Essential routing functions are assessed separately from optional attribution. We obtain consent where required; legitimate interests do not replace required device-tracking consent. The invite and referral links choice in Settings controls whether the app can see which link you installed from.
• Branch provides deep linking and attribution to route you to content and measure campaign performance. – Privacy Policy – Opt Out
We may use affiliate networks and tracking providers within the Platform, such as Tradedoubler, Awin, CJ and Impact, which can supply unique discount codes. This tracking may record referrals and resulting purchases to attribute performance, rewards or commissions. Student Perks may receive the resulting attribution data. We manage consent for tracking we initiate where required, and Student Perks is responsible for its subsequent processing as described in its policy.
Using provider privacy controls
The provider links in this policy explain how our named providers handle information and the privacy choices they offer. They supplement our website and in-app consent controls. Some controls require you to sign in or apply only to a particular account, browser or device. Sign-in controls manage account connections; they are not advertising opt-outs.
Use the Analytics choice in Settings to turn Google Analytics in the app on or off. For Firebase verification data, contact [email protected] as described in section 9. You can delete your account in the app at any time.
8 How long we keep information
We retain personal information only for as long as necessary for the relevant purpose. Our systems delete or anonymise information automatically when the periods below end.
Account, reward and entitlement records: we retain the minimum account identifiers, points balances and supporting records needed to administer outstanding points, rewards and gift-card access while your account is open. Qualifying purchases and referrals contribute to a rewards ledger recording the relevant event or reference, date, points awarded, applicable reward rule and any adjustment or redemption.
Gift-card validity varies by retailer and product, from 12 months to no expiry. When your account is deleted, we first email you links to all your gift cards so you keep access to them, and our support team can still see the gift card codes for 30 days afterwards to help with any problems. This does not require retention of unrelated browsing or other activity.
If you do not open the app for five years, we delete your account automatically. We email you 30 days beforehand, and opening the app keeps your account. Any unused points are deleted with your account.
When you delete your account in the app, we email you to confirm and complete the deletion automatically after seven days. When an account is deleted, by you or for inactivity, we delete your personal information from our systems and from Google Analytics, Branch, Intercom and Firebase, except the records listed below that we must keep for longer. Deleted information is removed from our backups within a further 14 days.
Once an entitlement has ended, we delete or anonymise its supporting records when they are no longer needed, subject to any specific legal or unresolved dispute requirements. Keeping records for entitlement administration does not extend permission to use them for marketing.
Ordinary app usage and analytics: records not needed to establish or administer an entitlement are deleted or anonymised automatically on the schedules below. We do not retain detailed usage histories simply because points or gift cards remain outstanding.
• Support and enquiry records: kept in Intercom until your account is deleted.
• Marketing contact and engagement records, including marketing emails and push notifications sent through Intercom: until your account is deleted. We stop relevant marketing if you unsubscribe, withdraw consent or object, and may retain a minimal suppression record to respect your preferences.
• Google Analytics for Firebase user-level and event-level data: 14 months, or until your account is deleted if sooner. The applicable period and any reset on new activity depend on the data type and configuration.
• Google Analytics for Firebase provides app analytics, which you can turn on or off in Settings. – Privacy Policy
• Account information, including the verification code you used and any base you connected to: until your account is deleted.
• Sign-in records held by Firebase Authentication: until your account is deleted. Google then removes them from its systems within 180 days.
• Order and credit records: six years after your account is deleted, to meet tax and accounting requirements. After that, we keep only the amounts, without anything that identifies you.
• Payment records and checkout quotes from our payment providers: 14 months.
• Data protection requests and complaints: six years after they are closed.
• Rate-limit records, which can include your IP address: seven days.
• Server logs, which can include your IP address: 30 days.
• System and administration records that refer to your account: background job records 30 days, alerts two years and our administration audit log six years.
• Crash reports: 90 days. Performance data: up to 60 days. These are Firebase’s own retention periods.
• Genuinely anonymised statistical information: may be retained for longer-term trend analysis where it no longer identifies you.
We may retain specific records for longer where necessary to meet legal obligations or establish, exercise or defend legal claims. We review these exceptions and delete or anonymise information once it is no longer needed.
Student Perks applies its own retention periods to records it controls. We retain the reward and entitlement information needed for our own services; this does not require duplicating Student Perks’ full payment records. Deleting a Defence Community Discounts account does not necessarily remove transaction records that Student Perks must retain. We explain any necessary retained records when handling deletion requests.
9 Your data protection rights
Subject to the applicable conditions and exceptions, you can request access to your personal information, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where processing relies on it.
You can delete your account in the app at any time, and make a data request or complaint in Settings. You can also contact [email protected] to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month and will explain any lawful extension.
You can complain to the Information Commissioner’s Office at https://ico.org.uk. You may contact us first to help resolve your concerns, but you are not required to do so.
10 International transfers
We store your account and app data in a database hosted on Google Cloud in London, UK, and our servers run in the same region. Database backups are stored in the EU. Some of our service providers process information in the United States: Firebase Authentication (sign-in and SMS verification), Intercom (support and marketing messages), Branch (invite and referral links), Mandrill (transactional emails) and Stripe (payments). Google Analytics, crash and performance reporting and our server logs run on Google’s global infrastructure. Our service providers may process information in the UK, the EEA or other countries. Where a transfer is restricted under UK data protection law, we use an applicable adequacy regulation or appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge), the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, as relevant. We carry out any required transfer assessment and apply additional safeguards where necessary.
You can contact [email protected] for information about the safeguards applicable to your information and how to obtain a copy.
11 Security
We use appropriate technical and organisational measures to protect personal information, including access controls and security measures proportionate to the risks. No system is completely secure. Please protect your sign-in credentials and contact us if you suspect misuse of your account.
12 Third party services
The Platform may contain links to third-party websites or services. Their own privacy notices explain their processing. Where we embed third-party content or initiate tracking, we remain responsible for our own processing and applicable consent obligations.
13 Changes to this policy
We may update this policy as our services or legal obligations change. The current version and effective date will be published at https://www.defencecommunitydiscounts.co.uk/privacy-policy. We will bring material changes to your attention as appropriate and obtain fresh consent where required before introducing processing that depends on it.
14 Contact us
For questions about our use of personal information, contact [email protected] or write to SUBTVU Ltd, Vox Studios, Unit W205, 1–45 Durham St, Vauxhall, London, SE11 5JH.