Digital Concierge Application: privacy notice

Last updated: 15/07/2026

Who is responsible for your data

The Ministry of Defence (MOD) is the data controller for personal data processed through the Digital Concierge Application (“the App”), which supports Royal Navy and RAF recruitment events.

Identity Events Management Ltd (“Identity”, “we”) built and operates the App and processes your personal data on the MOD's behalf as its data processor. This notice supplements our main privacy notice, available at Privacy Policy - Identity Global. Where this notice and the main notice differ, this notice applies to the App.

Read this notice together with the App's Terms and Conditions and Cookie Notice.

You can contact Identity's Data Protection Officer at dpo@identityglobal.com. We handle requests and questions about the App on the MOD's behalf.

How the Digital Concierge works and where your data flows

The Digital Concierge has two parts, and they handle data differently:

The website (where you are reading this) is a standard web page. It can set cookies on your device, listed in the Cookie Notice

The WhatsApp chat experience works differently. The App is a WhatsApp based service used at Royal Navy and RAF recruitment events. The chat is an automated decision tree; your messages receive pre-set automated responses, and no person reads or replies to them.

When you scan the QR code at an event stand, WhatsApp opens on your phone. No cookies are set on your device by this process. Your messages travel along this path:

1. Your phone, in the WhatsApp app
2. WhatsApp (Meta), which routes the message
3. Twilio, the platform running the automated quiz
4. Identity's content management system, hosted in Microsoft Azure's UK South region (a data centre located in the United Kingdom), where responses are stored

The Privacy Notice explains what personal data is processed in the chat, how long it is kept, and your rights.

What personal data we collect

We collect only the data needed to run the service and measure event effectiveness:

• Confirmation that you have agreed to the terms and privacy notice
• Confirmation that you are a UK or Commonwealth citizen (if you answer no, the conversation ends and nothing further is collected)
• Confirmation that you are older than 15 years and 9 months
• The alias or name you type into the chat
• The event you attended and timestamps for your record
• RAF events only: a pseudonymous identifier assigned by WhatsApp (a “business-scoped user ID”), which cannot identify you outside Identity's WhatsApp account

Your answers to the profession quiz and, at Royal Navy events, the post event survey are stored separately with no link to you. They are anonymous and cannot be traced back to you.

We do not read your other WhatsApp messages. Your use of WhatsApp itself is subject to WhatsApp's own privacy policy.

Why your data is processed and the lawful basis

Your personal data is processed to:

• run the chat experience and provide your profession or role result
• measure the effectiveness of individual events

The lawful basis is your consent (UK GDPR Article 6(1)(a)). You give consent at the start of the WhatsApp conversation, before any personal data is recorded. Identity collects this consent on the MOD's behalf. Participation is voluntary; you choose to scan the QR code and you can stop at any time.

You can withdraw consent at any time by emailing dpo@identityglobal.com. Your personal data will then be deleted and deletion confirmed to you.

Who your data is shared with

• Royal Navy: receives anonymised reports only. It never receives your name, number or any data that identifies you. Royal Navy Privacy Notice
• RAF: receives anonymised reports. It also receives an encrypted file of mobile numbers and event IDs, sent securely. Royal Air Force Privacy Notice
• Meta (WhatsApp Cloud API), which routes messages
• Twilio, which runs the automated chat flow and processes messages in transit only
• Microsoft Azure, which hosts our database in Identity's environment

International transfers

Some of these providers are headquartered in the United States. Where personal data is transferred to the US:

• Transfers to Twilio are made under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which Twilio holds an active certification. Twilio's data protection addendum also provides UK approved contractual safeguards as a fallback.
• Transfers to Meta/WhatsApp Business are made under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which WhatsApp hold an active certification. WhatsApp also have UK Data Transfer Addendum which apply UK Standard Contractual Safeguards as a backup.

How long your data is kept

Your personal data is kept for no more than six weeks from the final day of the event you attended, after which it is deleted from our systems. Anonymous quiz and survey answers are not personal data and may be kept longer for analysis.

Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data
• correct inaccurate data
• have your data deleted
• restrict or object to processing
• withdraw consent at any time

To exercise any of these rights, email dpo@identityglobal.com. Identity will action your request on the MOD's behalf and respond within one month.

If you are unhappy with how your data is handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Age requirement

The App is intended for people aged 15 years and 9 months or older. Please do not use it if you are younger.