Student Castle Privacy Policy

This privacy policy governs the collection, storage and use of personal information collected by us at Student Castle Limited ("we", "us" or "our") and our Group Companies. We take privacy seriously and we are committed to protecting it.

This privacy policy explains when and why we and our Group Companies collect personal information about individuals who are customers, prospective future customers, previous customers and other individuals who may be connected to them, how this information is used, the conditions under which it may be disclosed to others and how it is kept secure. Specifically, this privacy policy describes the following important topics relating to your information (you can click on the links to find out more):

  1. Who we are;
  2. Who this privacy policy applies to;
  3. How we collect personal information;
  4. What personal information do we collect and why;
  5. Special categories of data;
  6. Other processing of your personal information;
  7. Our legal basis for using your personal information;
  8. Aggregate and non-personal information;
  9. Others who may receive or have access to your personal information;
  10. How long we keep your personal information for;
  11. Data security;
  12. International transfers;
  13. Cookies;
  14. Minors;
  15. Marketing;
  16. Your rights;
  17. Links to other websites; and
  18. Contacting us.

This privacy policy may change from time to time. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by post or email. Please check this page frequently to ensure that you’re aware of any updates or changes to our privacy policy. This privacy policy was last updated on 15 October 2019.

1. Who we are

Student Castle Limited is a company registered in England and Wales (registration number 07119911), whose registered office is at Kintyre House, 70 High Street, Fareham, Hampshire PO16 7BB. This privacy policy also applies to personal information which is collected or controlled by the following group companies: SC Walmgate Management Limited (company registered number 08220322), SC Mitchams Corner Management Limited (company registered number 08444935), SC Pulteney Road Management Limited (company registered number 09053826), SC Causewayside Limited (company registered number 10416197), SC Claypath Management Limited (company registered number 08882637), SC Osney Lane Management Limited (company registered number 08253813) and SC Pelham Terrace Management Limited (company registered number 08451716) whose registered offices are at Kintyre House, 70 High Street, Fareham, Hampshire PO16 7BB ("Group Companies").

We respect your right to privacy and will only process personal information you provide to us in accordance with the General Data Protection Regulation 2016/679 ("GDPR") and other applicable privacy and/or data protection laws.

If you have any questions about how we collect, store and use personal information, or if you have any other privacy-related questions, please contact us by any of the following means:

^ Back to top

2. Who this privacy policy applies to

Depending on our relationship, we will collect and use your personal information in different ways. Please click on the sub-headings below to find out more about the personal information that we collect about you and how we use this personal information:

  1. Visitors to our Website
  2. Resident
  3. Language school resident
  4. Guarantor
  5. Short stay guest
  6. Resident's family member

^ Back to top

3. How we collect personal information

We collect personal information from you when you register on our Website, make a reservation or enquiry, request additional information and manage your personal details on your account. We may also receive information about you from third parties such as our Group Companies as well as marketing agencies, market research companies, accommodation reservation agencies, our suppliers, which we refer to collectively as "suppliers" throughout this policy.

We also collect personal information from you in the following ways when you give us your personal information by, for example:

  • Submitting an application to lease accommodation from us;
  • Visiting our website, www.studentcastle.co.uk ("Website");
  • Using our web or mobile applications ("Apps");
  • Viewing or following our channels on any social media platforms;
  • Corresponding with us by phone, email or otherwise;
  • Attending one of our organised events; and
  • Showing interest at a university accommodation fair or event.

^ Back to top

4. What personal information do we collect and why

The personal information we collect, and why we collect it, varies depending on the nature of our relationship with you. In the following tables, we explain for each type of relationship what personal information we collect, the purpose for which we collect and use your personal information, and our legal basis for processing your personal information for that purpose.

A. Visitors to our Website

We, or third parties on our behalf, will collect and use the following personal information about you if you are a visitor to our Website:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Browser IP address We use this to identify you when you return to our Website Legitimate interests
Usage data (recording the time and date you access documentation on our Website) We use this to improve our marketing and understanding of how our customers use our Website and Apps so we can make improvements
Contact details (first and last name, email address)
  • To allow us to answer any messages you send via our Website
  • To enable you to sign in to our online portal
Legitimate interests
Performance of a contract
Cookie data (for more information, see section 13 and also our Cookie policy) For more information, see the 'Cookies' section 13 and also our Cookie policy For more information, see the 'Cookies' section 13 and also our Cookie policy
Information provided when you correspond with us We use this to deal with any enquiries or issues you have about our service and to provide customer support Performance of a contract
B. Resident

We, or third parties on our behalf, will collect and use the following personal information about you if you are a resident:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Contact details and emergency contact details (first and last name, address, email address, telephone and mobile numbers)
  • To allow us to register you and process your application
  • To enable us to arrange and conduct viewings with you of our accommodation
  • To address, send or otherwise communicate a message to you
  • To confirm your acceptance of our sublicensing policy, acceptable behaviour policy, drugs policy and visitor policy
  • To enable us to give you access to the gym on your site
  • To collect payments from you or return money owed to you
  • For accounting and banking purposes
  • Performance of a contract
  • Legal obligation
  • Legitimate interests
Signature
  • To allow us to register you and process your application
  • To confirm your acceptance of our gym disclaimer and/or bike scheme
  • To confirm your acceptance of our sublicensing policy, acceptable behaviour policy, drugs policy and visitor policy
Personal details (student ID, student number, date of birth, gender preference, nationality, citizenship, country of residence, university/college, course, study year)
  • To allow us to register you and process your application
  • To enable us to arrange and conduct viewings with you of our accommodation
  • For accounting and banking purposes
  • To prevent and detect fraud, money laundering, other crime, and security issues
  • Performance of a contract
  • Legitimate interests
Payment details and related information (bank details, method, card details, account type, authorisation codes, transaction location, and description, cardholder name and address)
  • To collect payments from you or return money owed to you
  • To prevent and detect fraud, money laundering, other crime, and security issues
Identification information (proof of identity and address) To allow us to register you and process your application Performance of a contract
Information in relation to your stay (date of reservation, licence period, payment dates, room number)
Student loan payment schedule To allow us to delay a rent payment
Council tax exemption certificate and deposit protection certificate
  • To ensure you are exempt from paying council tax (if applicable)
  • To secure your deposit
Legal obligation
Medical information To enable us to give you access to the gym on your site Consent
C. Language school resident

We, or third parties on our behalf, will collect and use the following personal information about you if you are a language school resident:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Contact details and emergency contact details (first and last name, address, email address, telephone and mobile numbers)
  • To allow us to register you and process your application
  • To address, send or otherwise communicate a message to you
  • To confirm your acceptance of our sublicensing policy, acceptable behaviour policy and drugs policy
  • To enable us to give you access to the gym on your site
  • Performance of a contract
  • Legal obligation
  • Legitimate interests
Signature
  • To allow us to register you and process your application
  • To confirm your acceptance of our gym disclaimer and/or bike scheme
  • To confirm your acceptance of our sublicensing policy, acceptable behaviour policy and drugs policy
Personal details (date of birth) To allow us to register you and process your application Performance of a contract
Information in relation to your stay (room number, check in and check out dates)
  • To allow us to register you and process your application
  • When you confirm your acceptance of our sublicensing policy
Medical information To enable us to give you access to the gym on your site Consent
D. Guarantor

We, or third parties on our behalf, will collect and use the following personal information about you if you are a guarantor:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Contact details (first and last name, email address, telephone and mobile numbers)
  • To enable us to process the application of the person whose accommodation is being guaranteed
  • To enforce the guarantee (if necessary)
Performance of a contract
Individual guarantor's details (date of birth, signature, home address)
Verification information (proof of identity and address, credit check information including: score, result and notes) To prevent and detect fraud, money laundering, other crime, and security issues Legitimate interests
E. Short stay guest

We, or third parties on our behalf, will collect and use the following personal information about you if you are a short stay guest:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Contact details (first and last name, email address, telephone and mobile numbers)
  • To enable us to process your room reservation received through our Website or via a third party
  • To address, send or otherwise communicate a message to you
  • To process payment of your reservation
Performance of a contract
Personal details (ID number and preferred language) To enable us to process your room reservation received through our Website or via a third party
Information in relation to your stay (reservation balance, reservation number, reservation date and time, room number, number of guests, length of stay, check in and check out dates) To enable us to process your room reservation received through our Website or via a third party
Information provided when you correspond with us We use this to deal with any enquiries or issues you have when making a reservation
Payment details and related information (method, card details, account type, authorisation codes, transaction location, description of the transaction, cardholder name and address)
  • To enable us to process your room reservation received through our Website or via a third party
  • To collect payments from you or return money owed to you
  • To prevent and detect fraud, money laundering, other crime, and security issues
  • Performance of a contract
  • Legitimate interest
Information relating to security (first and last name, time and date of site access and CCTV) To ensure your safety and security and that of others Legitimate interests
F. Resident's family member

We, or third parties on our behalf, will collect and use the following personal information about you if you are a resident's family member and are making rent payments to us:

Type(s) of personal information Purpose/activity Our lawful basis for processing this personal information (see section 7 for further details)
Personal details (first and last name, date of birth, nationality, citizenship, country of residence)
  • To collect payments from you or return money owed to you
  • For accounting and banking purposes
  • To prevent and detect fraud, money laundering, other crime, and security issues
  • Performance of a contract
  • Legitimate interests
Payment details and related information (bank details, method, card details, account type, authorisation codes, transaction location, and description, cardholder name and address)
Verification information (proof of identity and address, credit check information including: score, result and notes) To prevent and detect fraud, money laundering, other crime, and security issues Legitimate interests

^ Back to top

5. Special categories of data

Some of the personal information that we collect about you or which you provide to us about you or others may be special categories of data (such as medical information). Special categories of data that we might process in connection with the services we provide you include information about your physical and mental health and wellbeing.

^ Back to top

6. Other processing of your personal information

Whatever our relationship with you is, we may also collect, use and store your personal information for the following additional reasons:

  • To deal with any enquiries or issues you have about how we collect, store and use your personal information, or any requests made by you for a copy of the information we hold about you. If we do not have a contract with you, we may process your personal information for these purposes where it is in our legitimate interests for customer services purposes;
  • For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies. We may process your personal information for these purposes where it is in our legitimate interests to do so;
  • To comply with any procedures, laws and regulations which apply to us – this may include where we reasonably consider it is in our legitimate interests or the legitimate interests of others to comply, as well as where we are legally required to do so; and
  • To establish, exercise or defend our legal rights – this may include where we reasonably consider it is in our legitimate interests or the legitimate interests of others, as well as where we are legally required to do so.

^ Back to top

7. Our legal basis for using your personal information

The legal basis for using your personal information is set out in section 4 and section 6 of this privacy policy. These legal bases are as follows:

  • Our use of your personal information is necessary to perform our obligations under any contract with you (for example, to enable us to lease or licence accommodation to you or to administer or provide services relating to that contract and to comply with the terms of use of our Website and Apps which you accept by browsing our Website or Apps); or
  • Our use of your personal information is necessary for complying with our legal obligations (for example, for health and safety purposes or if you contact us requesting access to personal information we hold about you); or
  • You have consented to our use of your personal information (noting that you may withdraw your consent at any time, as described below), for example:
    • when you provide us with your medical information so that you may make use of a gym on your site We may use your special categories of data (such as health and wellbeing information) where you have provided your consent; and
    • in certain cases, where we process your personal information for marketing purposes; or
  • Our use of your personal information is necessary for our legitimate interests or the legitimate interests of others (for example, to ensure the security of our Website). As well as any particular legitimate interests identified in section 4 and section 6, our legitimate interests are to:
    • to correspond or communicate with you generally, for example with company or relevant location news;
    • provide our services, make and receive payment and provide customer services;
    • run, grow and develop our business (as well as the businesses of our Group Companies);
    • operate our Website and Apps;
    • select appropriately skilled and qualified suppliers;
    • ensure a safe environment for you;
    • for network and information security in order for us to take steps to protect your personal information against loss or damage, theft or unauthorised access;
    • carry out marketing, market research and business development (other than where we rely on your consent to contact you by email or text with information about our products and services or share your details with third parties to do the same, as explained in section 15 below);
    • for analysis to inform our future marketing strategy, and/or to enhance or personalise your customer experience (such as improving the quality or relevance of information we provide to you in future);
    • to verify the accuracy of data that we hold about you and create a better understanding of you as a customer or potential customer;
    • or prevention of fraud and other criminal activities;
    • to review facts, assess and improve our service to customers through recordings of any calls with our offices;
    • place, track and ensure fulfilment of orders with our suppliers; and
    • for internal group administrative purposes.

If we rely on our (or another person's) legitimate interests for using your personal information, we will undertake a balancing test to ensure that our (or the other person's) legitimate interests are not outweighed by your interests or fundamental rights and freedoms which require protection of the personal information. You can ask us for information on this balancing test by using the contact details at section 18.

If we rely on your consent for us to use your personal information in a particular way, but you later change your mind, you may withdraw your consent by contacting us at head.office@studentcastle.co.uk and we will stop doing so. However, if you withdraw your consent, this may impact the ability for us to be able to provide our services to you.

^ Back to top

8. Aggregate and non-personal information

We may aggregate and analyse, non-personally-identifying information about the performance of our services. From time to time, we may disclose and use aggregate and non-personally-identifying information for industry analysis, demographic profiling, marketing and advertising, and other business purposes, e.g., by reporting on trends in the usage our Apps, Websites or services.

^ Back to top

9. Others who may receive or have access to your personal information

We will never sell or share your personal information with unconnected third parties for commercial gain without your knowledge and consent. However, we will share your personal information with the following third parties or categories of third parties:

  • Group Companies
    We may share your personal information with other Group Companies, who may use your personal information in the ways set out in sections 3, 4, 5, and 6 above, in connection with various ancillary or complementary products and/or services, for example products and services which only they can provide for regulatory reasons, or products and services which are similar to those we offer but may be under the name of a different brand. Some of our Group Companies may also be service providers to us, as explained in the section below. Please see the start of this privacy policy for a description of what we mean by Group Companies with whom we may share your personal information in this way.
  • Our suppliers and service providers
    We may disclose your information to certain selected third-party service providers, agents, subcontractors and other organisations where necessary for the purposes of them providing services to us or directly to you on our behalf. Such third parties may include information technology providers (such as hosting and software service providers), digital and marketing agencies and administrative services providers. When we use third party service providers in this way, we only disclose to them any personal information that is necessary for them to provide their service and we have an agreement in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions for the purposes intended and set out in this privacy policy.
  • Other ways we may share your personal information
    We may transfer your personal information to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. We may also transfer your personal information if we’re under a duty to disclose or share it in order to comply with any legal obligation, for example to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of other data subjects. If we do so, we shall take steps to ensure that your privacy rights continue to be protected and your rights are upheld.
  • Credit/debit card payment processors
    When you purchase certain products or services via our Website, over the phone or at one of our residences or premises, a credit or debit card payment may be processed with your instruction by a third party payment processing agent who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please ask us at the time of making the payment or contact us using the details at section 18. We do not store or keep a record of your credit card details on our own Website or within our own systems.

^ Back to top

10. How long we keep your personal information for

When we collect your personal information, we do not retain personal information for longer than we consider necessary. The length of time we retain personal information is determined by a number of factors, including:

  • the purpose for which we use that personal information;
  • our obligations under other laws; and
  • the legal basis we are using to collect and use your personal information.

For the majority of instances, we will retain the personal information we collect and use (as set out at section 4) for up to 7 years so that we may comply with our own governance, accounting and legal responsibilities. Where we are only required to retain some of your information for these purposes, we will take reasonable steps use 'minimise' that data and not to retain any information for longer than necessary. The only exceptions to this are where:

  • the law requires us to hold your personal information for a longer period, or to delete it sooner; or
  • you exercise your right to have the information erased (where applicable) and we do not need to hold it in connection with any of the reasons permitted or required under the law. See Your Rights (section 16) for more information.

^ Back to top

11. Data security

We are committed to ensuring that your personal information is held securely. In order to prevent unauthorised access or disclosure we put in place suitable procedures to safeguard the information we collect from you. Where possible we only store personal information in structured systems (databases) which can only be accessed with secure passwords. Whilst we take appropriate technical and organisational measures to safeguard the personal information that you provide to us, no transmission over the internet can ever be guaranteed secure. Consequently, please note that we cannot guarantee the security of any personal information that you transfer over the internet to us. Where we collect and process any sensitive personal information, for example medical information, we will apply additional security controls to protect that data. Where we have given (or where you have chosen) a password which enables you to access certain information, you are responsible for keeping this password confidential. We ask you not to share your password with anyone and to tell us as soon as possible if you think your password may have been stolen, exposed or compromised in any way.

^ Back to top

12. International transfers

Your personal information may be used, stored and/or accessed by our suppliers operating outside of the European Economic Area, including the US, China and India. Further details on to whom your personal information may be disclosed are set out in section 8.

If we transfer any personal information about you outside of the European Economic Area, we will take appropriate measures to ensure that we or the third-party recipient protects your personal information adequately in accordance with this privacy policy and the GDPR. These measures may include the following:

  • in the case of US based entities, entering into European Commission approved standard contractual arrangements with them, or ensuring they have signed up to the EU-US Privacy Shield (see further https://www.privacyshield.gov/welcome); or
  • in the case of entities based in other countries outside the EEA, entering into European Commission approved standard contractual arrangements with them.

Further details on the steps we take to protect your personal information, in these cases is available from us on request by contacting us using the contact details set out in section 17 at any time.

^ Back to top

13. Cookies

Like many other websites, our Website uses cookies. A cookie is a small file which is placed on your computer or mobile device’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can then tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Overall, cookies help us provide you with a better web experience by enabling us to monitor which information and pages you find useful and which you do not. You can choose to accept or decline cookies. If you decline cookies, this may however prevent you from taking full advantage of our Website.

^ Back to top

14. Minors

You must be aged 16 or over to purchase products or services from us. Our Website and services are not directed at children and we do not knowingly collect any personal information from children.

If you are a child and we learn that we have inadvertently obtained personal information from you from our Website, or from any other source, then we will delete that information as soon as possible.

Please contact us by using the contact details in section 17 if you are aware that we may have inadvertently collected personal information from a child.

^ Back to top

15. Marketing

We may collect your personal information and any information about your preferences in order for you to receive marketing information directly from us by email, and text with services and information we think may interest you. We collect your personal information for marketing if you:

  • Complete a contact form on our Website;
  • Receive and act upon a marketing campaign;
  • Make a reservation enquiry by telephone or email to one of our sites;
  • Attend one of our social events;
  • Enter a competition we have organised;
  • Engage with any of our social media content;
  • Download one of our Apps to one of your devices; and
  • Purchase a product or service from us.

In any of these cases listed above we may contact you with further marketing information. We may contact you with marketing information by email or via our social media platforms.

However, we will always obtain your consent to direct marketing communications where we are required to do so by law and if we intend to disclose your personal information to any third party for such marketing. If you do consent but later change your mind, you may contact us by contacting us at head.office@studentcastle.co.uk and we will cease any such activity.

^ Back to top

16. Your rights

You have certain rights in relation to your personal information. If you would like further information in relation to these or would like to exercise any of them, please contact us via email at us using the contact details in section 18 at any time. You have the following rights:

  • Right of access. You have the right to ask us to provide you with copies of personal information that we hold about you and further details of how we use it and look after it; confirmation as to whether your personal information is being used by us; and details of the safeguards which are in place if we transfer your information outside of the United Kingdom or the European Economic Area.
  • Right to update your information. You have the right to ask us to update and correct any out-of-date or incorrect personal information that we hold about you free of charge.
  • Right to stop marketing. You have the right to opt out of any direct marketing communications that we (or any third party to whom we have disclosed your personal info with your consent) may send to you. If you exercise this right, we will stop using your personal information for this purpose.
  • Right to delete your information. In certain cases, you have the right to request us to delete or destroy any personal information we hold about you after you have completed your contract with us, providing we are not required by law to keep these details for compliance, accounting or auditing purposes.
    We will pass your request onto other recipients of your personal information unless that is impossible or involves disproportionate effort. You can ask us who the recipients are by contacting us using the contact details in section 18.
  • Right to restrict use of your information: You have a right to ask us to restrict the way that we process your personal information in certain specific circumstances. You can ask us for further information on these specific circumstances by contacting us using the contact details in section 18.
    We will pass your request onto other recipients of your personal information unless that is impossible or involves disproportionate effort. You can ask us who the recipients are by contacting us using the contact details in section 18.
  • Right to data portability: You have a right to ask us to provide your personal information to a third party provider of services.
    This right only applies where we use your personal information on the basis of your consent or performance of a contract; and where our use of your information is carried out by automated means.
  • Right to object. You have a right to ask us to consider any valid objections which you have to our use of your personal information where we process your personal information on the basis of our or another person's legitimate interest.
  • Right to make a complaint. You have the right to complain to the Information Commissioners Office (ICO) if you are concerned about the way we have processed your personal information. Please visit the ICO's website www.ico.org.uk for further details.

We will consider all such requests and provide our response within a reasonable period (and in any event within one month of your request unless we tell you we are entitled to a longer period under applicable law). Please note, however, that certain personal information may be exempt from such requests in certain circumstances, for example if we need to keep using the information to comply with our own legal obligations or to establish, exercise or defend legal claims.

If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

^ Back to top

17. Links to other websites

Our Website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third-party websites or any association with their operators. This privacy policy only applies to the personal information that we collect or which we receive from third party sources, and we cannot be responsible for personal information about you that is collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third party websites or third party terms and conditions or policies.

^ Back to top

18. Contacting us

Please direct any queries about this policy or about the way we process your personal information using the contact details below. If you wish to write to us, please write to Student Castle Ltd, Head Office, Third Floor, 16 D'Arblay Street, London, W1F 8EA. Our email address for data protection queries is head.office@studentcastle.co.uk. If you would prefer to speak to us by phone, please call 020 7183 7764.

^ Back to top