We respect your privacy and are committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

Please also use the ‘Glossary’ to understand the meaning of some of the terms used in this privacy notice.

1. Important information and who we are

   Purpose of this privacy notice

   This privacy notice aims to give you information on how we collect and process your personal data through your use of this website, including any data you may provide through this website when you use our eTenancy services (either directly or indirectly through a property manager), utilise our site and or related platform, submit a property enquiry, search for a property using the site’s ‘find your home’ option, listing a property with us, and/or create an account with us.

   This website is not intended for children and we do not knowingly collect data relating to children.

   It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

   Controller

   StuRents Limited is the controller and responsible for your personal data (collectively referred to as "StuRents", "we", "us" or "our" in this privacy notice).

   We will act as a data processor in respect of personal data collected on your behalf from a property manager, guarantor, supplier or third party which is provided via our platform, when any of the above parties, for example, utilise our eTenancy services.

   We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

   Contact details

   Our full details are:

   Full name of legal entity: StuRents Limited

   Email address: dataprotection@sturents.com

   Postal address: Data Privacy Manager, StuRents Limited, Unit 101, 164-180 Union Street, London, SE1 0LH

   Telephone number: 0330 5001130

   You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

   Changes to the privacy notice and your duty to inform us of changes

   This version was last updated on 30th January 2024.

   It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

   Third-party links

   This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. The data we collect about you

   Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

   We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

   • Identity Data includes first name, maiden name, last name, username or similar identifier, previous address(es), marital status, title, date of birth and gender, proof of ID and/or address such as (but not limited to) passport, driving licence, utility bill or biometric residence permit, nationality, university student number, university, university course, university course length and year of study, university acceptance letter, UK visa, proof of standing order, deposit payer and signature
   • Contact Data includes address, email address and telephone numbers.
   • Financial Data includes bank account details, financial referee details, employment details, national insurance number, gross income, details of proof of earnings and home owner status.
   • Transaction Data includes details about payments to and from you and other details of services you have purchased from us.
   • Technical Data includes internet protocol (IP) address, browser cookies, details of the time that you spend on our site, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
   • Profile Data includes your username and password, your interests, property preferences (such as price, size and location), feedback, survey responses and platform communications between you and other users.
   • Usage Data includes information about how you use our website and services.
   • Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

   We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

   In most instances, we do not collect any Special Categories of Personal Data about you as a user of our platform (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

   We do collect Special Category Data if you are a user of our eTenancy services. We collect the following Special Category Data during our eTenancy process;

   Special Category Data:

   We do not collect any information about criminal convictions and offences. However, if you are a tenant or guarantor user, third parties may undertake credit reference checks utilising your details which are collected on our platform. This is so the Property Manager can administer your contract with them and ensure an appropriate letting arrangement is found according to your financial circumstances. This is discussed further below.

   If you fail to provide personal data

   Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.

3. How is your personal data collected?

   We use different methods to collect data from and about you including through:

   • Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms, speaking with one of our advisers, creating an account with us, using our eTenancy services, or in your capacity as a guarantor, property manager or tenant.

   • We will also collect data by corresponding with you by post, phone, email or otherwise. This includes personal data you provide when you:

     • apply for our services;
     • list a property with us in a capacity as a property manager;
     • a property manager utilises our platform on your behalf as tenant, in order to perform eTenancy services, collect rental payments and/or administer their tenancy with you (in our processor capacity), including utilising third party sub-processors (explained below);
     • act as a guarantor for a tenant using our online platform/website;
     • create an account on our website;
     • subscribe to our service or publications;
     • request marketing to be sent to you;
     • enter a competition, promotion or survey; or
     • give us some feedback.

   • Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.

   Please see our Cookie Policy below for further details.

   • Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out below:

   • Technical Data from the following parties:

     • analytics providers such as Google Analytics; and
     • advertising networks such as Google AdWords, Bing Ads or Facebook;

   • Contact, Financial and Transaction Data from providers of technical, accounting, customer relationship management (CRM), payment and delivery services or platforms.

   • Identity and Contact Data from data brokers or aggregators.

   • Identity and Contact Data from publicly available sources based inside the EU.

4. How we use your personal data

   We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

   • Where we need to perform the contract we are about to enter into or have entered into with you as a tenant user, guarantor user or property manager user or to facilitate contacts or other arrangements entered in to by you and a third party via our platform (including for the avoidance of doubt any Tenancy or Licence agreements), including effecting credit reference checks and facilitating payments, and to carry out our obligations arising from or in relation to your contract with a third party.
   • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
   • Where we need to comply with a legal or regulatory obligation.

   Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us using the details provided in this Privacy Policy.

   Purposes for which we will use your personal data

   We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

   Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

   Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
   To register you as a new tenant user, guarantor user, or property manager user	(a) Identity(b) Contact(c) Financial	Performance of a contract with you
   To facilitate users to enquire about properties of interest, arrange viewings, make bookings, or find potential housemates	(a) Identity(b) Contact(c) Profile Data	Necessary for our legitimate interests (to provide users with the ability to find properties of interest and communicate with property manager users to arrange viewings or make bookings.
   To facilitate the protection of users' tenancy deposits with a regulated deposit protection provider	(a) Identity(b) Contact	(a) Necessary to comply with a legal obligation (facilitate the compliance with property manager users' legal obligations)(b) Performance of a contract concluded in your interests(c) Necessary for our legitimate interests (To keep you informed in respect of your deposit protection and to provide property manager users with an efficient online facility to protect tenancy deposits)
   To allow tenant users to take up Utility Services including (but not limited to) gas, electricity, water, tv licence, internet and/or entertainment-related packages for a property	(a) Identity(b) Contact	Necessary for our legitimate interests (to provide tenant users with the ability to take up Utility Services for the property they rent or will rent in the future).
   To allow property manager users to utilise third party platforms for accounting services and CRM	(a) Identity(b) Contact(c) Financial(d) Transaction(d) Marketing and Communications	(a) When the property manager user has obtained your consent and/or has established an alternative legal justification via their terms and conditions with you to share for this purpose(b) Performance of a contract(c) Necessary for your, our and the property manager user's legitimate interests (to ensure accurate accounting and tenant records are maintained securely to be able to administer tenancies and manage tenant details more efficiently)
   To process and deliver our platform to you including:(a) Manage payments, fees and charges, including facilitating credit reference checks and facilitating payments(b) Facilitate any contracts or arrangements entered in to between you and a third party via out platform (including Tenancy or Licence agreements)(c) Collect and recover money owed to us	(a) Identity(b) Contact(c) Financial(d) Transaction(e) Marketing and Communications(f) Technical(g) Usage	Performance of a contract with you
   To manage our relationship with you which will include:(a) Notifying you about changes to our terms or privacy policy(b) Asking you to leave a review or take a survey(c) If you are a property manager user or other business/advertising user, to send you e-mails detailing the relevant statistics about your property portfolio(d) If you are a tenant or guarantor to contact you via email and SMS to notify you if the rent due under a Tenancy or Licence has fallen in to arrears, or if a rent or tenancy related paying is coming due	(a) Identity(b) Contact(c) Profile Data(d) Marketing and Communications	(a) Performance of a contract with you(b) Necessary to comply with a legal obligation(c) Necessary for our legitimate interests (to keep our records updated, to keep you informed in respect of your property lets, and to study how customers use our products/services)
   To enable you to partake in a competition or complete a survey	(a) Identity(b) Contact(c) Profile(d) Usage(e) Marketing and Communications	(a) Performance of a contract with you(b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)
   To perform our legal obligation under fraud protection regulations and credit risk reduction	(a) Identity(b) Contact(c) Financial	(a) Necessary to comply with a legal obligation
   (a) To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)(b) To allow you to participate in interactive features of our service when you choose to do so.	(a) Identity(b) Contact(c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)(b) Necessary to comply with a legal obligation
   To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you. This includes Google Analytics which tracks the pages you visit on our site	(a) Identity(b) Contact(c) Profile(d) Usage(e) Marketing and Communications(f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
   To use data analytics to improve our website, services, marketing, customer relationships and experiences. This includes Google Tag manger, AdWords, Analytics, Facebook and Bing	(a) Technical(b) Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
   To make suggestions and recommendations to you about goods or services that may be of interest to you	(a) Identity(b) Contact(c) Technical(d) Usage(e) Profile	Necessary for our legitimate interests (to develop our products/services and grow our business)
   To facilitate Right to Rent checks which are undertaken by third parties	(a) Sensitive Category Data	(a) Necessary to comply with a legal obligation(b) Explicit Consent

   Marketing

   We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You can manage your preferences to various platform communications by logging into your account and going to the Settings page in your account.

   Promotional offers from us

   We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you (we call this marketing).

   If you are a property manager user, we will send to you regular emails detailing relevant statistics about your property or properties on our website, which will not constitute marketing. As a user, we may send to you regular emails detailing your activity on our website and guidance on how to use our services, as well as property bulletins to inform you of available properties that are relevant to your search activity, which will not constitute marketing.

   You will receive marketing communications from us if you have requested information from us or purchased services from us or if you provided us with your details when you entered a competition, registered for an account with us, listed a property on our platforms, and/or proceeded to our site via channels such as Facebook, Google, Bing and/or another analytical advert. In each case, this is only if you have not opted out of receiving that marketing.

   Third-party marketing

   We will get your explicit opt-in consent before we share your personal data with any company outside StuRents group of companies for marketing purposes.

   Opting out

   You can ask us or third parties to stop sending you marketing messages at any time by logging into the website and checking or unchecking relevant boxes to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you.

   Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of creating an account with us, utilising our eTenancy platform as a tenant, guarantor or property manager, listing a property with us, or having purchased a service or other transaction from us.

   Cookies

   You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see below.

   Change of purpose

   We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

   If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

   Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Disclosures of your personal data

   We may have to share your personal data with the parties set out below for the purposes set out in the table above. We may also share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006. We will not sell any personal information of yours that identifies you or allows you to be contacted by third parties without your consent.

   We may disclose your personal information to third parties:

   • Internal Third Parties such as IT and system administration services. This will also include any group company that we may merge with and/or utilise in the future. You will be notified of such changes if and when they occur.

   • External Third Parties;

     • Accounting platforms, such as Xero, Sage or Quickbooks
     • CRM platforms, such as Hubspot or Salesforce
     • Business partners, suppliers, sub-contractors and other third parties for the performance of any contract we enter into with them or you and for the provision of our service
     • Property manager users who advertise properties on our website when you make a property enquiry, viewing request, request to book or any other similar enquiry
     • Other users of our website who you choose to communicate with using our online communication tools such as live chat.
     • Our CRM System.
     • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in DH1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.
     • Third parties to whom we sell anonymised aggregated market data (for example, average house price in postcode prefix DH1).
     • Analytics and search engine providers that assist us in the improvement and optimisation of our site.
     • Service providers based in the UK who provide IT and system administration services, including payment services such as facilitating card payments or direct debits (including Stripe, GoCardless, Truelayer, Transfermate) and know-your-customer/AML services (including Stripe and Creditsafe Business Solutions Limited). Details of specific service providers can be obtained by contacting us if requested at any time.
     • Professional advisers lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
     • HM Revenue & Customs, regulators and other based in the UK who require reporting of processing activities in certain circumstances.
     • Leap Guaranty Limited when you choose to use their guarantor waiver service
     • Tenancy Deposit Solutions Ltd when your tenancy deposit is protected by your property manager.
     • HomeLet (Barbon Insurance Group Limited), the credit referencing agency when your property manager opts to have a credit check or full employment reference performed on you as a tenant or guarantor for the purpose of assessing your creditworthiness.
     • Canopy (Insure Street Limited), when your property manager opts to have a credit check or reference performed on you as a tenant or guarantor user for the purpose of assessing your creditworthiness.
     • The-Bunch Limited when you choose to use their Utility Services.
     • The Student Energy Group Limited when you choose to use their Utility Services.
     • TrustID Limited when your property manager opts to use their right-to-rent service.

   If due to your financial circumstances, tenancy and/or letting arrangements a property manager finds it necessary to undertake such a credit reference check, the report shall be made available to the property manager user via our site once we have received it from the third-party supplier. This is in order that a suitable letting arrangement can be provided to you via out platform.

   If required under a legal obligation, contractual obligation or if it is in our, a tenant's, property manager's or guarantor's legitimate interests to do so (i.e. to facilitate, manage and administer tenancy arrangements), we may disclose all such personal data to third parties (including credit reference agencies). A third party may:

   • conduct any searches or investigations as may be considered necessary or desirable in order to determine the creditworthiness of such person and to prepare a Credit Reference Report in relation to them in order that we can perform our contractual obligations, or when it is in a party’s legitimate interests to know such information; and
   • record that any such searches or investigations have been made.
   • Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.

   Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

   We require all third parties to respect the security of your personal data and to treat it in accordance with the law. If we share your personal data in either our controller or processor capacity with a third-party service provider acting as a sub-processor (like with an accounting platform), we do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

   We may share your personal data with employees of StuRents who are based outside the United Kingdom (UK). Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. This will involve transferring your data outside the UK.

   A number of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. These include third parties we use to collect payments and perform credit reference checks on our site.

   Credit/debit card and bank details are not stored by StuRents, and are stored and managed by FCA regulated third party payment providers. If you require details of these third parties, please contact us.

   Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is met or a derogation applies:

   • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.

   • Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

   • In the absence of an adequacy decision, or of appropriate safeguards including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

     • You have explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards; or
     • the transfer is necessary for the performance of a contract between you and us (as data controller) or the implementation of pre-contractual measures taken at your request;
     • the transfer is necessary for the conclusion or performance of a contract concluded in your interests, between StuRents as data controller and another natural or legal person;
     • the transfer is necessary for the establishment, exercise or defence of legal claims;
     • Where a transfer could not be based on any of the above conditions, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of individuals, is necessary for the purposes of compelling legitimate interests pursued by StuRents which are not overridden by your interests or rights and freedoms. We will also assess all the circumstances surrounding the data transfer and provide suitable safeguards with regard to the protection of personal data.

   Please contact us if you would like further information on the specific mechanism used by us when transferring your personal data out of the UK.

7. Data Security

   We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

   We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

   How long will you use my personal data for?

   We will only retain your personal data for as long as necessary to fulfil the purposes we collect it for, including for the purposes of satisfying and legal, accounting or reporting requirements.

   To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of hard from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

   In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

   Under certain circumstances, you have rights under data protection laws in relation to your personal data. Be aware that in some capacities, we may act as a data processor, and in this capacity, we may not be able to comply with the following requests. However, we will inform the relevant data controller of your request and assist them as required under UK GDPR.

   Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

   Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

   Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

   Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which overrides your rights and freedoms.

   Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

   Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

   Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

   If you wish to exercise any of the rights set out above, please contact us.

   No fee usually required

   You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

   What we may need from you

   We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

   Time limit to respond

   We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Glossary

    ‘LAWFUL BASIS’

    Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

    Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

    Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

    Explicit consent means processing your data only when we have your express consent to do so.

    Cookies

    What is a cookie?

    A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.

    Information about our use of cookies

    Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.

    We use the following cookies:

    • Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
    • Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
    • Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
    • Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

    You can find more information about the individual cookies we use and the purposes for which we use them in the table below:

    Cookie	Purpose
    stu_auth	Stores your authentication token to allow you to be logged in automatically next time you visit
    stu_ad	Stores the fact that you arrived at our site from an advert elsewhere online
    stu_cookie	Stores the fact that you have read and closed our cookie notice
    stu_survey	Stores the fact that you have completed or hidden one or more surveys whilst on the site
    sturents_new	Stores the fact that you have signed up as a new user
    PHPSESSID	Allows the website to function
    Google Analytics and Google Tag Manager	Used to enable us to understand how our users interact with our website and to diagnose technical problems and to target advertising to users who visit our site. You can read more information on the cookies used by Google by visiting Google's help pages
    Microsoft Clarity	Used to enable us to understand how our users interact with our website and to diagnose technical problems. You can read more information on the cookies used by Clarity by visiting the 'Cookie list' section of Clarity's cookie information page.

    Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

    You are able to block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you will be unable to sign in to our website.

    With regards to Google Analytics, Google have an opt out page here that provides visitors with the ability to prevent their data from being used by Google Analytics.

    Except for essential cookies, all cookies will expire after 30 days.

    Where we store your personal data

    Please note we use third parties to collect payments and perform credit reference checks on our site and the data that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (UK). It may also be processed by staff operating outside the UK who work for our payment processors. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. Credit/debit card and bank details are not stored by StuRents, and are stored and managed by third party payment providers. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

    Please further note that we store your data on a secure third party CRM system.

    Please note that where you have registered on the site and chosen a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

    Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

    Uses made of the information

    We use information held about you in the following ways:

    • Information you give to us. We will use this information:
      • to carry out our obligations arising from any contracts or other arrangements entered into between you and us and to provide you with the information, products and services that you request from us;
      • to facilitate any contracts or other arrangements entered into between you and a third party via our Site (including for the avoidance of doubt any Tenancy or Licence agreement) (Third Party Contract), including effecting credit reference checks and facilitating payments, and to carry out our obligations arising from or in relation to such Third Party Contracts.
      • to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about;
      • to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you. If you are an existing customer, we will only contact you by electronic means (e-mail or SMS) and telephone with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you. If you are a new customer, and where we permit selected third parties to use your data, we (or they) will contact you by electronic means only if you have consented to this. If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, please tick the relevant box situated on any form on which we collect your data;
      • to notify you about changes to our service;
      • to ensure that content from our site is presented in the most effective manner for you and for your computer.
      • carry out external market analysis;
      • to allow you to participate in interactive features of our service when you choose to do so.
      • if you are a property manager user or other business/advertising user, to send to you a weekly e-mail detailing relevant statistics surrounding your property or properties.
      • if you are a tenant or guarantor, to contact you via electronic means, including email and SMS, to notify you if the rent due under an AST has fallen into arrears.
    • Information we collect about you. We will use this information:
      • to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
      • to provide our or a third-party service provider's services to you;
      • carry out external market analysis;
      • to improve our site to ensure that content is presented in the most effective manner for you and for your computer;
      • to allow you to participate in interactive features of our service, when you choose to do so;
      • as part of our efforts to keep our site safe and secure;
      • to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you;
      • to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.
    • Information we receive from other sources. We may combine this information with information you give to us and information we collect about you. We may us this information and the combined information for the purposes set out above (depending on the types of information we receive).

    Disclosure of your information

    We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

    We will not sell any personal information of yours that identifies you or allows you to be contacted by third parties without your consent.

    In addition to the above, we may also share your information with selected third parties including:

    • Third party sellers who publish quotes, offers and similar information about their products and/or services on our site to enable them to contact you about such products and/or services, if requested by you;
    • Business partners, suppliers, sub-contractors and other third parties for the performance of any contract we enter into with them or you or for the provision of our service to you or in connection with a Third Party Contract.
    • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in DH1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.
    • Third parties to whom we sell aggregated mark data (for example, average house price in DH1).
    • Analytics and search engine providers that assist us in the improvement and optimisation of our site.
    • Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you or a Third Party Contract.

    We may disclose your personal information to third parties:

    • In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
    • If StuRents Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
    • If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our Terms of Use and Acceptable Use Policy or Terms and Conditions and other agreements or to protect the rights, property, or safety of StuRents Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

    Your Rights

    You have the right to:

    Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

    Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

    Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

    Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

    Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want to establish the data's accuracy, (b) where our use of the data is unlawful but you do not want us to erase it, (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims, (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

    Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

    Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

    You can also exercise any of these rights at any time by contacting us by email to dataprotection@sturents.com.

    Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

    Changes to our Privacy Policy

    Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

    Contact

    We welcome comments, questions, feedback and requests regarding our site and this privacy policy and these should be communicated to us by submitting a support request when logged in.