• Advertise-with-us-top
Affiliated with

Privacy Notice

About this notice

Your privacy and trust are important to us and this Privacy Notice provides essential information about how the University collects and uses your personal information (data). It is relevant to those who have enquired about using the Studentpad service, together with those who later become registered users, landlords or agents.

Throughout this notice, “University” refers to the University of Exeter. “We” “our” and “us” refers to the Residential Services departments within the University of Exeter. This includes the Accommodation Office, Residence Contracts, Residence Operations and Residence Life.

1.0 What is personal data/personal information?

In simple terms, personal data is information which identifies and relates to you, either on its own or in conjunction with other information held by the University.  Sensitive personal data (or special categories of personal data, as it will be known under new EU legislation which comes into force on 25 May 2018) is personal data which falls within one of these categories: 

  • race;
  • ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetics;
  • biometrics (where used for the purpose of uniquely identifying a natural person);
  • health;
  • sex life or sexual orientation;

Data relating to criminal allegations, proceedings, offences, convictions or related security measures falls into the category of criminal offence data and is subject to separate safeguards.

We do not collect any special categories of personal data about you, nor do we collect any criminal offence data.

2.0 Why do you need my personal data?

There are specific reasons why we collect and process your personal data; these are known as lawful bases. From 25 May 2018 the new EU General Data Protection Regulations (or GDPR for short) will come into force and we shall process your personal data in accordance with these regulations. GDPR is new law and it has not yet been applied to circumstances such as Universities and students so we may change our views on the lawful bases for processing, as legal views also change.

If you are a landlord/agent user of Studentpad, we may process your personal data because it is necessary for the performance of a contract with you, or because you are asking us to take specific steps before entering into a contract. We need to be able to fulfil our contractual obligations to you, and in this respect, we use your personal data for the following:

  • Administration relating to the advertisement of your property(ies) and/or room(s) which is/are available to rent;
  • Processing and recovery of advertisement fees;
  • To enable prospective tenants to contact you in respect of the advertised property/room(s);
  • To allow you to participate in interactive features of the Studentpad service, when you choose to do so;
  • To notify you about any changes to our service;
  • Because we have a legitimate business need.

If you are an enquirer who is using Studentpad, we will most commonly use your personal information for the following reasons:

  • To allow you to participate in interactive features of the Studentpad service, when you choose to do so;
  • To provide appropriate details to agents/landlords;
  • To notify you about any changes to our service;
  • Because we have a legitimate business need.

We may also process your personal data where:

  • You have given us express permission (consent) to send you information relating to student housing and landlord events.

In addition to the purposes referred to above, we may share your personal data with certain third parties for specific processing reasons.

We may pass your details to third parties because it is necessary for the performance of a contract with you. In this respect, we/they may use your personal data for the following:

  • To deliver externally hosted IT services or products to the University. Such information will only be used to provide the contracted services, and in accordance with the terms of agreements with the University. In this instance, the approved IT and infrastructure providers currently include PAD Group/Studentpad Limited (for the Studentpad service) and WPM (for hosting payment services).

3.0 What personal data do you collect about me?

The type of personal data and sensitive personal data we may process about you includes:

  • Identity data such as your full name;
  • Contact data such as your permanent home address, letting property address, landline/mobile phone numbers and email addresses.
  • Profile data such as your user name and password, your preferences and reviews

In addition, the service provider Studentpad may collect:

  • Technical data such as an internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform. This may vary depending on the device(s) you use to access the Studentpad website.
  • Usage data includes information about how you use the Studentpad website.

Studentpad may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

4.0 How do you get my personal data?

We will collect your information in the following ways:

  • from you when you register a Studentpad account;
  • from you when you add property details for the purpose of placing an advertisement;
  • from you when you communicate with us by telephone, email, post, in person or via social media, for example in order to make enquiries or raise concerns;
  • from you when you interact with the Studentpad website. This may be automatically collected such as Technical Data about your equipment, browsing actions and patterns. This data is collected by using cookies, server logs and other similar technologies. Please see the Studentpad cookie policy for further details;
  • from a third party whom you have nominated to act on your behalf;
  • from a third party analytics provider such as Google, based outside the EU.

4.1 Data acquired through site visitor tracking

Like most websites, Studentpad uses Google Analytics (GA) to track user interaction. Studentpad may use the data from GA to determine how many people are using the website, how people find and use the web pages, and to visualise user journeys through the website.

Although GA records Technical Data, none of this information makes you personally identifiable to us. Your computer’s IP address is also recorded by GA and presents a potential way for you to be personally identified; however, Google do not grant us access to this information. We consider Google to be a third-party data processor (see section 7.0).

GA makes use of cookies, details of which can be found on Google’s developer guides. Our website uses the analytics.js implementation of GA.

Disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website; however, this may have an impact on the website display quality.

You can find out more about cookies on the dedicated Studentpad cookies page.

4.2 Data acquired when creating property reviews

If you add a review to any of the properties published on this site, your name and any additional details you enter, along with your comment, will be saved to this website’s database, along with the time and date that you submitted the review. This information is only used to identify you as a reviewer of the respective property and is not passed on to any of the third-party data processors detailed in section 7.0 aside from Studentpad. Only the information you directly enter will be shown on the public-facing website (please do not enter any sensitive or personal information that you do not wish to be made public).

Your review and its associated data will remain on this site until we see fit to either: 

1) remove the review, or 

2) remove the property.

Should you wish to have the review and its associated personal data deleted, please contact us (don’t forget to provide us with your name and the property you have reviewed).

If you are under 16 years of age you MUST obtain parental consent before posting a review on any properties.

NOTE: You should avoid entering personally identifiable information to the review section of any property.

4.3 Data acquired when using contact forms and email links

If you choose to contact us using the contact form (on our Contact us page), or via email, none of the data that you provide will be stored by this website. This data will not be passed to or be processed by any of the third party data processors defined in section 7.0. Instead the data will be collated into an email and sent to us over the Simple Mail Transfer Protocol (SMTP).

NOTE: Studentpad’s SMTP servers are not encrypted by TLS or SSL, and we strongly recommend that you do not send any sensitive information over email.

4.4Data acquired when creating an account

Users are able to make a property search without the need for creating an account, but we provide the ability for users to create a Studentpad account to make their search easier and faster. Should you choose to create an account, your data will be handled as outlined below:

  • Passwords are stored in a non-reversible encryption string. This means that nobody can see what your password is (e.g. the word "example" could look like this "61EA0803F8853523B777D414ACE3130CD4D3F92DE2CD7FF8695C337D79C2EEEE"). We also salt your password with additional information, to ensure the encrypted password does not resemble your original password.
  • The information held on you will, typically, be Contact and Identity Data. You are free to add, delete or update the information we hold about you, using the account area of the website. You are also free to use the ‘unsubscribe’ button on your account dashboard to completely remove your account and all the associated data.
  • The data you provide when creating your account will be backed up, encrypted and stored on 3 different servers for secure storage. For more details, refer to section 9.0.

​4.5 Data acquired when using message boards

When using the message board functionality on the Studentpad site, the name and any details you enter alongside your message will be saved to the website’s database, along with the time and date that you submitted the post or reply. This information is used to identify you as a user of the message board and is not passed on to any of the third-party data processors detailed in section 7. Only the information you enter onto the message board will be shown on the public-facing website. This will typically include your name, a subject message and the message content.

NOTE: please do not enter any sensitive or personal information that you do not wish to be made public.

Your post and its associated data will remain on this site until:

  1. the expiry date set in the post has passed; or
  2. an administrator removes the post/reply; or 
  3. an administrator removes the message board thread.

Should you wish to have any post/reply and its associated personal data deleted then please contact us; providing all the details regarding your request, including the reason for removal.

If you have chosen to create an account, as highlighted in section 4.4, you will have the option to log into your account and delete any posts you have submitted on the message board.

If you are under 16 years of age you MUST obtain parental consent before posting on the message board.

Useful Points to consider while using the message boards:

  • If you put your contact details in the body of your message these will be publicly available.
  • Take steps to verify the identity of anyone who you make contact with.
  • Beware of anyone requesting money in advance, especially anyone requesting money via Western Union (this is a scammers method of choice) – More information on internet scams.

5.0 What are my rights?

As a “Data Subject” you have a number of rights under the Data Protection Act. These apply until 24 May 2018 and give you the right to:

  • access the personal data the University holds about you;
  • object to processing of information which may cause, or is causing damage or distress;
  • prevent processing for direct marketing;
  • object to decisions being taken by automated means;
  • (in certain circumstances) have inaccurate personal data rectified, blocked, erased or destroyed;
  • claim compensation for damages caused by a breach of the Act.

Once GDPR is introduced on 25 May 2018 these rights will be expanded to provide for the following:

  • The right to be informed – we will explain how we collect and use your personal data in a clear and plain language.
  • The right of access – you will be able to request a copy of the personal data we hold about you and check that we are lawfully processing it.
  • The right to rectification – you can tell us to update any information about you which is inaccurate or incomplete, though we may need to verify the accuracy of the new data you provide to us.
  • The right to erasure – you can ask us to delete or remove personal data where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.  Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  • The right to restrict processing – This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  • The right to data portability – this allows you to obtain and reuse your personal data for your own purposes but only applies when processing has been carried out by automated means. 
  • The right to object – you can object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to us processing on this basis as you feel it impacts on your fundamental rights and freedoms.   You also have the right to object where we are processing your personal data for direct marketing purposes.  In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
  • Rights in relation to automated decision making and profiling – at present, we do not carry out any such activities.

More detailed explanations about all of these rights are available from the Information Commissioners Office website at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

If you wanted to exercise any of the above rights please contact the University’s Data Protection Officer via dataprotection@exeter.ac.uk

You can request a copy of the information we hold about you; this is known as a “Subject Access Request” (SAR). The University currently charges £10 and has 40 calendar days from receipt of payment to process a SAR. In accordance with the GDPR, we will stop charging the £10 fee by 25 May 2018. However, we may charge a reasonable free if your request is clearly unfounded, repetitive or excessive.  Alternatively, we may refuse to comply with your request in these circumstances. All SARs must be made in writing to the University’s Records Manager and you can find details as to how to do this on the University’s webpage: http://www.exeter.ac.uk/dataprotection/access/

6.0 What happens if I do not want you to process my personal data?

The primary reason for us collecting and processing your personal data is so that we can provide you with the means of advertising your property(ies) and/or room(s) on our Studentpad service. If you do not want us to process your personal data then we will be unable to accept your advertisement as we will be unable to form a contract.

7.0 Do you transfer any of my personal data to third parties or other countries?

Where data is shared within the UK, or the European Union (EU), the third party will be required to comply with and safeguard the data under the terms of the DPA and appropriate EU regulations (prior to 25 May 2018) or the GDPR (from 25 May 2018).

Your personal information will only be transferred to countries outside of the EU (“third countries”) or international organisations, where the European Commission has decided that an adequate level of data protection can be offered, or where adequate safeguards, such as the EU-US Privacy Shield, are in place.

Studentpad act as data processors and are based in the United Kingdom. They provide IT and system administration services. Studentpad directly uses the services of:

8.0 How do you secure my personal data?

We put in place a range of security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  In addition, Studentpad limit access to your personal data by their employees, agents, contractors and other third parties who have a business need to know.  They will only process your personal data on our instructions and these are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

The Studentpad website may include links to third party websites, plug-ins, and applications.  Clicking on those links or enabling those connections may allow third parties to collect or share data about you.  We do not control these third party websites and are not responsible for their privacy statements.  When you leave our website, we encourage you to read the privacy notice of every website you visit.

9.0 About the Studentpad website’s server

This website is hosted by our third party processor, Studentpad, which forms part of the Pad Group Limited group of companies, and is stored on servers provided by Fasthosts. These servers are located in the UK and are solely used by Pad Group Limited.

Some of the data centre’s more notable security features are as follows:

  • CCTV covering all areas of the data centres and corporate offices.
  • Highly experienced security guards on duty 24/7, 365 days a year.
  • Role-based access control swipe-card system across multiple secure areas to ensure absolutely no access by unauthorised personnel.
  • Awarded ISO 27001 certification – an international standard given to data centres that reach the top-level of security, safety and compliance.

Full details of FastHosts' data centre can be found here.

All traffic (transferral of files) between this website and your browser is encrypted and delivered over HTTPS.

10.0 How long do you keep my personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk and harm from unauthorised use or disclosure of your personal data, the purposes of which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

11.0 Who regulates the use of my personal data?

The University is registered as a Data Controller with the Information Commissioner's Office (ICO), the independent authority which oversees compliance with the DPA. The University's registration number is Z5785872 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. You can view our registration here.

The University’s Data Protection Officer is Rhiannon Platt, Information Governance Manager, who can be contacted by emailing dataprotection@exeter.ac.uk  

12.0 What can I do if I have any concerns?

We aim to be transparent about the way we process your personal data but we understand that you may still have questions or concerns. If there is anything you are unclear about then please contact our Data Protection Officer via dataprotection@exeter.ac.uk who shall be happy to help.  

If you remain dissatisfied then you have the right to complain to the ICO. Further advice on how you can raise a concern with us or escalate a matter to the ICO is available via the ICO website: https://ico.org.uk/for-the-public/raising-concerns/

13.0 Marketing

Once you have registered as an Agent/Landlord on Studentpad, we would like to be able to keep you informed about news, events and opportunities that may be of interest to you. This may include events such as the University’s annual Housing Fair, and periodical e-newsletters. You will be asked whether you are happy to receive communications from us as part of the account registration process. You can then manage your preferences within the “My Settings” section of the Studentpad control site. Our newsletters will also include an “Unsubscribe” option.

Please note: We may also contact you in respect of any queries relating to your advertisement. These are contractual rather than “marketing” communications and are therefore not subject to consent requirements.

14.0 Status of this Privacy Notice

We are likely to make changes to this Privacy Notice. Until 24 May 2018 we shall process your personal data in accordance with the Data Protection Act 1998 (or DPA for short). From 25 May 2018 the new EU General Data Protection Regulations (or GDPR for short) will come into force and we shall process your personal data in accordance with these regulations.

We will not explicitly inform clients or website users of any changes to this Notice. Instead, we recommend you check occasionally for any policy changes via the Studentpad website. We will also ensure that the most up to date version is available online at http://www.exeter.ac.uk/accommodation/privatehousing/studentpad/  

This Notice complies with requirements under both DPA and GDPR. If you want to find out more about the changes in legislation you can visit the ICO website www.ico.gov.uk

This Privacy Notice was last reviewed on 21 May 2018.

 

Landlord Contact Details, Accommodation Office, Northcote House, The Queen's Drive, Exeter, EX4 4QJ
Tel: 01392 723444, Email: sid@exeter.ac.uk

Copyright Studentpad Limited © 2018. All rights reserved.

Student accommodation search powered by

Studentpad Ltd
Please Wait...