Your privacy and trust are important to us and this Privacy Notice provides essential information about how the University collects and uses your personal information (data). It is relevant to those who have enquired about using the Studentpad service, together with those who later become registered users, landlords or agents.
Throughout this notice, “University” refers to the University of Exeter. “We” “our” and “us” refers to the Residential Services departments within the University of Exeter. This includes the Accommodation Office, Residence Operations and Residence Management teams.
1.0 What is personal data/personal information?
In simple terms, personal data is information which identifies and relates to you, either on its own or in conjunction with other information held by the University. Special category data is personal data which the GDPR says is more sensitive, and so needs more protection.
Data relating to criminal allegations, proceedings, offences, convictions or related security measures falls into the category of criminal offence data and is subject to separate safeguards.
We do not collect any special categories of personal data about you, nor do we collect any criminal offence data.
2.0 Why do you need my personal data?
There are specific reasons why we collect and process your personal data; these are known as lawful bases. If you are a landlord/agent user of Studentpad, we may process your personal data because it is necessary for the performance of a contract with you, or because you are asking us to take specific steps before entering into a contract. We need to be able to fulfil our contractual obligations to you, and in this respect, we use your personal data for the following:
Administration relating to the advertisement of your property(ies) and/or room(s) which is/are available to rent;
Processing and recovery of advertisement fees;
To enable prospective tenants to contact you in respect of the advertised property/room(s);
To allow you to participate in interactive features of the Studentpad service, when you choose to do so;
To notify you about any changes to our service;
Because we have a legitimate business need.
If you are an enquirer who is using Studentpad, we will most commonly use your personal information for the following reasons:
To provide appropriate details to agents/landlords;
To notify you about any changes to our service;
Because we have a legitimate business need.
We may also process your personal data where:
In addition to the purposes referred to above, we may share your personal data with certain third parties for specific processing reasons.
We may pass your details to third parties because it is necessary for the performance of a contract with you. In this respect, we/they may use your personal data for the following:
To deliver externally hosted IT services or products to the University. Such information will only be used to provide the contracted services, and in accordance with the terms of agreements with the University. In this instance, the approved IT and infrastructure providers currently include PAD Group/Studentpad Limited (for the Studentpad service) and WPM (for hosting payment services).
3.0 What personal data do you collect about me?
The type of personal data and sensitive personal data we may process about you includes:
Identity data such as your full name;
Contact data such as your permanent home address, letting property address, landline/mobile phone numbers and email addresses.
Profile data such as your user name and password, your preferences and reviews
Technical data such as an internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform. This may vary depending on the device(s) you use to access the Studentpad website.
Usage data includes information about how you use the Studentpad website.
Studentpad may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
4.0 How do you collect my personal data?
We will collect your information in the following ways:
from you when you add property details for the purpose of placing an advertisement;
from you when you communicate with us by telephone, email, post, in person or via social media, for example in order to make enquiries or raise concerns;
from a third party whom you have nominated to act on your behalf;
from a third party analytics provider such as Google, based outside the EU.
4.1 Data acquired through site visitor tracking
Like most websites, Studentpad uses Google Analytics (GA) to track user interaction. Studentpad may use the data from GA to determine how many people are using the website, how people find and use the web pages, and to visualise user journeys through the website.
Although GA records Technical Data, none of this information makes you personally identifiable to us. Your computer’s IP address is also recorded by GA and presents a potential way for you to be personally identified; however, Google do not grant us access to this information. We consider Google to be a third-party data processor (see section 7.0).
Disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website; however, this may have an impact on the website display quality.
4.2 Data acquired when using contact forms and email links
If you choose to contact us via email, none of the data that you provide will be stored by this website. This data will not be passed to or be processed by any of the third party data processors defined in section 7.0. Instead, the data will be collated into an email and sent to us over the Simple Mail Transfer Protocol (SMTP).
NOTE: Studentpad’s SMTP servers are not encrypted by TLS or SSL, and we strongly recommend that you do not send any sensitive information over email.
4.4 Data acquired when creating an account
Users are able to make a property search without the need for creating an account, but we provide the ability for users to create a Studentpad account to make their search easier and faster. Should you choose to create an account, your data will be handled as outlined below:
Passwords are stored in a non-reversible encryption string. This means that nobody can see what your password is (e.g. the word "example" could look like this "61EA0803F8853523B777D414ACE3130CD4D3F92DE2CD7FF8695C337D79C2EEEE"). We also salt your password with additional information, to ensure the encrypted password does not resemble your original password.
The information held on you will, typically, be Contact and Identity Data. You are free to add, delete or update the information we hold about you, using the account area of the website. You are also free to use the ‘unsubscribe’ button on your account dashboard to completely remove your account and all the associated data.
The data you provide when creating your account will be backed up, encrypted and stored on 3 different servers for secure storage. For more details, refer to section 9.0.
4.5 Data acquired when using message boards
When using the message board functionality on the Studentpad site, the name and any details you enter alongside your message will be saved to the website’s database, along with the time and date that you submitted the post or reply. This information is used to identify you as a user of the message board and is not passed on to any of the third-party data processors detailed in section 7. Only the information you enter onto the message board will be shown on the public-facing website. This will typically include your name, a subject message and the message content.
NOTE: please do not enter any sensitive or personal information that you do not wish to be made public.
Your post and its associated data will remain on this site until:
the expiry date set in the post has passed; or
an administrator removes the post/reply; or
an administrator removes the message board thread.
Should you wish to have any post/reply and its associated personal data deleted then please contact us; providing all the details regarding your request, including the reason for removal.
If you have chosen to create an account, as highlighted in section 4.4, you will have the option to log into your account and delete any posts you have submitted on the message board.
If you are under 16 years of age you MUST obtain parental consent before posting on the message board.
Useful points to consider while using the message boards:
Take steps to verify the identity of anyone who you make contact with.
Beware of anyone requesting money in advance, especially anyone requesting money via Western Union (this is a scammers method of choice).
As a “Data Subject” you have a number of rights under GDPR which provide for the following:
The right to be informed – we will explain how we collect and use your personal data in a clear and plain language.
The right of access – you will be able to request a copy of the personal data we hold about you and check that we are lawfully processing it.
The right to rectification – you can tell us to update any information about you which is inaccurate or incomplete, though we may need to verify the accuracy of the new data you provide to us.
The right to erasure – you can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
The right to restrict processing – This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
The right to data portability – this allows you to obtain and reuse your personal data for your own purposes but only applies when processing has been carried out by automated means.
The right to object – you can object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to us processing on this basis as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Rights in relation to automated decision making and profiling – at present, we do not carry out any such activities.
If you wanted to exercise any of the above rights please contact the University’s Data Protection Officer via email@example.com
You can request a copy of the information we hold about you; this is known as a “Subject Access Request” (SAR). In most circumstances we will not charge a fee for dealing with this request. However, we may charge a reasonable free if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. All SARs must be made in writing to the University’s Records Manager and you can find details as to how to do this on the University’s webpage: https://www.exeter.ac.uk/about/oursite/dataprotection/request/
6.0 What happens if I do not want you to process my personal data?
The primary reason for us collecting and processing your personal data is so that we can provide you with the means of advertising your property(ies) and/or room(s) on our Studentpad service. If you do not want us to process your personal data then we will be unable to accept your advertisement as we will be unable to form a contract.
7.0 Do you transfer any of my personal data to third parties or other countries?
Where data is shared within the UK, or the European Union (EU), the third party will be required to comply with and safeguard the data under the GDPR.
Your personal information will only be transferred to countries outside of the EU (“third countries”) or international organisations, where the European Commission has decided that an adequate level of data protection can be offered, or where adequate safeguards, such as the EU-US Privacy Shield, are in place.
Studentpad act as data processors and are based in the United Kingdom. They provide IT and system administration services. Studentpad directly uses the services of:
8.0 How do you secure my personal data?
We put in place a range of security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, Studentpad limit access to your personal data by their employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and these are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
The Studentpad website may include links to third party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
9.0 About the Studentpad website’s server
This website is hosted by our third party processor, Studentpad, which forms part of the Pad Group Limited group of companies, and is stored on servers provided by Fasthosts. These servers are located in the UK and are solely used by Pad Group Limited.
Some of the data centre’s more notable security features are as follows:
CCTV covering all areas of the data centres and corporate offices.
Highly experienced security guards on duty 24/7, 365 days a year.
Role-based access control swipe-card system across multiple secure areas to ensure absolutely no access by unauthorised personnel.
Full details of FastHosts' data centre can be found here.
All traffic (transferral of files) between this website and your browser is encrypted and delivered over HTTPS.
10.0 How long do you keep my personal data?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk and harm from unauthorised use or disclosure of your personal data, the purposes of which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
11.0 Who regulates the use of my personal data?
The University is registered as a Data Controller with the Information Commissioner's Office (ICO), the independent authority which oversees compliance with the DPA. The University's registration number is Z5785872 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. You can view our registration here.
12.0 What can I do if I have any concerns?
We aim to be transparent about the way we process your personal data but we understand that you may still have questions or concerns. If there is anything you are unclear about then please contact our Data Protection Officer via firstname.lastname@example.org who shall be happy to help.
If you remain dissatisfied then you have the right to complain to the ICO. Further advice on how you can raise a concern with us or escalate a matter to the ICO is available via the ICO website: https://ico.org.uk/make-a-complaint/
Once you have registered as an Agent/Landlord on Studentpad, we would like to be able to keep you informed about news, events and opportunities that may be of interest to you. This may include events such as the University’s annual Housing Fair, and periodical e-newsletters. You will be asked whether you are happy to receive communications from us as part of the account registration process. You can then manage your preferences within the “My Settings” section of the Studentpad control site. Our newsletters will also include an “Unsubscribe” option.
Please note: We may also contact you in respect of any queries relating to your advertisement. These are contractual rather than “marketing” communications and are therefore not subject to consent requirements.
14.0 Status of this Privacy Notice
This Privacy Notice was last reviewed on 20 May 2022.