Privacy Policy

Student Castle respects your privacy and is committed to handling personal data fairly, lawfully and transparently. This Privacy Policy explains how we collect and use personal data when you use our website, enquire about or book accommodation, live with us, act as a guarantor or emergency contact, visit our properties, communicate with us, take part in promotions, or otherwise interact with Student Castle.

1. Who we are

Student Castle Property Management Services Limited (“SCPMS”, “Student Castle”, “we”, “us” or “our”) is a company incorporated in England and Wales under company number 07119911. Our registered office is Kintyre House, 70 High Street, Fareham, Hampshire, England, PO16 7BB. Our head office is 4th Floor, WestWorks, White City Place, 195 Wood Lane, London W12 7FQ.

SCPMS manages student accommodation for property-owning entities within its group and for relevant landlords. Depending on your relationship with us and the property concerned, SCPMS and/or the relevant landlord may act as a controller of your personal data. The relevant landlord will normally be identified in your booking or accommodation documents. We may also act as a processor for another controller in limited circumstances.

Our Data Protection contact is available at dpo@studentcastle.co.uk.

2. The law that applies

We process personal data in accordance with applicable UK data protection and privacy law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and those laws as amended by the Data (Use and Access) Act 2025 (“DUAA”).

3. Who this policy covers

·       prospective residents, applicants and residents;

·       parents, guardians, guarantors and emergency contacts;

·       website visitors and users of our booking, resident, enquiry, viewing or contact tools;

·       visitors to our properties and offices;

·       people who enter competitions, promotions, surveys or referral schemes;

·       suppliers, business contacts and partners; and

·       job applicants, where a separate recruitment privacy notice has not been provided.

4. Personal data we may collect

The personal data we collect depends on how you interact with us. It may include:

·       Identity data: name, preferred name, date of birth, age, photograph and identification information where required.

·       Contact data: postal address, email address, telephone number and emergency-contact details.

·       Accommodation and study data: property and room preferences, booking details, tenancy/licence details, move-in and move-out information, university, course and student-status information.

·       Guarantor and relationship data: information about a guarantor, parent, guardian or other person connected with your booking or stay.

·       Financial and transaction data: payment status, bank or payment information, deposits, refunds, invoices, arrears and transaction records. Payment-card data may be processed directly by our payment providers rather than stored by Student Castle.

·       Account and service data: resident or booking-portal identifiers, enquiries, maintenance requests, viewing bookings, preferences, feedback, complaints and customer-service history.

·       Technical and usage data: IP address, device and browser information, website activity, referring pages, interaction data, cookie identifiers and similar online information.

·       Marketing and communications data: your communication preferences, campaign engagement and records of consent or opt-out choices.

·       Property security and access data: CCTV footage, access-control or entry records and incident information where those systems are used.

·       Recruitment data: CV, employment history, qualifications, interview information and references where you apply to work with us.

·       Special category data: limited information about health, disability or wellbeing where you choose to provide it or where it is necessary to support accessibility, safety, emergency response or another lawful purpose. We only use special category data where an additional legal condition applies.

5. How we collect personal data

·       directly from you when you enquire, book, create an account, complete a form, contact us, visit a property, make a payment, use a resident service or communicate with our teams;

·       from a parent, guardian, guarantor, emergency contact or other person involved in your booking or stay;

·       from universities, referral partners, agents or other third parties where you have authorised the sharing or another lawful basis applies;

·       from service providers that support our website, booking, resident management, payments, communications, analytics, advertising, security and customer service;

·       automatically when you use our website or digital services, using cookies and similar technologies as explained in our Cookie Policy;

·       from CCTV, access-control and security systems at our properties where applicable; and

·       from publicly available sources where it is lawful and appropriate to do so.

6. Why we use personal data and our lawful bases

We only use personal data where we have a lawful basis. The table below summarises the main purposes and bases we expect to rely on. More than one basis may apply depending on the circumstances.

Where we process special category personal data, we also rely on an appropriate condition under Article 9 UK GDPR and, where required, the Data Protection Act 2018. Depending on context, this may include explicit consent, vital interests, legal claims or a substantial-public-interest condition.

7. Marketing communications

We may send marketing about Student Castle accommodation, offers, resident products or relevant services where the law allows us to do so. For email, text and similar electronic marketing, we will obtain consent where PECR requires it. We may use the existing-customer “soft opt-in” where its legal conditions are met, including giving you a clear opportunity to opt out when we collect your details and in every message.

You can opt out of marketing at any time by using the unsubscribe method in a message, changing your preferences where available, or contacting us. Opting out of marketing does not stop service or administrative communications that we need to send about an enquiry, booking, payment, tenancy, resident service, safety issue or other non-marketing matter.

8. Cookies, analytics and online advertising

We use cookies and similar technologies for security, website functionality, preferences, analytics and, where enabled, advertising and campaign measurement. Our Cookie Policy explains these technologies and how to manage your choices.

Where PECR requires consent, the relevant non-essential technologies should not be activated until you have made a valid choice. Where we rely on a statutory exception for limited statistical or appearance/functionality purposes, we will only do so where the legal conditions are met and we provide any required information and simple means of objecting.

9. Sharing personal data

We may share personal data where necessary with:

·       the relevant property owner, landlord and other entities within the Student Castle/Mapletree group where they need the information for the purposes described in this policy;

·       booking, property-management and resident-portal providers;

·       payment processors, banks and financial-service providers;

·       website hosting, development, IT, cybersecurity, cloud and communications providers;

·       email, CRM, customer-support, chatbot, call, survey and marketing-service providers;

·       analytics, search, advertising and social-media platforms where their use is lawful and consistent with your cookie/marketing choices;

·       universities, guarantors, emergency contacts or support services where there is a lawful and appropriate reason to share information;

·       professional advisers, auditors, insurers, debt-recovery providers and dispute-resolution bodies;

·       police, courts, regulators, public authorities and other bodies where disclosure is required or permitted by law; and

·       a purchaser, investor, lender or successor entity in connection with a proposed or completed corporate or property transaction, subject to appropriate safeguards.

We require service providers acting on our behalf to protect personal data and use it only for authorised purposes. Some third parties, such as payment providers, social-media platforms or the relevant landlord, may act as controllers in their own right and their own privacy information may also apply.

10. International transfers

Some of our service providers or group companies may process personal data outside the United Kingdom. Where this results in a restricted transfer under UK data protection law, we use an available lawful transfer mechanism. This may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for eligible US organisations, an International Data Transfer Agreement or UK Addendum, binding corporate rules, or another safeguard or exception permitted by law.

You can contact dpo@studentcastle.co.uk if you would like more information about the safeguards used for a particular transfer.

11. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is limited to people who need the information for their role, and relevant staff and service providers are subject to confidentiality and security obligations.

We maintain procedures for identifying, assessing and responding to personal-data breaches and will notify affected individuals and the relevant regulator where the law requires us to do so.

12. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide services, comply with legal, tax, accounting or regulatory obligations, resolve complaints, establish or defend legal claims, prevent fraud and maintain appropriate records.

Retention periods vary according to the type of information and our relationship with you. We consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes of processing, whether those purposes can be achieved in another way, and applicable legal requirements. We maintain internal retention rules and can provide further information about relevant periods on request.

Where appropriate, we may anonymise information so that it can no longer be linked to an individual and use the resulting anonymous information for statistical, planning or research purposes.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

·       ask for access to the personal data we hold about you;

·       ask us to correct inaccurate or incomplete personal data;

·       ask us to erase personal data in certain circumstances;

·       ask us to restrict how we use personal data in certain circumstances;

·       object to processing based on legitimate interests, and object at any time to processing for direct marketing;

·       receive certain personal data in a structured, commonly used and machine-readable format and/or ask us to transmit it to another controller where the right to data portability applies;

·       withdraw consent at any time where consent is the lawful basis, without affecting processing carried out before withdrawal; and

·       where we make a solely automated decision that has a legal or similarly significant effect on you, receive information about that decision and, where the law applies, make representations, obtain human intervention and contest the decision.

These rights are subject to conditions and exemptions in the law. We may need to verify your identity and may ask for information reasonably required to locate the relevant data. The statutory response period normally starts when we have the information reasonably required to verify identity, and for a subject access request it may be paused where clarification is reasonably required under current law.

You will not usually have to pay a fee. Where the law permits, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive, and we will explain the reason and your relevant complaint rights.

14. Under-18 users

Student Castle accommodation and the Website may be relevant to prospective students who are under 18. We take additional care when processing children’s personal data and apply age-appropriate safeguards where required. Some booking or contractual steps may require a parent or guardian. Where an online service is likely to be accessed by children, we will consider the additional requirements of UK data-protection law and the Children’s code.

15. Third-party websites and services

Our website may link to or embed third-party websites and services. Those organisations may process personal data as controllers in their own right. We are not responsible for their privacy practices, and we encourage you to read their privacy information before providing personal data or using their services.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems, suppliers, legal requirements or guidance. The latest version will be published on our website and will show the date of the most recent update. Where a change is significant, we will take reasonable steps to bring it to your attention where appropriate.

17. Contact us and exercise your rights

·       Data Protection email: dpo@studentcastle.co.uk

·       General enquiries: head.office@studentcastle.co.uk

·       Post: Data Protection, Student Castle Property Management Services Limited, 4th Floor, WestWorks, White City Place, 195 Wood Lane, London W12 7FQ

18. Data-protection complaints

If you believe we have not handled your personal data in accordance with data-protection law, you can make a data-protection complaint to us by emailing dpo@studentcastle.co.uk or using our online complaints route. We will acknowledge a data-protection complaint within 30 days of receipt. We will take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and provide the outcome without undue delay.

You also have the right to complain to the UK data-protection regulator, the Information Commissioner’s Office (ICO). You can find current contact and complaint information at ico.org.uk. We would welcome the opportunity to address your concerns directly first, but you are not required to do so before contacting the ICO where the law allows you to complain directly.