Privacy Policy

Last Updated: 26/07/2025

Stuhomes (referred to as “we”, “us”, or “our”) places a high priority on our student’s or any representing party’s
(referred to as “you” or “your”) data security and acknowledges the significance of privacy protection. We are committed
to handling the personal information of those we engage with, whether customers, suppliers or colleagues, responsibly and
in a way that meets the legal requirements of the countries in which we operate.

This Privacy Policy provides an overview of the types of personal information we collect, how we collect, use, retain, and
protect it, as well as your rights in relation to the information we have collected. Please read this Privacy Policy carefully,
as it becomes legally binding when you use our services and communicate with us.

In providing the personal data of any individual (other than yourself) during your use of our services, you confirm that you
have obtained consent from such individual to disclose their personal data to us, as well as consent to our collection, use and
disclosure of such personal data, for the purposes set out in this Privacy Policy.

1. Our Contact Details

Name: Stuhomes Accommodation Limited, trading as ‘Stuhomes’
Address: 1st Floor Winchester House, 19 Bedford Row, London, WC1R 4EB
Phone Number: +44 020 7242 5720
E-mail: hello@stuhomes.com
UK ICO Registered Number: ZA506462

2. The Type of Personal Information We Collect

We may collect and process the following personal data:

Identity Information and Contact Details

Full name, email address, phone number, gender, date of birth, home address, residential address, nationality, national id
number*, social security number*, taxpayer identification number*, driver’s license number*, passport number*, passport scan,
visa and residence permit scan*, picture*, signature, relationship to student.

In some cases, such as where we need to comply with anti-money laundering regulations, we may also collect additional commercial
or identification information.

Identity and contact details may relate to the student, student’s guarantor, and student’s emergency contact.

Education Information

Education type, university name / school name, university course / subject name, student number*, student letter scan*, CAS number*.

Medical Information

Medical conditions*, medical reports*, welfare check reports*, physical disability details*, special physical requirements*.

Financial Information

Finance: proof of finance*, proof of student loan*, student loan details*, credit history*, rent insurance details*, tax documentation*.

Payments: invoice payment details, payer name, location, payment date, payment amount, payment method, payment currency, payment reference, transaction reference, payment status, proof of payment.

Refunds: payee full name, bank name, bank address, SWIFT code, IBAN, account number, sort code, refund currency, refund amount, refund date.

Payment Schedule: instalment plan amounts, due dates, rent components, rent arrears, non-payment escalation details (e.g. court claims details).

Importantly, we do not collect, process or store cardholder data (e.g. debit or credit card details). All online payments are
processed by third-party payment processing companies which have their own privacy and security policies and we do not accept any
responsibility for them.

Technical Data

Internet protocol (IP) address, login information, browser type and version, time zone setting, browser plug-in types and versions,
operating system and platform, Uniform Resource Locators (URL) details, products you viewed or searched for, page response times,
download errors, length of visits to certain pages, page interaction information, methods used to browse away from the page, cookies.

Security Data

Residences’ CCTV Surveillance Camera and Audio Recording, security entry system records, incident reporting details, formal complaint
details, details from formal incident investigations.

Marketing Data

Preferences for being contacted by us, survey information, marketing information.

* Collected only in some cases

3. How We Get the Personal Information and Why We Have It

We will only use your personal data when the law allows us to do so. Most of the personal information we process is provided to us
directly by you for one of the following purposes:

Enquiry Processing

We may collect and process information you provide us when enquiring about a residence, a room, or about any of our products.
This information may include your identity information, contact details, education information, medical information, financial
information, technical data, and marketing data. We may also collect and process enquiry information, booking information, any
additional information you provide or special request you make.

Booking Processing

We may process information you provide us when accepting our offer and completing forms, contracts or other agreements with us.
This information may include booking details, your identity information, contact details, education information, medical information,
financial information, technical data, marketing data, your guarantor identity information and contact information, your emergency
contact identity information and contact information.

Health and Safety

We may process medical information you provide us when accepting our offer and completing forms, contracts or other agreements with us.
Medical Information includes the details of the medical condition(s) and/or physical disability you would like us to be aware of when
allocating your accommodation, and information about any special physical requirements you have for the purpose of assistance with
evacuation from a building in an emergency.

Complaint and Incidents

We may collect and process information you provide us when you lodge a complaint or when you report an incident to us. This information
may include identity information, contact details, complaint details, any evidence submitted, such as medical data, police report or any
other details submitted.

Communication

We may collect the necessary information to correspond by phone, email, letter, face to face, or via our website. In some cases, you may
choose to provide unsolicited personal information (information we have not asked for) to us such as a CV, or medical records you wish to
discuss with a member of staff. Where this is the case, this personal data will be handled with the same care as any other personal data
we process and in accordance with data protection legislation as laid out in this notice.

Marketing

We may collect and process marketing data when you inform us about your preferences for being contacted by us when you take part in any of
our online surveys.

We also receive personal information indirectly, from the following sources in the following scenarios:

Property Management, Contractual Obligations

We may collect and process information provided to us by our partners involved in operation and management of residences. We may also
collect and process information provided to us by our partners in order to perform our contractual obligations to you.

Security

We may collect and process data obtained through CCTV surveillance camera and audio recording, or through electronic means such as security
entry system records at premises you occupy under a contract with us. We may also collect and process information related to reported
incidents and formal complaints we were made aware of.

Technical

We may collect and process technical information collected about our website use.

4. How We Use This Personal Information

We use the information that you have given us in order to:

Carry our obligations under your accommodation contract.
Comply with our obligations under health and safety and other laws, including by keeping records of incidents.
Ensure that you comply with your obligations under the accommodation contract.
Notify your guarantor about any breaches of the accommodation contract which might affect them, and to secure their compliance with their obligations.
Promote the safety of the building you occupy, by monitoring compliance with building rules and ensuring suitable plans are in place for evacuation from the building.
Manage your booking with us.
Manage the accommodation you are booking with us.
Provide you with additional services you book with us or notify you about changes to our services.
Administer our services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
Provide you with the best experience of living in student accommodation.
Improve our services and communications with you and ensure they are presented in the most effective manner.
Measure or understand the effectiveness of advertising we serve and deliver relevant promotional material to you.
Allow you to participate in interactive features of our services, when you choose to do so.

5. Disclosure of Your Information

We may share your information with selected third parties including:

Our group entities or subsidiaries.
Affiliates, business partners, suppliers and subcontractors for the performance and execution of any contract we enter into with them or you.
Analytics and search engine providers that assist us in the improvement and optimisation of our site.
Advertisers and advertising networks solely to select and serve relevant adverts to you and others (with your consent).
Your education provider, guarantor, and emergency contact in cases of ongoing emergency (with your consent).

A list of all third parties we share your data with depends on your specific use of our services and your specific case. If you would like
further information about who we have shared your data with, or to be provided with a list specific to you, you can request this by writing
to hello@stuhomes.com.

We may disclose your personal information if we are under a duty to disclose or share your personal data in order to comply with any legal
obligation, enforce or apply agreements, or protect the rights, property, or safety of Stuhomes, our customers, or others.

More specifically, we may disclose your personal information:

For the reasons outlined in Clause 3.
For the purposes of fraud protection.
To prevent and detect fraud or crime.
To assist with investigations of fraud or other illegal activity where we believe it is reasonable and appropriate.
In response to a subpoena, warrant, court order, or as otherwise required by law.
To assess financial and insurance risks.
For the purposes of credit risk reduction.
To recover debt or in relation to your insolvency.
To develop customer relationships, services, and systems.

6. Legal Basis For Processing Your Personal Information

In Europe or the EEA

The lawful bases we use for collecting and processing your information in Europe or within the EEA are:

Where it is necessary for entering into or performing a contract with you.
Where we have a legitimate interest to do so, provided your rights do not override those interests.
Where you have consented to its uses.
Where we believe it is in your vital interests to share your personal details.
Where required to comply with our legal obligations.

In the United Kingdom

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

Your consent. You can remove your consent at any time by contacting us using the details supplied above. Consent applies to marketing communications you have opted in to, or to sharing information with a ‘next of kin’ where this is not absolutely necessary in an emergency.
We have a contractual obligation. If we provide you with accommodation services, this will be the main reason for processing your personal information.
We have a legal obligation. This could arise in relation to council tax, a demand for information from an official body, or a request by a public health body.
We have a vital interest. In an emergency, we might need to share information with a medical professional.
We have a legitimate interest. Processing is necessary for legitimate interests pursued by us or a third party, and is not overridden by your rights and freedoms.

7. How We Retain And Store Your Personal Information

We retain personal data only as long as necessary to fulfil the purposes collected for, including legal, accounting, reporting, and claims-related purposes.
We consider the amount, nature, sensitivity, risk, purpose, and legal requirements to determine retention periods. Contact us for further detail regarding our retention policy.
We may transfer and store data outside the EEA. By submitting your personal data, you agree to this transfer, storage and processing. We take steps to ensure security and compliance with this privacy notice.
Where data is transferred to third parties outside the EEA, we ensure appropriate technical, physical and organisational safeguards and contractual protections are in place.

8. How We Protect Your Personal Information

We take safeguarding of your information very seriously and take steps to keep it secure:

Our technical security team monitors systems for abnormal or malicious activity. Additionally, we have ASV scanning performed by a PCI SSC Approved Scanning Vendor on a quarterly basis, where applicable.
We handle data in a manner that fits its sensitivity and classification and maintain safeguards in line with relevant laws and regulations.
Confidential data is stored electronically and access is controlled via passwords. Devices are protected with secure login and password-protected screensavers.
Access to confidential, restricted and protected information is limited to authorised persons with a legitimate business need.
Sensitive data no longer required is discarded securely and irrecoverably. On termination of employment, system access is revoked and accounts are disabled/removed.
We require partners to comply with data security rules and report noteable incidents without delay using the contact details above.

9. Your Data Protection Rights

In Europe or the EEA

Your exercise of these rights is subject to certain exemptions to safeguard public interest (e.g. prevention/detection of crime) and our
interests (e.g. legal privilege). We will check entitlement and respond in most cases within one month. No fee is usually required.

Subject to applicable laws, you may have the right to access information we hold about you and to request further details, copies, corrections,
deletion where applicable, withdrawal of consent, and to stop direct marketing.
Where we undertake wholly automated decision making with legal or similarly significant effects, you may request information about the
decision-making methodology and verification (subject to lawful exemptions).
Object to processing based on legitimate interests unless our reasons outweigh prejudice to your rights.
Restrict how we use your information whilst a complaint is being investigated.

In the United Kingdom

Under data protection law, you have rights including:

Your right of access.
Your right to rectification.
Your right to erasure.
Your right to restriction of processing.
Your right to object to processing.
Your right to data portability.

10. How To Complain

Please send any questions, comments or requests regarding this privacy policy to Stuhomes, our Data Protection Officer, at
hello@stuhomes.com. We hope that our Data Protection Officer can resolve any query or concern you
raise about our use of your information.

If you feel that we have not addressed your questions or concerns adequately, or you believe that your data protection or privacy rights have
been infringed, you can complain to any supervisory authority or other public body with responsibility for enforcing privacy laws. In the United
Kingdom this is the Information Commissioner’s Office (ICO), via the ICO website.

11. Third-Party Links

Our services may contain links to and from the websites of partner networks, advertisers and affiliates. If you follow a link to any of these
websites, please note those websites have their own privacy policies and we do not accept responsibility for them. Please check these policies
before you submit any personal data to these websites.

12. Changes To Our Privacy Policy

To keep up with changing legislation, best practice and changes in how we process personal information, we may revise this Privacy Policy at any
time without notice by posting a revised version on this website. To stay up to date, please check back periodically.