Centurion Student Services (UK) Limited (trading as dwell Student Living) (“dwell”): Student Privacy Notice
Centurion Student Services (UK) Limited trading as dwell (we, us, are) is responsible for and committed to protecting the privacy and security of your personal data. This Privacy Notice describes how we collect, use and look after your personal data when you register an account on website portal, apply for accommodation services and in the course of us providing accommodation services to you. It also tells you about your rights and how the law protects you.
To assist you in understanding this Privacy Notice, we have set out in the Schedule examples of types of personal data we collect, how we use it, the lawful basis for processing such data, further details of your rights and a glossary of terms used.
We have appointed a Data Protection Manager (DPO). If you have any questions about this Privacy Notice, or wish to raise any requests to exercise your legal rights, please contact our DPO in writing, either:
by email to: [ firstname.lastname@example.org ]
by post to: Data Protection Manager, Centurion Student Services (UK) Limited, Manchester Student Village, Manchester, M1 5SX.
You have the right to make a complaint at any time to the ICO (www.ico.org.uk) and to seek judicial remedies. We would, however, appreciate the chance to deal with any concerns you have before you approach the ICO so please contact us in the first instance.
Your duty to inform us of changes
It is important that the data we hold about you is accurate and current, therefore please keep us informed of any changes to your personal data.
The data we collect about you
We may collect, use, store and transfer the types of personal data about you listed in the Schedule: Part 1. We require your personal data to enter into and perform the terms of a contract with you. If you fail to provide it, we may not be able to enter into or perform the contract and may have to cancel the contract.
We do not require you to provide us with sensitive personal data but you may provide us with sensitive personal data relating to your health, nationality, ethnic background or beliefs for the purposes of us providing to you the most effective service which takes into account your requirements and preferences. You consent to providing such information when you volunteer to provide it to us either during your registration and application process or during your contract with us. You are entitled to withdraw your consent to us holding such information about you at any time by notifying our Data Protection Manager.
Third Party Services
Our registration and application process may refer you to certain third parties, for example, in relation to finance arrangements, payment facilities or external guarantors. By pursuing links or referrals to these services you may enable third parties to collect or share your personal data. We have no control over these third parties or their privacy policies. You should therefore read their privacy notices to understand what personal data they collect about you and how they use it.
How personal data is collected
We collect personal data in the following ways:
|Directly from you
||You may provide personal data when you provide information to register with us or apply for accommodation via our website portal or over the telephone. You may also provide additional information to us during the course of us proving you with accommodation and ancillary services.
|From an applicant
||If you are a guarantor for a student applying for accommodation, your information may have been provided to us by the student.
||We may collect personal data from public sources such as social media websites
How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data:
- to perform the contract, we are to enter into or have entered into with you;
- to comply with a legal obligation; or
- where it is necessary and in our legitimate interests (or those of a third party) and your interests and rights do not override those interests.
The Schedule: Part 2 sets out the situations in which we process personal data about you and the corresponding legal basis or legitimate interests. We may process your personal data based on more than one lawful ground depending on the specific purpose for which we are using your information.
Change of purpose
We will only use your personal data for the purpose that we originally collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to use your personal data in this manner. We may process your personal data (without your knowledge or consent) where this is required or permitted by law.
We rely on your consent as a legal basis for processing your personal data only in relation to sending marketing communications to you in connection with our accommodation services. You have the right to withdraw your consent to marketing communication at any time by [how will this operate?].
Transfer of personal data to group companies
Centurion Student Services (UK) Limited is a subsidiary company of Centurion Corporation Limited, a company registered in Singapore, outside of the EEA. Centurion Corporation Limited hosts our registration and application portal for the purposes of us providing accommodation services and processes your data for these purposes. To ensure that your personal information receives an adequate level of protection, Centurion Student Services (UK) Limited (dwell) and Centurion Corporation Limited have entered into an agreement to ensure that your personal information is treated in a way that is consistent with and which respects the EU and UK law on data protection. If you require further information about this, you can request it from the Data Protection Manager.
Disclosure of personal data to third parties
For the purposes of providing ancillary services to you (for example, in relation to car parking, parcel delivery, laundry services, security and call-out services) we may share your personal data with third parties. We may also need to share your personal data to ensure that we maintain appropriate levels of customer service and for the purposes of the administration of our business. For example, we may need to share your data with advisers, insurers and auditors, further details of which are set out in the Schedule: Part 3.
We do not allow our third-party service providers to use your personal data for their own purposes. They can only process your personal data for specified purposes and in accordance with our instructions. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
We may share your personal data with your guarantor if that is necessary for the purposes of our contract with the guarantor and for financial reasons.
Additionally, we may need to share your personal data with certain authorities or a regulator or otherwise to comply with the law.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees and persons who have a business need to know and they only process your personal data on our instructions and subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Details of retention periods for different aspects of your personal data are available in our QR Master List which you can request from us. For legal reasons we keep basic information about users of our accommodation services (including contact, identity, financial and transaction data) for six years after they cease to have a relationship with us.
Your legal rights
You have certain rights in relation to your personal data. These are set out in the Schedule: Part 4. If you wish to exercise any of your rights, please contact our DPO.
You will not have to pay a fee to exercise any of your rights. However, if your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee for this information or refuse to comply with your request.
We may request specific information from you to help us confirm your identity when you contact us. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.
We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month to deal with your request if it is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
This policy was last updated in May 2018
- Schedule 1
- Part 1 Types of personal data
||digital and photographic images
||name, address, email address and telephone number
||bank account and payment card details
||first name, last name, date of birth
|Marketing and Communications data
||your preferences in receiving marketing communications from us
||your username and password, and preferences]
|Sensitive Personal data
||information about your health, including any medical condition you have notified to us
your nationality, ethnic origin, religious or other beliefs
||internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website
||includes details about payments to and from you and other details of accommodation and ancillary services provided to you
||data provided to us or collected in the course of us providing accommodation services or ancillary services to you, preferences, opinions and incident data
- Part 2 Lawful basis for processing and processing activities
Set out below are specific details of the processing activities we undertake with your personal data and the lawful basis for doing this.
||Type of data
||Lawful basis for processing
|To register you as a new user of our services
||to perform our contract with you.
|To enter into the terms of a tenancy agreement with you (and your guarantor)
||identity, contact, financial, transaction
||(i) to perform our contract with you;
(ii) as necessary for our legitimate interest in maintaining appropriate levels of customer service and payment for our services.
|To manage our relationship with you, and your preferences and to provide you with access to ancillary services and invite you to events
||identity, contact, profile, sensitive personal data
||(i) to perform our contract with you;
(ii) as necessary to comply with a legal obligation;
(iii) As necessary for our legitimate interests in keeping our records updated and in maintaining appropriate levels of customer service.
(iv) and in relation to sensitive personal data your consent
|To send to you marketing communications
||identity, contact, marketing and communications,
sensitive personal data
|as necessary for our legitimate interest in promoting our products and services in accordance with your preferences.
and in relation to sensitive personal data your consent
|To provide for your safety and welfare and that of others
||identity, contact, CCTV, sensitive personal data
||(i) as necessary to comply with a legal obligation;
(ii) as necessary for our legitimate business interests in ensuring a safe and secure environment for our users;
(iii) and in relation to sensitive personal data and criminal conviction data either with your consent or in your or another’s vital interests or the public interest.
|To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
||identity, contact, technical
||(i) as necessary for our legitimate interests in running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise;
(ii) as necessary to comply with any legal obligations.
|To deliver relevant website content to you and measure or understand the effectiveness of our content
||identity, contact, profile, technical
||as necessary for our legitimate interests in promoting the effectiveness of our website and marketing activities.
|To use data analytics to improve our website, products/services, customer relationships and experiences
||as necessary for our legitimate interests to define types of customers for our products and services, to keep our website updated, relevant, and effective.
||Acting as processors or controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
|HM Revenue & Customs, trading standards, regulators and other authorities (including the police)
||Acting as processors or controllers who require reporting of processing activities in certain circumstances, including where we are required by law or for the purposes of preventing crime or fraud.
||third parties who support us in providing ancillary services (car parking, parcel delivery, laundry services, security and call-out services); third parties whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
You have the following legal rights in relation to your personal data:
|Access your data
||You can ask for access to and a copy of your personal data and can check we are lawfully processing it.
||You can ask us to correct any incomplete or inaccurate personal data we hold about you.
||You can ask us to delete or remove your personal data where:
(a) there is no good reason for us continuing to process it;
(b) you have successfully exercised your right to object (see below);
(c) we may have processed your information unlawfully; or
(d) we are required to erase your personal data to comply with local law.
We may not always be able to comply with your request for specific legal reasons, which will be notified to you at the time of your request.
||You can object to the processing of your personal data where:
(a) where we are relying on our legitimate interest (or those of a third party) as the basis for processing your personal data, if you feel it impacts on your fundamental rights and freedoms; or
(b) where we are processing your personal data for direct marketing purposes.
In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms and in such circumstances, we can continue to process your personal data for such purposes.
||You can ask us to us to suspend or restrict the processing of your personal data, if:
(a) you want us to establish the accuracy of your personal data;
(b) our use of your personal data is unlawful, but you do not want us to erase it;
(c) you need us to hold your personal data (where we no longer require it) as you need it to establish, exercise or defend legal claims; or
(d) you have objected to our use of your personal data, but we need to verify whether we have overriding legitimate grounds to use it.
|Request a transfer
||In limited circumstances you can request a transfer of your personal data which is held in an automated manner and which you provided your consent for us to process such personal data or which we need to process to perform our contact with you, to you or a third party. We will provide your personal data in a structured, commonly used, machine-readable format.
|Withdraw your consent
||You can withdraw your consent at any time (where we are relying on consent to process your personal data) e.g. in relation to marketing communication. This does not affect the lawfulness of any processing carried out before you withdraw your consent.
||a body that determines the purposes and means of processing personal data
||an individual living person identified by personal data (you)
||information identifying a data subject from that data alone or with other data we may hold
||a body that is responsible for processing personal data on behalf of a controller.
||Information Commissioner’s Office, the UK’s supervisory authority for data protection issues.