Last updated – 25/05/2018
At CRM Students we are committed to protecting and respecting your privacy. For the purpose of the data protection laws the data controller is CRM Students Limited, Hanborough House, 5 Wallbrook Court, North Hinksey Lane, Botley, Oxford, OX2 0QS, United Kingdom (“We” or “Us”).
By visiting www.crm-students.com, or engaging with us, you are accepting and consenting to the practices described in this policy.
Our nominated representative for the purpose of the Act is the Data Protection Officer who can be contacted at GDPR@crm-students.com.
The personal information we process about you
In order to provide our services, we collect and process a range of information about individuals. We may collect and process the following data about you:
- Information you give us. You may give us information about you by filling in forms on our site www.crm-students.com (our site), via our student portal crm.securestudentpayments.com/student/, via our Guarantor portal crm.securestudentpayments.com/student/guarantorlogin.aspx or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register to use our site, subscribe to a service, search for a product or service, make a booking on our site, in person or over the phone, participate in discussion boards or other social media functions, enter a competition, promotion or survey, and when you report a problem.
- We collect information on residents, applicants, guarantors, employment candidates, visitors to our website or premises, suppliers and clients.
- We have categorised the types of data we may collect from you as follows: Tenant, Prospective Tenant, Guarantor and Next of Kin
- Identity Data – Your name, date of birth, gender, personal description, photograph, information about your nationality, marital status, emergency contact or Next of Kin including relationship, Guarantor, driving licence, passport information, visa Information, entitlement to live in the UK, National Insurance Number, utility bill or similar identifiers;
- Contact Data – Contact details: postal and e-mail address, phone number;
- Course Data – Details of your University, College or Institution and your Faculty, Course and Year of Study;
- Financial Data – Financial and credit card information, details of your bank account and national insurance number, information about your remuneration and/or earnings and transaction data including details about your payments to and from you;
- Profile Data – Preferences including details of room requirements, friends to share with, religious or belief requirements or other such preferences provided by you;
- Marketing and Communication Data – Your marketing preferences in receiving information from us
- Special Categories of Personal Data – we may process some personal information that is more sensitive in nature, because it relates to your physical or mental health or wellbeing or your gender identity (such as to enable us to accommodate or support any disabilities you may have); or your religious views or ethnic origin. We may collect this information directly from you, or occasionally we are provided with this information from third parties.
If you are a client the information you give us may include:
- Your name, contact details: postal and e-mail address, phone number, date of birth and national insurance number;
- Details about your organisation, Know Your Client details (KYC), ownership structure, shareholders
- Your name, address and contact details, for majority shareholders above 25%
- Photo ID and proof of address for majority shareholders;
If you are a supplier the information you give us may include:
- Your name, contact details: postal and e-mail address, phone number, date of birth and national insurance number;
- Company details, contact details: postal and e-mail and phone number,
- Health and safety and insurance certificates,
- Information on the performance of the company
- Ownership structures and shareholder details
- Physical location data
CCTV systems are installed at all of our premises. All internal and external CCTV cameras are clearly labelled or otherwise notified to staff and visitors and are visible
- Electronic entry systems including, swipecard and fob entry, are installed at the majority of our sites to allow you access to our premises
- Meter readings
- Information we receive from other sources.
We work closely with a number of third parties who may provide us with your personal data directly, such as landlords, universities or credit reference agencies to enable us to provide our services
- We may receive information if you have provided permission to referees or other organisations to share it with us. Before providing permission to such third party organisations to share your personal data, you should check their privacy notices carefully.
- In order to manage and provide our services, we work with a number of other partners including to process payments for rent or other monies we are owed, to verify your identity or status through credit reference checks.
- We may also search publicly available records, including business records; social and other media outlets and Post Office’s National Change of Address Database and credit reference agencies
- We may combine this information with information you give to us and information we collect about you.
Information we automatically collect about you when using our online services.
With regard to each of your visits to our site we may automatically collect the following information:
- technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
Uses made of the information
Under the data protection laws, to protect individuals, We are only permitted to collect and use data for certain specified lawful purposes. We use information held about you in the following ways:
- Information that is necessary for the purpose of entering into or fulfilling a contract:
This applies to any personal information that We process for the purpose of delivering accommodation services to our tenants, or for the purpose of entering into a guarantee or other activities related to the management and administration of a tenancy, the maintenance of the building. to process your application for a tenancy or guarantor; to administer your tenancy; to communicate with you and respond to your requests;
- We will process information to enable us to manage payments including to recover any unpaid sums due to us or the landlord;
- We will use personal data for these reasons whilst you, or the tenant you have relationship with, remains a tenant of ours.
Information necessary to protect vital interests:
- Whilst we hope that this is not required, We will collect and process information to support tenants in an emergency situation. This includes processing information on next or kin and emergency contacts.
- We may also pass on information to security, police, accommodation managers or emergency services where necessary.
Information necessary to support our legal obligations:
- We may be required by law to collect, hold or share personal data. For example if We are ordered by a court of law to disclose information or to meet financial reporting obligations.
- We also process information to prevent and detect criminal activity, fraud and misuse of or damage to the landlords property;
Information processed for our own legitimate business interests
- Providing that we are not intruding on your privacy, and we have taken appropriate steps to protect your rights, we may process personal data for a number of reasons connected with the operation of our business, including dealing with problems that may arise; promoting our services; developing or improving our service operations; internal management and reporting; engaging with prospective and current tenants, clients and personnel.
- We use the automated data collected from users of our online services to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; to improve our site to ensure that content is presented in the most effective manner for you and the device you are using to view our website; as part of our efforts to keep our site safe and secure; and to measure or understand the effectiveness of advertising we provide to you and others, and to deliver relevant advertising to you;
- We also provide interactive features of our online services, when you choose to do so, and may make suggestions and recommendations to users of our site about goods or services that may interest you.
Information processed based on Promotional Communications
- If we are providing you with email based communications, we will only do so with your consent. If you have given us your consent, you can withdraw your consent at any time by contacting the Accommodation Team.
Information processed based on special categories of information i.e. information revealing racial ethnic origin, health data, sex life or sexual orientation, we must have a further lawful basis for the processing. This may include:
- Where you have given us your explicit consent to do so e.g. to cater for your medical needs
- Where the processing is necessary to protect your vital interests or someone else’s vital interests
- The processing being necessary for reasons of substantial public interest e.g. to undertake activities to the prevention or detection of fraud or other unlawful or dishonest activities
Disclosure of your information
In order to provide our services, and within the lawful conditions for processing personal data, We may share your information with selected third parties including:
- Where we have a legal or regulatory obligation to do so – this will include sharing your personal information with local councils for the provision of Council tax exemption;
- Business partners, landlords, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
- Where it is necessary to do so to protect or defend our legal rights or the legal rights of others;
- If you are a tenant and you fail to pay your rent we may contact the guarantor and inform them of this failure when exercising the landlords rights under the guarantee;
- With your University so that they can provide you with support in the event that we have concerns surrounding your health or in the even of any serious disciplinary matters;
- With your emergency contact or Next of Kin in the event this is required;
- Analytics and search engine providers that assist us in the improvement and optimisation of our site.
- We may disclose your personal information to third parties:
In the event that the landlord sells or buys any business or assets, for which CRM Students Limited are the data controller, in which case we may be required to disclose your personal data to the prospective seller or buyer, managing agent and solicitors of such business or assets.
If CRM Students Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
- We may also provide aggregated statistics about our sales, customers, traffic patterns and other site information to third parties, but these statistics will not include any information that could personally identify you.
Where we store your personal data
We take the security of your data seriously. We operate internal policies and controls to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees, sub-contractors and landlords in the performance of their duties.
All information you provide to us is stored on secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
For how long does the company keep data?
The periods for which we keep your information will vary according to the purpose for which we use the information.
Unless there is a specific legal requirement to keep your information we will not keep it for longer than necessary for the purposes for which the data was collected or for which it is to be further processed.
By law we are required to retain certain information for a prescribed period of time. Where there is no such legal requirement to determine the retention period information may be kept for more or less time depending on how long we reasonably feel is required.
We will consider the amount, nature and sensitivity of personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we are processing your personal data to determine what is reasonable.
Data about your tenancy is held for the duration of the tenancy and up to 6 years after the tenancy expires or is terminated.
Details of your guarantor are retained for the duration of the guaranteed tenancy and for up to 6 months after the tenancy expires or is terminated to ensure that all sums have been collected by the landlord.
Client and Supplier information will be kept for the duration of the contract and for a period of no less than 6 years after the contract has terminated.
In some circumstances the company may anonymise your personal data for research and statistical purposes where we may use this information indefinitely without further notice to you.
The data protection laws give you a number of rights.
You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting the site team at your accommodation.
You have the right to withdraw your consent where that is the legal basis of our processing. For us, this generally only applies to consent to marketing, or where you are engaging with us in our online services
You have a right to access your personal data that We process, and to ask for any inaccuracies to be rectified.
You have a right to request the erasure of certain data from our systems, object to certain processing activities, or to restrict the scope of our data processing in certain circumstances
Information on these rights is available on the ICO website: www.ico.org.uk
If you would like to exercise any of these rights, please contact GDPR@crm-students.com. You can make a subject access request by completing the company’s form for making a subject access request which can be found [here]. Please note that any subject access request made will require proof of identity for the person making the request.
If you believe that We have not complied with your data protection rights, please contact us on the above address in the first instance. If you are not satisfied with the company’s response you can contact the Information Commissioner directly.
How to contact us
- By email to GDPR@crm-students.com
- Or write to us at: Data Protection Officer, CRM Students Limited, Hanborough House, 5 Wallbrook Court, North Hinksey Lane, Botley, Oxford, OX2 0QS