Privacy notice

[Owner to confirm the controller and wording before launch.]

Who we are. This website is run by UPP (the company named in the footer), which operates halls of residence at Nottingham Trent University in partnership with NTU. UPP is the controller for the information you enter on this site. NTU becomes the controller for your accommodation booking once the accommodation team creates it in the NTU booking system (StarRez).

What we collect and why. To handle your booking request we collect your name, e-mail address, NTU student or applicant ID, year group, whether you will be 18 or over when your contract starts, your room choices and anything you tell us about room needs. We use this to create your booking with NTU, to check which offers apply to you, and to contact you about your request. This is processing at your request before a contract (UK GDPR Article 6(1)(b)).

Saved bookings. If you save your place we keep a draft for 30 days so you can finish later, and e-mail you a link to it. We only send reminder e-mails if you tick the box asking for them (up to three over seven days); you can stop them from any e-mail. We only send news and offers if you tick the separate box for that.

Group bookings. If you book a flat with friends, you give us each friend’s first name and mobile number and confirm they know you are adding them and are happy to be contacted about it. UPP passes each friend’s first name and number to its customer system (HubSpot, EU region) so they can be sent one text or WhatsApp message with the link to your group page, saying who gave the number, with a “that’s not me” reply that removes them at once. Their number is never shown on the site. If a friend does not confirm within 30 days, their name and number are removed. We do this in our legitimate interest in letting students book a flat together (UK GDPR Article 6(1)(f)); a friend can object at any time by replying to the message or e-mailing the address in the footer. Once a friend confirms their own place, the rest of this notice applies to their own booking request.

Where your data goes. Your booking request is stored encrypted on servers in the UK and shared with the NTU accommodation team, who create your booking. If you agreed to reminders or news, your name, e-mail and booking stage are also kept in UPP’s customer system (HubSpot, EU region), as are the first name and mobile of each friend listed for a group booking (above). Room needs and notes are never sent there.

How long we keep it. Personal data on a submitted booking request is removed 30 days after submission, or 7 days after it is closed, and never later than 90 days; anonymous statistics are kept. Unsent drafts are removed 30 days after your last activity.

Your rights. You can ask us for a copy of your data, to correct it, or to delete it, by e-mailing the address in the footer and quoting your booking reference. You can complain to the Information Commissioner’s Office at ico.org.uk.