Student Shac Privacy Policy / Fair Processing Notice

Originally created: April 2018   |   Last reviewed: July 2026

This notice explains what information we collect, when we collect it and how we use it. During the course of our activities we process personal data (which may be held on paper, electronically, or otherwise) about you, and we recognise the need to treat it in an appropriate and lawful manner. The purpose of this notice is to make you aware of how we handle your information.

Who we are

Student Shac Limited, of 15–17 Lawn Avenue, Stourbridge, DY8 3UR, takes the issue of security and data protection very seriously and strictly adheres to the guidelines published in UK GDPR and the Data Protection Act 2018 (which incorporate the principles of the General Data Protection Regulation (EU) 2016/679, applicable in the UK from 25 May 2018), together with any domestic laws subsequently enacted.

We are notified as a Data Controller with the Information Commissioner's Office under registration number ZA148376, and we are the data controller of any personal data that you provide to us.

Our Data Protection Officer is Peter Rees, contactable at let@studentshac.co.uk.

Any questions relating to this notice and our privacy practices should be sent to let@studentshac.co.uk.

How we collect information about you

• From your application for accommodation.

• From Student Shac forms completed by hand and via Signable, our tenancy e-signing service (including but not limited to tenancy agreements, guarantor agreements, or notices).

What information we collect

• Tenant name, email address, telephone number, date of birth, address (including any previous addresses), marital status, nationality, next of kin, name of university or college where you are studying (if applicable), the name of friends you are staying with (if applicable).

• Guarantor name, email address, telephone number, date of birth, address (including any previous addresses), marital status, nationality, National Insurance number, next of kin (if applicable), and proof of ID.

• Property address; term, rent, deposit, utility and service responsibilities.

• The employment status of tenants and/or guarantors, address, contact details (including email and phone numbers) and length of employment.

• Bank account details of the tenant are only required if we need to credit the tenant's account for any reason, e.g. the tenant has overpaid rent.

• Where a tenant requests permission to keep a pet under section 16A of the Housing Act 1988 (as inserted by the Renters' Rights Act 2025), we collect details of the pet and the request in order to consider and record our response.

Why we need this information and how it will be used

• To undertake and perform our obligations and duties to you under the terms of our contract with you.

• To enable us to supply you with the services and information you have requested.

• To help you manage your tenancy.

• To carry out due diligence on any prospective tenant, including whether there are any money judgments against them or any history of bankruptcy or insolvency.

• To analyse the information we collect so that we can administer, support, improve and develop our business and the services we offer.

• To contact you about any changes to our services or suppliers which may affect you.

• To consider and respond to pet requests, and to record landlord consent decisions in line with the Renters' Rights Act 2025.

• For all other purposes consistent with the proper performance of our operations and business.

Online providers and processors we work with

We work with Signable to sign tenancy and guarantor documents. Their privacy policy can be viewed at signable.co.uk/gdpr. Signable takes security seriously and is GDPR compliant. All documents can also be posted or signed in person if necessary.

We use Google Drive (with two-factor authentication for each team member) to store tenancy, compliance and maintenance records, and Google Calendar to track certificate and licence expiry dates and set renewal reminders.

We use Fireflies.ai to record and transcribe notes from property maintenance and site-visit calls, which are then filed securely in Google Drive. Fireflies.ai is a US-based service; where your information is processed outside the UK/EEA as a result, we ensure appropriate safeguards are in place (see 'Transfers outside the UK and Europe' below).

We no longer work with COHO. If you previously had access to a COHO tenant portal, that access and any associated data processing has ended; house documents such as gas, electrical and PAT certificates are now stored and shared via Google Drive.

Sharing of your information

The information you provide to us will be treated as confidential and will be processed only by third parties acting on our behalf, within the UK/EEA, unless stated otherwise below. We may disclose your information to other third parties who act for us for the purposes set out in this notice, or for purposes you have approved, including:

• If we enter into a joint venture with, or merge with, a business entity, your information may be disclosed to our new business partners or owners.

• To carry out due diligence on you as a prospective tenant/guarantor, including affordability checks, due diligence checks, and obtaining references from relevant parties whose data you have provided.

• If you request it, your information may be disclosed to determine whether there are any money judgments against you, or any history of bankruptcy or insolvency.

• If you are unable to make payments under your tenancy, your information may be disclosed to any relevant party assisting in debt recovery or tracing you as a tenant.

• In the creation, renewal or termination of a tenancy, your information will be disclosed to the relevant local authority, tenancy deposit scheme administrator, service/utility provider, freeholder, factor, facilities manager, or other relevant person or organisation.

Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.

Transfers outside the UK and Europe

Your information is principally stored within the UK and EEA. We may transfer your information outside the UK and/or EEA where a service provider we use is based outside these areas (for example, Fireflies.ai). Where this occurs, we ensure adequate safeguards are in place to protect your information in accordance with this notice, including reliance on adequacy decisions or appropriate contractual safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

Security and how long we keep your information

When you give us information we take steps to make sure it is kept secure and safe. Records held in Google Drive are protected by two-factor authentication for every team member with access. All information not required for regulatory, legal or accounting purposes is destroyed securely when the tenancy ends. Information we are required to keep for legal reasons is stored securely and destroyed once we are no longer obliged to keep it.

We review our data retention periods regularly and only hold personal data for as long as is necessary for the relevant activity, or as required by law or contract.

Renters' Rights Act 2025

From 1 May 2026, the Renters' Rights Act 2025 introduced new rights for tenants, including the right to request permission to keep a pet, with landlord consent not to be unreasonably refused. Where you make such a request, we will collect and hold details of the request and our response as part of your tenancy record, retained for the same period as your tenancy agreement. The Act also introduces new written information requirements for tenancies; these are addressed in your tenancy documentation rather than in this notice.

Your rights

• Ask for a copy of the information about you held by us in our records.

• Require us to correct any inaccuracies in your information.

• Request that we delete the personal data we hold about you.

• Object to receiving any marketing communications from us.

If you would like to exercise any of these rights, please contact us at let@studentshac.co.uk.

Should you wish to complain about the use of your information, we would ask that you contact us first at let@studentshac.co.uk to resolve the matter. You also have the right to complain to the Information Commissioner's Office concerning our use of your information. Their contact details are: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113.

The accuracy of your information is important to us — please help us keep our records updated by informing us of any changes to your email address and other contact details.