Privacy Policy

Version 8 – Last updated: Nov 20, 2025

1. Policy overview

1.1 Uliving@Hertfordshire PLC (‘Uliving’) is committed to compliance with data protection legislation which include the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, or any other legislation supplementing and enacting the UK GDPR within the UK. Such legislation is based on specific principles, rights, and responsibilities which govern the management and processing of personal data by organisations. Uliving recognises those principles, rights, and responsibilities. This document sets out our privacy policy in accordance with the above mentioned legislation. Uliving is the data controller for the purposes of this privacy policy and this privacy policy acts as the company’s privacy notice under UK GDPR.

2. Definitions

2.1 For the purposes of this document, the following definitions will apply:

2.1.1 ‘Personal data’:

The UK GDPR defines personal data as any information relating to a data subject (Article 4(1) UK GDPR). This information will relate to a living, identifiable individual and can be held in a form in which it can be processed automatically, either on computer systems or structured manual filing systems. Statements of fact or expression of opinion about an individual data subject are also personal data, as is an indication of a data controller’s intentions towards a data subject. The definition also includes data held visually in photographs or video clips (including closed circuit television) or audibly, on sound recordings. The UK GDPR identifies special categories of personal data (“Sensitive personal data”) for which processing is prohibited – these are data which reveal: racial or ethnic origin; political opinions; religious and philosophical beliefs; trade union membership; genetic data; biometric data (for the purpose of uniquely identifying a natural person, e.g. fingerprints); data concerning health; and sex life and sexual orientation (Article 9(1) UK GDPR). Processing this data is only permitted in the limited circumstances set out in Article 9 UK GDPR. Sensitive personal data does not include personal data relating to criminal offences and convictions, as there are separate and specific safeguards for this type of data contained in Article 10 of the UK GDPR.

2.1.2 ‘Data subject’:

A data subject is the identified or identifiable person to whom personal data relates. A person is identifiable if they can be identified, by all reasonably available means, directly or indirectly, in particular by reference to an identifier, such as a name, identification number, location data, an online identifier or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person (Article 4(1) UK GDPR). This may also include where the data subject is identifiable because of the context of the information.

2.1.3 ‘Data processing’:

In effect, this means any activity involving personal data. It is very broadly defined by the UK GDPR (Article 4(2) UK GDPR) as carrying out any operation or set of operations on data, including collection; recording; organisation; structuring; storage; adaptation or alteration; retrieval; consultation; use; disclosure by transmission; dissemination or otherwise making available; alignment or combination; restriction (i.e. marking stored data to prevent future processing); erasure; or destruction.

2.1.4 ‘Data controller’:

The person(s) who determine(s) the purposes for, and the manner for, the processing of any personal data which, for the purposes of this document, is Uliving and/or the relevant subsidiary company (Uliving and a subsidiary company may be joint data controllers) but could also be a third-party organisation. Most obligations under the UK GDPR fall on the data controller, who may act alone or jointly with others.

2.1.5 ‘Data processor’:

A natural (individual) or legal (corporate) person, public authority, agency, or other body which processes personal data on behalf of a data controller (Article 4(8) UK GDPR). The UK GDPR imposes specific and separate duties and obligations on data processors. Uliving is a data controller and may also be a data processor. Uliving is contracted with the University of Hertfordshire, Places 4 People Living+ Limited and Derwent Facilities Management Limited with respect to the provision of accommodation services at College Lane, University of Hertfordshire and on occasion each of these organizations may act as a data controller or process with personal data necessary to provide the accommodation service to residents.

2.1.6 ‘Data user’:

An authorised user of personal data held by Uliving, as data controller or data processor (for example, a member of staff of Uliving or a subsidiary company, or a resident at College Lane).

2.1.7 ‘Consent’

Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

3. Responsibilities

3.1 Data Protection Officer

Where data processing is carried out by a body corporate, that body is required by the UK GDPR to designate a data protection officer (“DPO”) where there is systematic monitoring on a large scale (such as Close Circuit Television (‘CCTV@)). Uliving has appointed a DPO for Uliving and its group of companies. It is the job of the DPO to advise Uliving and its subsidiary companies on compliance with data protection legislation. The Data Protection Officer for Uliving may be contacted by email: bookings@ulivingherts.co.uk or by post to our registered office at: 105 Piccadilly, London, W1J 7NJ marked for the attention of the Company Secretary.

3.2 Data users

All members of staff or seconded staff of Uliving and its subsidiary companies must always comply with regulations and procedures set out in this document.

4. Legal basis for processing (Privacy Statement)

4.1 General

Personal Data may only be processed in the following circumstances, pursuant to Article 6(1) of the UK GDPR:

With the Data Subject’s explicit and informed consent – An individual has given clear and informed consent to the processing of their Personal Data for a specific, identified purpose. Such consent requires a positive opt-in, by a clear and affirmative act, and the individuals involved must have a genuine choice and be able to opt out at any time. Consent may only be relied upon where there is no other lawful basis for processing personal data. For the purposes of The Privacy and Electronic Communications (EC Directive) Regulations 2003, such as now is part of domestic law, consent is required for all electronic marketing. [Article 6(1)(a) UK GDPR]

Where it is necessary for the performance of a contract – Processing of the personal data is permitted either (a) in order to allow the performance of a contract to which the data subject is a party; or (b) in order to take steps, at the request of the data subject, prior to entering into a contract. [Article 6(1)(b) UK GDPR]

Where there is a legal obligation to process Personal Data – Processing of the personal data is necessary in order that the data controller (this is likely to be Uliving or one of its subsidiary companies) may comply with a legal obligation, [Article 6(1)(c) UK GDPR].

Where processing is necessary to meet the legitimate interests of the data controller – Processing of personal data may be in Uliving’s, a subsidiary company’s or a third party’s legitimate interests in circumstances where: (a) Uliving/company has balanced its interests or the interests of a third party with the interests and rights of the data subject; (b) it has properly documented that balancing exercise; (c) it has informed the data subject that it is processing the personal data on that basis (by providing the data subject with a copy of this policy); and (d) the data subject has the right to object to that processing. Broadly speaking, this basis for processing is appropriate in circumstances where Uliving or subsidiary company wishes to prevent fraud or ensure the security of a network. The interests of the data subject must not override those of Uliving or subsidiary company, and the data subject must have a reasonable expectation that processing would take place for the specific purpose.

Sensitive personal data (or “special category” personal data) is subject to much stronger controls and may only be processed where one or more of the following circumstances applies, pursuant to Article 9(2) of the UK GDPR:

Explicit consent – The data subject has given their explicit consent to the processing of the sensitive personal data, except where this is prohibited by domestic law. [Article 9(2)(a) UK GDPR]

Where the processing is in the vital interests of the data subject – Processing of the sensitive personal data is necessary in order to protect the vital interests of the data subject or another natural person and they are physically or legally incapable of giving consent (e.g. in a medical emergency where Uliving is asked to hand over a data subject’s personal data by a doctor or hospital, and they are unable to give consent for themselves). [Article 9(2)(c) UK GDPR]

Public information – The data subject has taken deliberate steps to make the relevant sensitive personal data public. [Article 9(2)(e) UK GDPR]

Legal claims – The processing of sensitive personal data is necessary to establish, exercise or defend legal claims or whenever courts are acting in their judicial capacity. [Article 9(2)(f) UK GDPR]

Substantial public interest – Processing of the sensitive personal data is necessary for reasons of substantial public interest on the basis of domestic law (where such processing is proportionate, respects the essence of the right to data protection and provides suitable safeguards for the data subject’s rights). [Article 9(2)(g) UK GDPR]

In accordance with the above, Uliving may seek explicit consent for the processing of sensitive personal data (or criminal offence data), unless an alternative legal basis applies.

This policy sets out the legal bases on which Uliving (and, where appropriate, its subsidiary companies) processes personal data. It should be brought to the attention of any individuals whose personal data may be processed by Uliving or its group companies because of their involvement or connection with Uliving and those companies. The processing of such personal data may arise in any number of circumstances including, by way of examples only, where a person is accessing information about services or using a College Lane accommodation facility; where they have signed up to attend an event at Uliving or to receive information about Uliving events and services; or where that person is a prospective student/resident.

For convenience, this policy has broken down the specific bases for processing personal data into the categories of data subject, as set out below:

• Applicants;
• Residents;
• Other categories (members of the public, etc.).

No personal data will be kept for longer than is necessary for achieving the purpose for which it was obtained. Uliving’s retention policy is to retain data for successful applicants for a maximum of six years from the commencement of residential living at College Lane, for the legitimate purpose of managing your accommodation whilst at College Lane. Uliving does not market to undergraduate first years, and the retention policy is the estimated maximum duration of a full-time course.

In the event that an application is not successful, Uliving retains the applicant’s personal data for a limited period in order to address any queries, administrative requirements, arising from the application process. All personal data relating to unsuccessful applicants is securely disposed of within twelve months of the application date. Following this period, the data is permanently deleted and is not used for marketing or for any purpose unrelated to the original application.

Personal data is may be required by law in certain circumstance and this is stated in Section 4.

Uliving does not operate automatic data subject profiling or decision making.

Personal data will only be shared with internal and external parties where necessary. Information regarding the purpose of processing, lawful basis, and any sharing of personal data can be found in the table below. Personal data my may be provided direct from potential and current residents and/or by the University of Hertfordshire, Places for People Living+ Limited, Derwent Facilities Management Limited to assist in the provision of accommodation services at College Lane.

5. Sharing and processing personal data outside the UK

There are certain limited circumstances in which we may share personal data with third parties outside the UK, which may include:

i. where a third-party service provider uses servers outside the UK;
ii. where we work with foreign recruitment agent’s outside the UK; and

In such circumstances, any transfer of personal data outside the UK will be subject to appropriate safeguards such as contractual arrangements which comply with UK GDPR provisions regarding such transfers in line with ICO guidance . For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

6. Data protection rights

Subject to certain conditions which facilitate the services we provide, you have the following rights in relation to your personal data:

The right of access:

You have the right to:

1. Disclosure:
You may request a copy of the information that we hold about you. If you would like a copy of some or all your personal information free of charge*, please contact us at the below email address: bookings@ulivingherts.co.uk if you wish to exercise this or any other right.

This information will be provided within one month. For complex cases we retain the right to extend the time limit, but we will write to you first about this. We reserve the right to refuse to provide information for any manifestly unfounded requests (including multiple/duplicate requests) or charge a fee for complex cases.

2. Rectification:
We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

3. Withdraw consent:
You may choose to withdraw your consent to be sent marketing materials.

4. To be forgotten/erasure:
You may also choose to withdraw your consent for us to hold your information at any time, where relevant subject to legitimate data retention requirements (i.e. statute or legitimate reason).

5. Restriction:
This is a right for an individual to require a controller to restrict processing of personal information about them on certain grounds;

6. Object:
This is a right for an individual to object, on grounds relating to their situation, to a controller’s processing of personal data about them, if certain grounds apply;

7. Data portability:
This is a right for an individual to receive personal information concerning them from a controller in a structured, commonly used, and machine-readable format and to transmit that information to another controller, if certain grounds apply.
If you wish to make the Data Subject Access Request, please email bookings@ulivingherts.co.uk.
You will be asked to complete the Subject Access Request form and verify your identity as appropriate.

7. Data storage
All personal data is stored in a secure cloud environment and IT systems with accredited contractors holding cyber essentials certification. These suppliers do not process personal data.

8. Queries and Complaints
The data controller for your personal data is Uliving@Hertfordshire PLC, and we can be contacted via bookings@ulivingherts.co.uk or by post at our registered office 105 Piccadilly, London, W1J 7NJ marked for the attention of the Company Secretary.

Please contact us at bookings@ulivingherts.co.uk. If you have any concerns or questions about the above information or wish to ask us not to process your personal data for purposes, please let us know. If you have specific requests relating to how we manage your data, we will endeavor to resolve these, but please note that there may be circumstances where we cannot comply with specific requests.

If you are not happy with the way your personal data is being handled, or with the way Uliving has handled your queries, you have the right to lodge a complaint with the ICO at ico.org.uk. Their full contact details are shown below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint