Last update 22 July 2021

Welcome to the UPP Group Holdings Limited’s Privacy Notice

Summary

UPP Group Holdings Limited (UPP) is committed to protecting your personal information. This Privacy Notice sets out what information we may collect from you when you visit our website, communicate with us, and use our services. It tells you why and how we use this information and gives you details of your privacy rights. 

We encourage you to read this notice and take a moment to read the website Terms and Conditions https://www.upp-ltd.com/terms-conditions/

We keep our data protection measures under constant review and from time to time we will update this notice so please refer back to this page. If we make any significant changes, we will endeavour to notify you. 

We hope the headings below help you to find the information you are looking for. 

About this Privacy Notice

This notice sets out how UPP uses and protects your personal information when you visit our website, provide information to us, make enquiries about our services and / or do business with us. 

If you are accessing this site, or engaging with us, on behalf of your organisation, then this notice will also apply to any personal details you may provide to us, such as your name and your business contact details. 

Where we refer to “UPP”, as appropriate this includes its subsidiaries and Parent organisation.

Alongside this notice and depending on the nature of our relationship with you we may provide you with additional privacy information.

Students – If you are a student at one of our halls of residence, you can access an appropriate privacy notice via the accommodation website of your University or your halls of residence. 

Job applicants – If you are applying to UPP or any of its Subsidiary Group Companies for a job, please see our Applicant Privacy Notice 

Employees/workers/contractors – We make sure relevant privacy notices are available to employees and contractors.  Please see our Employee, Worker and Contractor Privacy Notice

Suppliers / customers – If you or your organisation are a supplier of UPP, or a customer of UPP, then the terms of our contract with you will provide more detail about how UPP and its group companies will handle your personal information.

Our website and services are not generally intended for children. In some circumstances we will collect information relating to children if this is a necessary part of our services to you, for example, in relation to our student accommodation services where a limited number of students may be under 18.  

About us

UPP Group Holdings Limited comprises different legal entities, details of which can be found in Appendix 1

This notice is issued on behalf of UPP Group.  When we mention refer to ‘we’, ‘us’ or ‘our’ we mean the relevant Company in the UPP Group responsible for holding and using your personal information.  We will always make it clear to you which entity is responsible in your dealings with us. UPP Group Limited is responsible for this website, will deal with your enquiries and operates UPP’s social media accounts. 

We will always endeavour to handle your personal information in accordance with applicable data protection legislation here in the UK. 

How to contact us

If you have any questions about this privacy notice or any questions about how we collect, use, and protect your personal details please contact our Compliance Team who will respond as quickly as possible to any query you may have. 

UPP Compliance Team 

UPP Group Holdings Limited 

1st Floor
12 Arthur Street
London
EC4R 9AB   

Telephone: 0207 398 7200

Email: compliance@upp-ltd.com

Personal information we collect about you

We will collect different types of personal information about you in several different ways depending on your relationship with us. To illustrate the types of information we collect we have grouped this together as follows: 

  1. Identity Data – this includes information such as first name, last name, username, date of birth or information which uniquely identifies you such as a passport number, national insurance number or student number. 
  2. Contact data – this includes information such as your email address, telephone number, social media profile (if you use this to get in touch with us) or billing address. 
  3. Financial & transactional data – this includes bank account and payment card details, and information about payments to and from you. 
  4. Marketing data – this includes your preferences in receiving marketing from us or any partners we work with. 
  5. Technical data – this includes information we may collect when you access our website or interact with our social media accounts. Please see our Cookie Notice. 
  6. Client / supplier data – this includes personal information that you or your colleagues provide to us, or that we collect in connection with the service you supply to us. For example, business contact details and your business circumstances or history. 

It is important the information we hold is accurate and current. Please let us know if your details change or you notice information, we have needs updating. 

We also collect, use, and share what we called Aggregate Data – this is statistical or demographic information which is used by us for a variety of purposes.  We anonymise this so it does not identify you as an individual. For example, we may calculate a percentage of users accessing a specific website feature. 

Some personal information is given special protection under data protection law, this includes details about your race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.  Where it is necessary for us to collect such information, for example information about your health in providing student accommodation services, this will be clearly brought to your attention. 

During the COVID-19 pandemic, it has become necessary for us to handle health-related information relating to students, staff, and contractors. For example, test results, and self-isolation/quarantine status.  We are handling this information in order to fulfil our duty of care to students, our accommodation staff, and others.  We have an obligation to handle this information under the Health and Safety at Work Act, combined with reasons of substantial public interests under the Coronavirus Act 2020.  

How we collect your personal information 

We collect personal data about you in a number of different ways depending on the relationship we have with you, for example when you: 

  • make enquiries about or apply for our products or services 
  • create an account on any of our web portals
  • subscribe to our services or publications
  • receive marketing from us 
  • communicate with us via social media
  • enter a competition, promotion or survey or give us feedback or contact us

We will collect information from you when you directly provide this to us for example by completing forms or corresponding with us via the website, by post, by phone, by email, via our social media accounts or face to face. 

We may also receive personal information about you from other organisations. For example, 

  • Public Relations advisors in our interaction with public authorities and government agents 
  • Your advisors or parties associated with you. 
  • Publicly available information from sources such as Companies House, the open electoral register, and other websites.
  • Universities where we provide accommodation and other services. 
  • Credit reference agencies and credit checking providers, as part of our new suppliers’ process, as well as criminal records checks and information from HM Revenue and Customs (HMRC). 
  • Information from social media sites such as LinkedIn, Facebook, or Twitter, such as when you sent us a message, like or comment on our content. 
  • Information from our website analytics provider Google (based within the EU). 

If we receive information about you from another organisation, and it is not already obvious to you that we are holding this, we will endeavour to let you know and tell you how we will use this information. 

If you fail to provide personal information

If you do not wish to provide us with certain personal information that we are required to collect by law or under the terms of a contract we have you, we may not be able to deliver our services to you.  We will explain this to you where relevant. 

How we use your personal information 

We use your personal data for the following activities:

  • To deal with your enquiries, and to make contact with you, where you request information about our services.
  • To perform a contract, we are about to enter into or have entered into with you or your organisation
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests 
  • To agree and then provide our services to you under our contract with you or your organisation.
  • To contact you where your details have been legitimately provided to us in relation to our services.
  • To comply with our legal or regulatory obligations and to handle complaints or claims.
  • To ensure that content from our site and the social media accounts that we operate is presented in the most effective manner for you and for your computer.
  • To send you marketing communications 
  • To manage our business, including to notify you of changes to our services and to our Site.

Your privacy rights

You have certain rights under data protection laws in relation to your personal data. These rights are aimed at giving you control over how your personal information is used by us. Please note they may be subject to specific requirements and some limitations. 

  • Request access to your personal data (known as a “data subject access request”). You can ask us to provide a copy of the personal data we may hold about you and the purposes for which we are using it. 
  • Request correction of your personal data. If you notice or believe the information, we hold for you is out of date or incorrect in any way, please let us know and we will rectify this as soon as possible. 
  • Request erasure of your personal data. You can ask for your personal data to be deleted or removed. We need to assess this on a case-by-case basis as there may be justifiable reasons as to why we need to keep hold of your personal data. If this is the case, we will explain the reason(s) in our response to you. 
  • Request restriction of processing your personal data. In certain circumstances you can ask us to suspend or limit our use of your personal data. 

Object to processing of your personal data. This allows you to ask us to stop using your personal information and it applies in certain circumstances.  We may have a strong and legitimate reason to continue using your information. If this is the case, we will explain why in our response to you.  

Our Marketing

We hope you enjoy and value our newsletter and updates, and our marketing material generally. We respect your right to choose what marketing messages you receive. You can opt out of any marketing material we send you at any time by clicking the unsubscribe link in our emails, or by contacting us.

We may ask you to confirm or update your marketing preferences over time, such as when you instruct us to provide further services in the future, or if there are changes in the law or the regulation or structure of our business.

You always have the right to object to direct marketing from us.  Please note this doesn’t necessarily mean we will delete all your details. We hold what’s called a marketing ‘suppression’ file. This means we can make sure we uphold your objection to direct marketing and don’t send you promotional material in the future.   

Who we share your personal information with

We may be required to disclose your personal data by law. For example, we may be required to disclose your personal information to law enforcement agencies, regulators, HMRC or as part of legal proceedings. We will only do so if required by law or if you have approved this disclosure.  

In other circumstances, depending on your relationship with us we need to share personal data in order to fulfil our services. 

Others we may share your information: 

  • Internal parties. This includes UPP Residential Services Limited (which is our main accommodation operating subsidiary) and any of our subsidiaries and parent companies which support our services or have a need to know in order to respond to your enquiries or to meet our commitments to you.
  • External organisations in connection with our services – this includes:
  • Other professional advisers acting on your, or our behalf. 
  • Our University partners, where this is necessary to provide our services to them and to students. 
  • Our Suppliers and sub-contractors, where they are contracted by us to provide a service and handle personal information on our behalf.  For example, payment services, delivery services, analytics providers.
  • Our insurers if we need to discuss your organisation’s request for services.
  • In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets only for that purpose and subject to appropriate confidentiality agreements.
  • If UPP or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
  • To enforce or apply our Site’s Terms of Use or our standard terms and conditions of business or other agreements, or to protect the rights, property or safety of UPP, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
  • In other circumstances we may share your personal data where you have given us your consent for us to do so.

How we keep your personal information secure

UPP has a strong commitment to data security. UPP uses all reasonable endeavours to protect personal information from loss, misuse or alteration and we have put in place physical, electronic, and managerial procedures to safeguard and secure the information you provide to us online, or that we store about you. UPP takes appropriate steps to communicate and train its staff in relation to applicable data protection law. 

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site or via the social media accounts that we operate; any transmission is at your own risk. 

If you would like to know more about our data security measures please contact us.

In the main, personal information is stored on our servers or our suppliers’ servers in the UK. 

However, there are circumstances where it may be necessary for your personal data to be stored outside the UK.  Where this is the case, we will make sure this is subject to appropriate safeguards being in place as required by data protection law.

How long we keep your information for

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for. This includes satisfying any legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine how long we keep personal information, we consider applicable legal, contractual requirements and where these don’t apply, we carefully assess why it is necessary to keep personal information for legitimate business reasons.  

If you would like more information about how long, we will keep your personal information for please contact us. 

  • Request transfer of your personal data to you or to an organisation. You can request that we send you a machine-readable copy of your personal information or request us to give this to another organisation.  This right only applies when we are relying on your consent or when we have a contract with you.
  • Right to withdraw consent at any time (provided we are relying on consent to process your personal data). If you wish to exercise any of the rights set out above, please contact our Compliance Team:

UPP Compliance Team 

UPP Group Holdings Limited 

1st Floor

12 Arthur Street

London

EC4R 9AB   

Telephone: 0207 398 7200

Email: compliance@upp-ltd.com

What we may need from you – it may be necessary to request specific information from you to help us confirm your identity before fulfilling one of your privacy rights. We may also need to ask you to clarify your request. 

When you can expect to hear from us: We will acknowledge any request received as soon as possible. Routinely we will respond in full to requests within one calendar month.  In some circumstances where requests are complex, we may need to extend this.  if this is the case, we will notify you and keep you updated. 

We will always endeavour to fully answer any queries you raise with us. If, however, you are not happy with our response and the manner in which we have handled your personal information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Third Party Links

On this website and within information we may post via our social media account, there may be links to other organisation’s websites, plug-ins, and applications. By clicking on those links or enabling those applications you may allow other organisations to collect personal information about you.  We do not control other organisations’ websites and encourage you to read the privacy information they provide to you.  

Use of cookies

Like most other websites, we use cookies and similar technologies. To find out more about this please see our Cookie Notice.

Our Lawful bases

The table below shows in more detail the purposes for which we use your personal information, the type of data used and the lawful basis we rely upon for that purpose. Please also see the section above entitled ‘Personal Information we collect about you’ to see how we group different types of data.

In limited circumstances we rely on your consent, this will always be clearly brought to your attention when you give information to us.  You have the right to withdraw your consent at any time. 

If you work for an organisation which is considering entering into a contract with us, we will collect personal details about you (for example you name and business contact details).  We may need to continue to hold this information for the duration of any contract if you are the person, we are liaising with. We process this information under our legitimate business interests.  

Purpose/activity Type of data Lawful basis for processing including basis of legitimate interest

Students – Please note if you are a student at one of our halls of residence, you can access an appropriate privacy notice via the accommodation website of your University or your halls of residence.
To deal with your enquiries, and to make contact with you, where you request information about our services. Identity

Contact

 To take steps necessary to perform a contract with you, or to take steps at your request prior to entering into a contract with you.

  • To market or promote our services to you or your organisation where you have made a request for information or discussed our services with us.
  • To take steps at your request in relation to your organisation prior to entering into a contract. For example, booking an appointment.
  • To perform our contract with your organisation.
To agree and then provide our services to you under our contract with you or your organisation. Identity

Contact

Client / supplier

 To take steps necessary to perform a contract with you, or to take steps at your request prior to entering into a contract with you.

Our Lawful basis of Performance of a Contract.:

  • To take steps at your request in relation to your organisation prior to entering into a contract.
  • To performing our contract with your organisation.
  • To manage payments, and to collect and recover money owed to us.
  • To strengthen and protect our business, including our relationship with clients and suppliers.

Legitimate Interest that requires us:

comply with any regulatory requirements such as Anti-Money Laundering checks.
To contact you where your details have been legitimately provided to us in relation to our services. Contact Our legitimate interests:

  • To approach business leads that have legitimately been provided to us, for us to promote our business
To comply with our legal obligations and to handle complaints or claims. Identity

Contact

Client / supplier

 Our legal obligation:

  • To protect our business, including our relationship with customers and suppliers.
  • Necessary to comply with our legal obligations 
To ensure that content from our Site and the social media accounts that we operate is presented in the most effective manner for you and for your computer. Technical

Usage

Marketing and communications

 Necessary for our legitimate interests:

  • To present our Site and social media accounts appropriately to best promote our services.
  • To allow you to participate in interactive features of our service, when you choose to do so.
To send you our newsletter and other marketing material about our services or about issues that we think may interest you (by email, text message, social media, post, or phone), and to measure the effectiveness of our marketing material. Contact

Marketing and communications

 Consent (where this is necessary).

Necessary for our legitimate interests:

  • To strengthen our relationship with our customers and to develop our business and our marketing strategy.
To manage our business, including our relationship with you, which will include:

  1. Notifying you about changes to our terms or privacy policy.
  2. Asking you to update your details.
  3. Asking you to partake in a review, a prize draw, competition, or a complete survey.
 Contact

Marketing and communications

Client / supplier

 Performance of a contract with you.

Necessary to comply with a legal obligation under the Data Protection Act 2018 that requires us to provide you with fair processing information, and to keep our records of personal data up to date and accurate.

Necessary for our legitimate interests:

  • To maintain our customer relationships.
  • To keep our records updated.
  • To study how customers, use our site and services.
  • To improve our site and service to you and make your visits to our site more rewarding
To administer and protect our business and our Site. Identity

Contact

Technical

Usage

 Necessary for our legitimate interests:

  • To run our business efficiently, including by appointing appropriate suppliers that support our services.
  • To manage our IT systems, including by allowing us and our suppliers to manage network security, troubleshoot, conduct testing, perform system maintenance, provide support, and generate reporting.
  • To keep our business secure and safe.
  • To prevent fraud and dishonest behaviour.
To use data analytics and to conduct statistical analysis and research. Technical

Usage

Marketing and communications

Partner/Client /Supplier 

Contact

 Necessary for our legitimate interests:

  • To analyse our current or prospective partner, clients/suppliers and social media usage, and services, for business planning.
  • To keep our site updated and relevant.
  • To develop our business and to inform our marketing strategy.
To sell our business, or part of it. Client / supplier Necessary for our legitimate interests:

 

Appendix 1

List of all UPP Companies:

UPP Group Holdings Limited

James Square Plymouth Limited 

UPP Loring Hall Limited

UPP (East Park) LLP

UPP (Exeter 2) LLP 

UPP Projects Limited

UPP Residential Services Limited 

UPP (Alcuin) Limited

UPP (Duncan House) Limited

UPP (Lancaster) Limited 

UPP (Hull) Limited

Leeds Student Residences Limited 

UPP Leeds Student Residences Limited

UPP (Nottingham) Limited

UPP (Byron House) Limited 

UPP (Clifton) Limited

UPP (Broadgate Park) Limited

UPP (Loughborough Student Accommodation) Limited 

UPP (Exeter) Limited

UPP (Plymouth 3) Limited

UPP (SAC2) Limited

UPP (Swansea) 1C Limited 

UPP (Swansea 2) LLP 

UPP (Reading I) Limited 

UPP (Reading) Limited

UPP (Reading St George’s) Limited

UPP (Kent Student Accommodation) Limited 

UPP (Kent Student Accommodation II) Limited 

UPP (Kent Turing) Limited

UPP (Cartwright Gardens) Limited 

UPP (Oxford Brookes) Limited