Last update 16 November 2020
Welcome to the UPP Group Holdings Limited’s Privacy Notice
Summary
UPP Group Holdings Limited (UPP) is committed to protecting your personal information. This Privacy Notice sets out what information we may collect from you when you visit our website, communicate with us and use our services. It tells you why and how we use this information and gives you details of your privacy rights.
We encourage you to read this notice and take a moment to read the website Terms and Conditions https://www.upp-ltd.com/terms-conditions/
We keep our data protection measures under constant review and from time to time we will update this notice so please refer back to this page. If we make any significant changes, we will endeavour to notify you.
We hope the headings below help you to find the information you are looking for.
- About this Privacy Notice
- About us
- How to contact us
- Personal information we collect about you
- How we collect your personal information
- How we use your personal information
- Our Lawful bases
- Our marketing
- Who we share your personal information with
- How we keep your personal information secure
- How long we keep your information for
- Your privacy rights
- Third Party Links
- Use of Cookies
About this Privacy Notice
This notice sets out how UPP uses and protects your personal information when you visit our website, provide information to us, make enquiries about our services and / or do business with us.
If you are accessing this site, or engaging with us, on behalf of your organisation, then this notice will also apply to any personal details you may provide to us, such as your name and your business contact details.
Where we refer to “UPP”, as appropriate this includes its subsidiaries and Parent organisations.
Alongside this notice and depending on the nature of our relationship with you we may provide you with additional privacy information.
Students – If you are a student at one of our halls of residence, you can access an appropriate privacy notice via the accommodation website of your University or your halls of residence.
Job applicants – If you are applying to UPP or any of its Subsidiary Group Companies for a job, please see our Applicant Privacy Notice https://uppgroup.sharepoint.com/:b:/t/humanresources/EcgRfLwkmRZDn8cWVWzI-goBl-K120FVAW-VvdgDTMtuiA?e=1sGe5R
Employees/contractors – We make sure relevant privacy notices are available to employees and contractors. please see our Employee, Worker and Contractor Privacy Notice here https://uppgroup.sharepoint.com/:b:/t/humanresources/ETq4PV9zw_xMr7C80M6qCNgBQ6MXRMDIinNUW3OUdqIBUg?e=JCScPI
Suppliers / customers – If you or your organisation are a supplier of UPP, or a customer of UPP, then the terms our contract with you will provide more detail about how UPP and its group companies will handle your personal information.
Our website and services are not generally intended for children. In some circumstances we will collect information relating to children, if this is a necessary part of our services to you. For example, in relation to our student accommodation services where limited number of students may be under 18.
About us
UPP Group Holdings Limited comprises different legal entities, details of which can be found https://uppgroup.sharepoint.com/:b:/t/Compliance/ExternallySharedDocuments/EWTWhmZwyqhMracSQp1_5v4B-jk6SS4c5OYw2eHaEMkZ0A?e=XoJ1mo
This notice is issued on behalf of UPP Group. When we mention refer to ‘we’, ‘us’ or ‘our’ we mean the relevant Company in the UPP Group responsible for holding and using your personal information. We will always make it clear to you which entity is responsible in your dealings with us. UPP Group Limited is responsible for this website, will deal with your enquiries and operates UPP’s social media accounts.
We will always endeavour to handle your personal information in accordance with applicable data protection legislation here in the UK.
How to contact us
If you have any questions about this privacy notice or any questions about how we collect, use and protect your personal details please contact our Compliance Team who will respond as quickly as possible to any query you may have.
Email: compliance@upp-ltd.com
Post: UPP, First Floor,12 Arthur Street, London, EC4R 9AB
Telephone: +(44) (0)207 398 7200
We keep our data protection practices under constant review and from time to time my update this notice. This version was last updated on 20 October 2020. We will endeavour to notify you by email or other means if any significant changes are made.
Personal information we collect about you
We will collect different types of personal information about you in several different ways depending on your relationship with us. To illustrate the types of information we collect we have grouped this together as follows:
- Identity Data – this includes information such as first name, last name, username, date of birth or information which uniquely identifies you such as a passport number, national insurance number or student number.
- Contact data – this includes information such as your email address, telephone number, social media profile (if you use this to get in touch with us) or billing address.
- Financial & transactional data – this includes bank account and payment card details, and information about payments to and from you.
- Marketing data – this includes your preferences in receiving marketing from us or any partners we work with.
- Technical data – this includes information we may collect when you access our website or interact with our social media accounts. Please see Use of Cookies for further information
- Client / supplier data – this includes personal information that you or your colleagues provide to us, or that we collect in connection with the service you supply to us. For example, business contact details and your business circumstances or history.
It is important the information we hold is accurate and current. Please let us know if your details change or you notice information we have need updating.
We also collect, use and share what we called Aggregate Data – this is statistical or demographic information which is used by us for a variety of purposes. We anonymise this so it does not identify you as an individual. For example, we may calculate a percentage of users accessing a specific website feature.
Some personal information is given special protection under data protection law, this includes details about your race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. Where it is necessary for us to collect such information, for example information about your health in providing student accommodation services, this will be clearly brought to your attention.
During the COVID-19 pandemic it has become necessary for us to handle health-related information relating to students, for example COVID-19 test results and self-isolating / quarantine status. We are handling this information in order to fulfil a duty of care we have to both students and our accommodation staff (e.g. building maintenance & cleaners). We have an obligation to handle this information under the Health and Safety at Work Act, combined with reasons of substantial public interest and under the Coronavirus Act 2020. We have taken robust measures to make sure this information is kept secure and have removed directly identifying details.
How we collect your personal information
We collect personal data about you in a number of different ways depending on the relationship we have with you, for example when you:
- Make enquiries about or apply for our products or services
- create an account on any of our web portal
- subscribe to our service or publications
- receive marketing from us
- communicate with us via social media
- enter a competition, promotion or survey or give us feedback or contact us
We will collect information from you when you directly provide this to us for example by filling informs or corresponding with us via the website, by post, by phone, by email, via our social media accounts or face to face.
We may also receive personal information about you from other organisations. For example,
- Public Relations advisors in our interaction with public authorities and government agents
- Your advisors or parties associated with you.
- Publicly available information from sources such as Companies House, the open electoral register and other websites.
- Universities where we provide accommodation and other services.
- Credit reference agencies and credit checking providers, as part of our new suppliers’ process, as well as criminal records checks and information from HM Revenue and Customs (HMRC).
- Information from social media sites such as LinkedIn, Facebook or Twitter, such as when you sent us a message, like or comment on our content.
- Information from our website analytics provider Google (based within the EU).
If we receive information about you from another organisation, and it is not already obvious to you that we are holding this, we will endeavour to let you know and tell you how we will use this information.
If you fail to provide personal information
If you do not wish to provide us with certain personal information that we are required to collect by law or under the terms of a contract we have you, we may not be able to deliver our services to you. We will explain this to you where relevant.
How we use your personal information
We use your personal data for the following activities:
- To deal with your enquiries, and to make contact with you, where you request information about our services.
- To perform a contract, we are about to enter into or have entered into with you or your organisation
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
- To agree and then provide our services to you under our contract with you or your organisation.
- To contact you where your details have been legitimately provided to us in relation to our services.
- To comply with our legal or regulatory obligations and to handle complaints or claims.
- To ensure that content from our site and the social media accounts that we operate is presented in the most effective manner for you and for your computer.
- To send you marketing communications
- To manage our business, including to notify you of changes to our services and to our Site.
Our Lawful bases
The table below shows in more detail the purposes for which we use your personal information, the type of data used and the lawful basis we rely upon for that purpose. Please also see Personal information we collect about you to see how we group different types of data)
In limited circumstances we rely on your consent, this will always be clearly brought to your attention when you give information to us. You have the right to withdraw your consent at any time.
If you work for an organisation which is considering entering into a contract with us, we will collect personal details about you (for example you name and business contact details). We may need to continue to hold this information for the duration of any contract if you are the person, we a liaising with. We process this information under our legitimate business interests.
If you would like more information about this or require any clarification, please contact us. There is also useful information about lawful bases guidance from the Information Commissioner’s Office:https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/
| Purpose/activity | Type of data | Lawful basis for processing including basis of legitimate interest |
| To deal with your enquiries, and to make contact with you, where you request information about our services. | Identity
Contact |
To take steps necessary to perform a contract with you, or to take steps at your request prior to entering into a contract with you.
Our legitimate interests:
|
| To agree and then provide our services to you under our contract with you or your organisation. | Identity
Contact Client / supplier |
To take steps necessary to perform a contract with you, or to take steps at your request prior to entering into a contract with you.
Our legitimate interests:
Legal obligations that require us: comply with any regulatory requirements such as Anti-Money Laundering checks. |
| To contact you where your details have been legitimately provided to us in relation to our services. | Contact | Our legitimate interests:
|
| To comply with our legal obligations and to handle complaints or claims. | Identity
Contact Client / supplier |
Our legitimate interests:
|
| To ensure that content from our Site and the social media accounts that we operate is presented in the most effective manner for you and for your computer. | Technical
Usage Marketing and communications |
Necessary for our legitimate interests:
|
| To send you our newsletter and other marketing material about our services or about issues that we think may interest you (by email, text message, social media, post or phone), and to measure the effectiveness of our marketing material. | Contact
Marketing and communications |
Consent (where this is necessary).
Necessary for our legitimate interests:
|
To manage our business, including our relationship with you, which will include:
|
Contact
Marketing and communications Client / supplier |
Performance of a contract with you.
Necessary to comply with a legal obligation under the Data Protection Act 2018 that requires us to provide you with fair processing information, and to keep our records of personal data up to date and accurate. Necessary for our legitimate interests:
|
| To administer and protect our business and our Site. | Identity
Contact Technical Usage |
Necessary for our legitimate interests:
|
| To use data analytics and to conduct statistical analysis and research. | Technical
Usage Marketing and communications Partner/Client /Supplier Contact |
Necessary for our legitimate interests:
|
| To sell our business, or part of it. | Client / supplier | Necessary for our legitimate interests: |
Our marketing
We hope you enjoy and value our newsletter and updates, and our marketing material generally. We respect your right to choose what marketing messages you receive. You can opt out of any marketing material we send you at any time by clicking the unsubscribe link in our emails, or by contacting us.
We may ask you to confirm or update your marketing preferences over time, such as when you instruct us to provide further services in the future, or if there are changes in the law or the regulation or structure of our business.
Who we share your personal information with
We may be required to disclose your personal data by law. For example, we may be required to disclose your personal information to law enforcement agencies, regulators, HMRC or as part of legal proceedings. We will only do so if required by law or if you have approved this disclosure.
In other circumstances, depending on your relationship with us we need to share personal data in order to fulfil our services.
Others we may share your information:
- Internal parties. This includes UPP Residential Services Limited (which is our main accommodation provider subsidiary) and any of our subsidiaries and parent companies which support our services or have a need to know in order to respond to your enquiries or to meet our commitments to you.
- External organisations in connection with our services – this includes:
-
- Where we are legally compelled to do so, by a court or tribunal, a regulatory authority, and law enforcement agencies.
- Other professional advisers acting on your behalf.
- Our professional advisers and our bank.
- Our University partners, suppliers and sub-contractors and providers of goods or services for the performance of any contract that we enter into with them to support our business. For example, our sub-contractors in technical, payment and delivery services, marketing and advertising service providers, analytics providers, and search and social media information and optimisation providers.
- Our insurers if we need to discuss your organisation’s request for services.
- In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets only for that purpose and subject to appropriate confidentiality agreements.
- If UPP or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
- To enforce or apply our Site’s Terms of Use or our standard terms and conditions of business or other agreements, or to protect the rights, property or safety of UPP, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
- In other circumstances we may share your personal data where you have given us your consent for us to do so
How we keep your personal information secure
UPP has a strong commitment to data security. UPP uses all reasonable endeavours to protect personal information from loss, misuse or alteration and we have put in place physical, electronic, and managerial procedures to safeguard and secure the information you provide to us online, or that we store about you. UPP takes appropriate steps to communicate and train its staff in relation to applicable data protection law.
Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site or via the social media accounts that we operate; any transmission is at your own risk.
If you would like to know more about our data security measures please contact us.
International Data transfers
Wherever possible, we will not transfer your data outside the European Economic Area (EEA). However, there are circumstances where this may be necessary. Where this is necessary, we make sure there are appropriate safeguards in place. For example,
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- We may use specific contractual clauses adopted by the European Commission
How long we keep your information for
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for. This includes satisfying any legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine how long we keep personal information, we consider applicable legal, contractual requirements and where these don’t apply, we carefully assess why it is necessary to keep personal information for legitimate business reasons.
If you would like more information about how long, we will keep your personal information for please contact us.
Your privacy rights
You have certain rights under data protection laws in relation to your personal data. These rights are aimed at giving you control over how your personal information is used by us. Please note they may be subject to specific requirements and some limitations.
- Request access to your personal data (known as a “data subject access request”). You can ask us to provide a copy of the personal data we may hold about you and the purposes for which we are using it.
- Request correction of your personal data. If you notice or believe the information, we hold for you is out of date or incorrect in any way, please let us know and we will rectify this as soon as possible.
- Request erasure of your personal data. You can ask for your personal data to be deleted or removed. We need to assess this on a case-by-case basis as there may be justifiable reasons as to why we need to keep hold of your personal data. If this is the case, we will explain the reason(s) in our response to you.
- Request restriction of processing your personal data. In certain circumstances you can ask us to suspend or limit our use of your personal data.
- Object to processing of your personal data. This allows you to ask us to stop using your personal information and it applies in certain circumstances. We may have a strong and legitimate reason to continue using your information. If this is the case, we will explain why in our response to you.
You always have the right to object to direct marketing from us. Please note this doesn’t necessarily mean we will delete all your details. We hold what’s called a marketing ‘suppression’ file. This means we can make sure we uphold your objection to direct marketing and don’t send you promotional material in the future.
- Request transfer of your personal data to you or to organisation. You can request that we send you a machine-readable copy of your personal information or request us to give this to another organisation. This right only applies when we are relying on your consent or when we have a contract with you.
- Right to withdraw consent at any time (provided we are relying on consent to process your personal data). However, this will not affect the lawfulness of any processing based on consent before withdrawal. This may impact our ability to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If you wish to exercise any of the rights set out above, please contact our Compliance Team:
Email address: compliance@upp-ltd.com
Postal address: UPP, 40 Gracechurch Street, London, EC3V 0BT
What we may need from you – We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to make sure we do not inadvertently send your personal information to another person. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond – We try to respond to all legitimate requests. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We will always endeavour to fully answer any queries you raise with us. If however you are not happy with our response and the manner in which you have handled your personal information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Third Party Links
On this website and within information we may post via our social media account there may be links to other organisation’s websites, plug-ins and applications. By clicking on those links or enabling those applications you may allow other organisations to collect personal information about you. We do not control other organisations’ websites and encourage you to read the privacy information they provide to you.
Use of cookies
Like most other websites, we use cookies and similar technologies. To find out more about this please see our Cookie Notice.