1. Who We Are

Student Bubble Ltd ("Student Bubble", "we", "us", or "our") is the data controller responsible for personal data collected through our website, application, and related services (the "Platform").

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable privacy legislation.

If you have any questions about this Privacy Policy or how we handle your data, please contact our Data Protection Officer:

Email: dpo@studentbubble.co.uk General privacy enquiries: privacy@studentbubble.co.uk

2. Personal Data We Collect

We collect and process the following categories of personal data:

Account and identity data Name, email address, date of birth, phone number, and university or employer affiliation. Authentication is handled by our provider Clerk. Where you sign up via a third-party provider (e.g. Google, Microsoft), we receive the data you authorise that provider to share.

Rental Passport data Student number or staff ID, academic year and course, references, identity documents (such as passport or driving licence), right-to-rent documents, rental history, and accommodation preferences. We collect identity documents so that your identity can be verified and, where you choose to apply, so that documents can be passed to the landlord or letting agent who carries out their own statutory right-to-rent check. You control which sections of your Rental Passport are shared and with whom.

Applications, viewings and tenancy data When you apply for a property, request a viewing, or receive a tenancy offer, we process the information you submit (including your application message, household details where you apply as a group, preferred viewing dates, move-in dates, and any Rental Passport information you choose to attach), together with the status and outcome of that application, viewing or offer. Where you use the Tenancy Hub, we process tenancy details (such as deposit scheme reference, tenancy dates, and maintenance requests).

Flatmate and room listing data If you opt in to the Flatmate Pool or post a room listing, we process the profile and listing information you provide, including your first name, university affiliation, preferences, room and address details, and any contact details you choose to add. You can opt out at any time.

Landlord feedback data Where a landlord or letting agent who has had a tenancy relationship with you submits feedback about you as a tenant, we process that feedback, which may include ratings, a "would rent again" indicator, and free-text comments. See Section 4 for the lawful basis, your rights, and our retention rule for this data.

Property and listing data If you are a landlord or letting agent: company name, registered address, company and letting-agent registration numbers, contact details, property details and photographs, and compliance documents (such as EPC, gas safety and HMO information).

Usage and technical data IP address, browser type and version, device identifiers, pages visited, search queries, filter selections, and session duration, collected via server logs and cookies.

Communications data Messages sent through our in-platform messaging system, support tickets, and email correspondence with us.

Newsletter and marketing data If you subscribe to our newsletter or marketing communications, we process your email address and your consent record (including when you subscribed and any later opt-out).

Landlord and letting-agent contact data (collected indirectly) When a student asks us to request a tenant reference from their current or former landlord or letting agent, the student gives us that landlord's or agent's name (optional), email address, and the property address so that we can send the reference request. Where the landlord or agent is a business (a company or letting agent) and is not already a Student Bubble user, we may also retain those business contact details as a prospective business contact, so that we can tell them about services relevant to landlords and agents. We do not retain the contact details of private-individual landlords as a business or marketing lead.

Letting-agency manager contact data (supplied by you about your tenancy) If you have a live tenancy, you may save the contact details of the letting-agency manager who acts for that tenancy: their name, work email, the agency or branch they act for, and, optionally, their agency registration number. You provide these details and confirm that the person manages your tenancy. We store them so that you can keep your tenancy manager to hand and, in future, contact them on your behalf about your tenancy. A Student Bubble administrator may verify the details before they are confirmed. See Section 4 for the lawful basis, the manager's rights, and our retention rule for this data.

We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@studentbubble.co.uk and we will delete it promptly.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Platform: creating and managing your account, enabling property search, facilitating Rental Passport creation and sharing, and connecting students with landlords. • Identity verification: holding Rental Passport documents submitted by you to verify your identity and eligibility. • Communications: sending transactional emails (account confirmation, password resets, invite links), Platform notifications, and, where you have consented, marketing updates. • Safety and trust: reviewing listings, investigating reports of misconduct, and preventing fraud, spam, and other prohibited activity. • Legal compliance: meeting our obligations under UK law, including anti-money laundering checks, right-to-rent verification requirements, and responding to lawful requests from authorities. • Analytics and improvement: understanding how users interact with the Platform so we can improve features and fix issues. Analytics data is aggregated and anonymised where possible. • Tenant feedback: enabling landlords and letting agents who have had a tenancy relationship with a tenant to provide feedback, to support trust and informed decision-making between users (see Section 4). • Fees and invoicing: we do not currently process payments through the Platform. Where fees apply, these are handled by invoice.

4. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases:

Contract performance (Article 6(1)(b)): processing necessary to provide you with the service you have requested, such as creating your account, enabling property listings, and facilitating Rental Passport sharing.

Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate interests, including preventing fraud, improving the Platform, and communicating service updates. We balance our interests against your rights and will not process your data in this way where your interests override ours.

Legal obligation (Article 6(1)(c)): processing necessary to comply with our legal obligations, for example in response to a court order or to meet anti-money laundering requirements.

Consent (Article 6(1)(a)): where you have given your explicit consent, such as for marketing emails or for sharing your Rental Passport with a specific landlord. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Special category data (Article 9(2)(a) or (g)): where identity documents reveal special category information (such as nationality), we process this on the basis of your explicit consent or where processing is necessary for substantial public interest reasons in connection with right-to-rent checks.

Landlord feedback about tenants Where a landlord or letting agent who has had a tenancy relationship with you submits feedback about you as a tenant (ratings, a "would rent again" indicator, and optional comments), we process that feedback on the basis of our legitimate interests (Article 6(1)(f)). Our legitimate interest is to support trust, safety, and informed decision-making between users of the Platform. We have carried out a legitimate interests assessment balancing this interest against your rights and freedoms. Because you do not provide this data yourself, this Policy is how we notify you that the data is being processed, in line with Article 14 of the UK GDPR.

You can object to this processing at any time under Article 21, and you can ask us to correct or erase feedback about you. You also have the right to request restriction of processing while any objection or accuracy complaint is investigated. Feedback comments are subject to moderation, and feedback is not used to rank or rate you automatically.

Retention of landlord feedback We retain landlord feedback in an identifiable form for 16 months from the date it is submitted. After that period, we anonymise it irreversibly so that it can no longer be linked to you, retaining only aggregate, non-identifying information. If you ask us to erase feedback sooner, we will do so unless we have an overriding legal reason to keep it. To exercise any of these rights, contact us at privacy@studentbubble.co.uk.

Landlord and letting-agent contact details Where a student requests a reference, we process the landlord's or letting agent's contact details to deliver that student-requested reference. We rely on the performance of the service you have asked for and our legitimate interests (Article 6(1)(b) and 6(1)(f) of the UK GDPR). The landlord or agent does not provide these details to us directly — we receive them from the student — so this Policy is how we notify them of the processing, in line with Article 14 of the UK GDPR.

Separately, where the landlord or agent is a business or letting agent, we may keep their business contact details as a prospective business contact, so that we can let them know about Student Bubble services relevant to landlords and agents. We rely on our legitimate interests (Article 6(1)(f)) in growing the supply side of our marketplace through relevant business introductions, and we have carried out a legitimate interests assessment balancing this against the rights of the contact. We do not keep private-individual landlords' details for this purpose. Any marketing we send is to business contacts (or to people who have asked to hear from us), always includes an easy way to opt out, and is subject to the Privacy and Electronic Communications Regulations 2003.

Landlords and letting agents can object to this processing at any time under Article 21, ask us to correct or erase their details, or opt out of any marketing, by contacting us at privacy@studentbubble.co.uk.

Letting-agency manager contact details on the Tenancy Hub Where you have a live tenancy, you can save the contact details of the letting-agency manager who acts for that tenancy — their name, work email, the agency or branch they act for, and, if you wish, their agency registration number. You supply these details yourself, and you confirm at the point of entry that this person manages your tenancy and that you are happy for us to store them (see Section 6.1 of our consent record for the exact wording shown to you). We hold these details so that you can keep your tenancy manager to hand and, in future, ask us to contact that manager on your behalf about your tenancy. We rely on the performance of the service you have asked for and our legitimate interests (Article 6(1)(b) and 6(1)(f) of the UK GDPR), and we record your consent as proof that you provided the details and authorised us to hold them. We will not use these details to market to your agent.

Because the manager does not provide these details to us directly — we receive them from you, the student — this Policy is how we notify the manager of the processing, in line with Article 14 of the UK GDPR. Before a saved contact is treated as confirmed, a Student Bubble administrator may check it. We hold an unconfirmed contact for no more than 30 days and then delete it; if a contact is rejected at the verification stage we delete it promptly; and a confirmed contact is held for the life of your tenancy and deleted when the tenancy record is deleted or on a valid erasure request.

The letting-agency manager can object to this processing at any time under Article 21, and can ask us to correct or erase their details, by contacting us at privacy@studentbubble.co.uk.

5. Who We Share Your Data With

We share your personal data only as described below:

Landlords and letting agents: when you expressly choose to share your Rental Passport with a specific Provider, we disclose the agreed profile information. We do not share your full contact details until both parties have mutually agreed to proceed.

Other users (Flatmate Pool): anonymised profile information (first name, passport score, university affiliation, and preferences) is visible to other verified users. Full details are shared only on mutual agreement.

Service providers: we engage trusted third-party processors to support the Platform, including: • Clerk (authentication) • Cloud hosting, storage, and infrastructure providers • Email delivery services

All processors are bound by data processing agreements and may not use your data for their own purposes.

Legal and regulatory authorities: we may disclose data where required by law, regulation, court order, or to protect the safety of users or third parties.

Business transfers: if Student Bubble is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We do not sell your personal data to third parties.

6. Future Data Partnerships

We may in future work with financial data partners to help tenants build their credit history through verified rent payments. We will update this Policy and notify you before any such sharing begins, and where the law requires your consent we will ask for it first.

7. International Data Transfers

Where we transfer your personal data outside the United Kingdom, we ensure that an appropriate safeguard is in place, such as the UK's International Data Transfer Agreement (IDTA), adequacy regulations, or standard contractual clauses approved by the Information Commissioner's Office (ICO).

Our primary data processing infrastructure is located within the UK and EEA. Where sub-processors operate outside these regions, we carry out transfer impact assessments and implement appropriate protections.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law.

Account data is retained for the duration of your account and for up to 3 years after closure, to enable us to resolve disputes, enforce our agreements, and comply with legal obligations.

Rental Passport documents (identity documents, references) are deleted 16 months after you close your account, unless a longer retention period is required by law.

Property listing data is retained for 6 years after a tenancy ends, in line with the Limitation Act 1980.

Landlord and letting-agent business contact data is deleted 12 months after we collect it, unless the contact becomes a Student Bubble user or asks to hear from us. Contact details used solely to send a student-requested reference are governed by the reference-request retention rule.

Letting-agency manager contact details that you save against a tenancy are kept for no more than 30 days while unconfirmed, deleted promptly if rejected at verification, and otherwise kept for the life of that tenancy and deleted when the tenancy record is deleted or on a valid erasure request.

Anonymised usage and analytics data may be retained indefinitely as it can no longer identify you.

When data is no longer needed, it is securely deleted or anonymised.

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access: you may request a copy of the personal data we hold about you (a Subject Access Request).

Right to rectification: you may ask us to correct inaccurate or incomplete data.

Right to erasure ("right to be forgotten"): you may ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

Right to restrict processing: you may ask us to pause processing of your data while a complaint is being investigated.

Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.

Right to object: you may object to processing based on legitimate interests or direct marketing at any time.

Rights in relation to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces significant legal effects, unless you have given explicit consent or it is necessary for a contract.

To exercise any of these rights, please contact us at privacy@studentbubble.co.uk. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or to seek a judicial remedy.

10. Cookies and Tracking

We use cookies and similar technologies to operate the Platform, remember your preferences, and understand usage patterns.

Essential cookies: required for the Platform to function (e.g. session management, authentication). These cannot be disabled.

Analytics cookies: help us understand how users navigate the Platform. These are anonymised where possible and are set only with your consent.

Preference cookies: remember your settings and choices across sessions.

You can control cookie settings through your browser or through our cookie preference centre when you first visit the Platform. Please note that disabling certain cookies may affect Platform functionality.

We do not use cookies to serve third-party advertising.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption in transit and at rest, access controls, regular security reviews, and staff training.

No transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. If you suspect a security incident involving your account, please contact us immediately at privacy@studentbubble.co.uk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

12. Third-Party Links and Services

The Platform may contain links to third-party websites and integrations with third-party services. This Privacy Policy applies only to the Student Bubble Platform. We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy policies before sharing any data with them.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice on the Platform at least 14 days before the changes take effect.

The "Effective date" at the top of this page indicates when this version was last updated. We encourage you to review this Policy periodically.

14. Contact and Complaints

For any privacy-related queries, please contact us:

Data Protection Officer Email: dpo@studentbubble.co.uk

General privacy enquiries Email: privacy@studentbubble.co.uk

If you are not satisfied with our handling of your data, you have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk · 0303 123 1113