legal
Privacy Policy
Effective date: 1 May 2025
We are committed to protecting your personal data. This Policy explains what we collect, why, and your rights under UK GDPR.
1. Who We Are
Student Bubble Ltd ("Student Bubble", "we", "us", or "our") is the data controller responsible for personal data collected through our website, application, and related services (the "Platform").
We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable privacy legislation.
If you have any questions about this Privacy Policy or how we handle your data, please contact our Data Protection Officer:
Email: dpo@studentbubble.co.uk General privacy enquiries: privacy@studentbubble.co.uk
2. Personal Data We Collect
We collect and process the following categories of personal data:
Account and identity data Name, email address, date of birth, phone number, and university or employer affiliation. Where you sign up via a third-party provider (e.g. Google, Microsoft), we receive the data you authorise that provider to share.
Rental Passport data Student number or staff ID, academic year and course, references, identity documents (passport, driving licence), right-to-rent documents, rental history, and accommodation preferences. Identity verification is carried out directly by Student Bubble using the documents you submit.
Property and listing data If you are a landlord or letting agent: company name, registered address, letting agent registration number, property details and photographs, and billing information.
Usage and technical data IP address, browser type and version, device identifiers, pages visited, search queries, filter selections, and session duration — collected via server logs and cookies.
Communications data Messages sent through our in-platform messaging system, support tickets, and email correspondence with us.
We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@studentbubble.co.uk and we will delete it promptly.
3. How We Use Your Data
We use your personal data for the following purposes:
• Providing the Platform — creating and managing your account, enabling property search, facilitating Rental Passport creation and sharing, and connecting students with landlords. • Identity verification — processing Rental Passport documents submitted by you to verify your identity and eligibility. • Communications — sending transactional emails (account confirmation, password resets, invite links), Platform notifications, and, where you have consented, marketing updates. • Safety and trust — reviewing listings, investigating reports of misconduct, and preventing fraud, spam, and other prohibited activity. • Legal compliance — meeting our obligations under UK law, including anti-money laundering checks, right-to-rent verification requirements, and responding to lawful requests from authorities. • Analytics and improvement — understanding how users interact with the Platform so we can improve features and fix issues. Analytics data is aggregated and anonymised where possible. • Billing — processing subscription payments from landlords and letting agents via our payment processor.
4. Legal Basis for Processing
Under the UK GDPR, we rely on the following legal bases:
Contract performance (Article 6(1)(b)) — processing necessary to provide you with the service you have requested, such as creating your account, enabling property listings, and facilitating Rental Passport sharing.
Legitimate interests (Article 6(1)(f)) — processing necessary for our legitimate interests, including preventing fraud, improving the Platform, and communicating service updates. We balance our interests against your rights and will not process your data in this way where your interests override ours.
Legal obligation (Article 6(1)(c)) — processing necessary to comply with our legal obligations, for example in response to a court order or to meet anti-money laundering requirements.
Consent (Article 6(1)(a)) — where you have given your explicit consent, such as for marketing emails or for sharing your Rental Passport with a specific landlord. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Special category data (Article 9(2)(a) or (g)) — where identity documents reveal special category information (such as nationality), we process this on the basis of your explicit consent or where processing is necessary for substantial public interest reasons in connection with right-to-rent checks.
5. Who We Share Your Data With
We share your personal data only as described below:
Landlords and letting agents — when you expressly choose to share your Rental Passport with a specific Provider, we disclose the agreed profile information. We do not share your full contact details until both parties have mutually agreed to proceed.
Other users (Flatmate Pool) — anonymised profile information (first name, passport score, university affiliation, and preferences) is visible to other verified users. Full details are shared only on mutual agreement.
Service providers — we engage trusted third-party processors to support the Platform, including: • Clerk (authentication) • Payment processors for billing • Cloud hosting and infrastructure providers • Email delivery services
All processors are bound by data processing agreements and may not use your data for their own purposes.
Legal and regulatory authorities — we may disclose data where required by law, regulation, court order, or to protect the safety of users or third parties.
Business transfers — if Student Bubble is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
We do not sell your personal data to third parties.
6. International Data Transfers
Where we transfer your personal data outside the United Kingdom, we ensure that an appropriate safeguard is in place, such as the UK's International Data Transfer Agreement (IDTA), adequacy regulations, or standard contractual clauses approved by the Information Commissioner's Office (ICO).
Our primary data processing infrastructure is located within the UK and EEA. Where sub-processors operate outside these regions, we carry out transfer impact assessments and implement appropriate protections.
7. How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law.
Account data is retained for the duration of your account and for up to 3 years after closure, to enable us to resolve disputes, enforce our agreements, and comply with legal obligations.
Rental Passport documents (identity documents, references) are deleted 12 months after you close your account, unless a longer retention period is required by law.
Property listing data is retained for 6 years after a tenancy ends, in line with the Limitation Act 1980.
Anonymised usage and analytics data may be retained indefinitely as it can no longer identify you.
When data is no longer needed, it is securely deleted or anonymised.
8. Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
Right of access — you may request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification — you may ask us to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — you may ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.
Right to restrict processing — you may ask us to pause processing of your data while a complaint is being investigated.
Right to data portability — where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
Right to object — you may object to processing based on legitimate interests or direct marketing at any time.
Rights in relation to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces significant legal effects, unless you have given explicit consent or it is necessary for a contract.
To exercise any of these rights, please contact us at privacy@studentbubble.co.uk. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or to seek a judicial remedy.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption in transit and at rest, access controls, regular security reviews, and staff training.
No transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. If you suspect a security incident involving your account, please contact us immediately at privacy@studentbubble.co.uk.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.
11. Third-Party Links and Services
The Platform may contain links to third-party websites and integrations with third-party services. This Privacy Policy applies only to the Student Bubble Platform. We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy policies before sharing any data with them.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice on the Platform at least 14 days before the changes take effect.
The "Effective date" at the top of this page indicates when this version was last updated. We encourage you to review this Policy periodically.
13. Contact and Complaints
For any privacy-related queries, please contact us:
Data Protection Officer Email: dpo@studentbubble.co.uk
General privacy enquiries Email: privacy@studentbubble.co.uk
If you are not satisfied with our handling of your data, you have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk · 0303 123 1113
Questions about this Policy? privacy@studentbubble.co.uk · Terms and Conditions