Privacy and cookies policy

About this notice

Derwent Students are committed to protecting your privacy when you use our services.


The Privacy Notice below explains how we use information about you and how we protect your privacy.


What is personal data/personal information?

Why do you need personal data?

What personal data do you collect about me?

How do you collect my data?

What are my rights?

What happens if I do not want you to process my personal data?

Do you transfer any of my personal data to other countries?

How long do you keep my personal data?

How do you secure my personal data?

What can I do if I have any concerns?

Marketing Consent

1. What is personal data/personal information?

In simple terms, personal data is information which identifies and relates to you, either on its own or in conjunction with other information held by the Derwent FM. Sensitive personal data (or special categories of personal data, as it will be known under new EU legislation which comes into force on 25 May 2018) is personal data which falls within one of these categories:  

  • race;
  • ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetics;
  • biometrics (where used for the purpose of uniquely identifying a natural person);
  • health;
  • sex life or sexual orientation;

Data relating to criminal allegations, proceedings, offences, convictions or related security measures falls into the category of criminal offence data and is subject to separate safeguards.

2. Why do you need personal data?

There are specific reasons why we collect and process your personal data; these are known as lawful basis.

We may process your personal data because it is necessary for the performance of an accommodation contract with you, or because you are asking us to take specific steps before entering into a contract. We need to be able to fulfil our contractual obligations to you, and in this respect, we use your personal data for the following:

  • Provision of accommodation. This purpose may include processing sensitive personal data you disclose regarding health conditions or disabilities relevant to your accommodation if you have given your explicit consent for us to do so.
  • Processing safeguarding concerns to ensure the safety and wellbeing of students.
  • Processing and recovery of accommodation fees.
  • Review and completion of repairs and maintenance
  • Provision of support services to students such as Wellbeing Services.
  • Administration of the CCTV system.
  • We may also process your personal data to administer complaints and investigations concerning misconduct. As providers of higher education living accommodation, investigating complaints concerning misconduct is necessary to maintain the integrity of the University’s welfare of students and staff we work with.

We may also process your personal data where:

  • It will help us to protect your vital interests, or those of another party. This would be in extreme circumstances where there is an emergency situation such as illness or serious injury.
  • You have given us permission (consent) to send you information relating to events or activities which may be of interest.

In addition to the purposes referred to above, we may share your personal data with certain third parties for specific processing reasons.

We may pass your details to third parties because it is necessary for the performance of our accommodation contract or the accommodation provider’s contract with you. In this respect, we/they may use your personal data for the following:

  • In emergency situations such as illness or serious injury we may pass your information to the emergency services, close family or next of kin.
  • To administer the accommodation contract and repayment of student debts, where internal recovery attempts have proved unsuccessful. We may use external agents including (but not limited to) solicitors, debt recovery agents, tribunals and Courts.
  • To deliver externally hosted IT services or products. Such information will only be used to provide the contracted services, and in accordance with the terms of agreements with us.

3. What personal data do you collect about me?

The type of personal data and sensitive personal data we may process about you includes:

  • your full name;
  • your student number (if known);
  • student photograph / ID held on file;
  • your home/ permanent and term time addresses and other contact details such as landline/mobile phone numbers and email addresses;
  • your date of birth;
  • your nationality;
  • your religion;
  • the name of your current or most recent educational institution;
  • any disability or other medical information that has been provided to us;
  • images gathered through CCTV recording.

4. How do you collect my data?

We will collect your information in the following ways:

  • from you when you complete applications / admissions processes;
  • from you when you complete an Application for Accommodation;
  • from you when you communicate with us by telephone, email, in person or via social media, for example in order to make enquiries or raise concerns;
  • from images gathered through CCTV recording;
  • from third party sources in relation to your accommodation application, contract and/or subsequent residence in accommodation;
  • from third party sources in relation to your funding, such as your sponsor/guarantor.

Where we have said that we obtain personal data about you from third party sources, we will look to ensure that the third party has lawful authority to provide us with this information.
5. What are my rights?

5. What are my rights?


As a “Data Subject” you have a number of rights under Data Protection Legislation. These rights provide for the following:

  • The right to be informed – we will explain how we collect and use your personal data in a clear and plain language
  • The right of access – you will be able to request a copy of your personal data and other information around how we process it
  • The right to rectification – you can tell us to update any information about you which is inaccurate or incomplete
  • The right to erasure – some people may refer to this as the ‘right to be forgotten’, but you can only ask to have your personal data erased and prevent processing in specific circumstances. For example, if you provided your personal data in order to form an accommodation contract but you are no longer bound by that contract or the retention periods of a contract that has ended, then you can request that it is deleted. But if we have told you that we need your personal data to comply with a legal obligation, then we may refuse your request.
  • The right to restrict processing – in certain circumstances you can block or restrict us from processing your data. If we are restricted then we are allowed to store your personal data, but not process it again.
  • The right to data portability – this allows you to obtain and reuse your personal data for your own purposes but only applies when processing has been carried out by automated means.  
  • The right to object – where we have said that we are processing your data based on legitimate interests, or for direct marketing, you have a right to object to your personal data being used. However, if we can demonstrate that we have legitimate grounds for the processing which override your individual interests, or that the processing is necessary for the establishment, exercise or defence of legal claims, then we can decline your request.
  • Rights in relation to automated decision making and profiling – at present, all our decisions involve a human. If this situation were to change and we started to use automated decision-making processes, then you would have the right to ask us to not base any decisions which significantly affected you solely on automated processing.

If you wanted to exercise any of the above rights please contact the Data Protection Officer via [email protected]

More detailed explanations about all of these rights are available from the Information Commissioners Office website at 

6. What happens if I do not want you to process my personal data?

The primary reason for us collecting and processing your personal data is so that we can provide you with accommodation whilst you are studying. If you do not want us to process your personal data then we will be unable to offer accommodation to you as we will be unable to form a contract.

Under the Data Protection Legislation, you do have the right to object to us processing your personal data if we have said we are doing it:

  • based on legitimate interests
  • for research and statistical purposes

Where we have said that we are processing your personal data for one of the purposes mentioned above, then you are entitled to object to the processing of any personal data relating to your own specific situation (and not on behalf of someone else) and we will stop processing. 

However, if we (as the data controller) can demonstrate that our compelling legitimate grounds for the processing override your own interests, fundamental rights or freedoms, then we shall be able to continue processing your data. We will also be able to continue if the processing is for the establishment, exercise or defence of legal claims.

Where we are processing your personal data for statistical reporting purposes and we are doing this for the performance of a public interest task, then we are not required to comply with an objection to the processing.

7. Do you transfer any of my personal data to other countries?

Where data is shared within the UK, or the European Union (EU), the third party will be required to comply with and safeguard the data under the terms of the Data Protection Legislation and the General Data Protection Regulation (GDPR).

Your personal information will only be transferred to countries outside of the EU (“third countries”) or international organisations, where the European Commission has decided that an adequate level of data protection can be offered, or where adequate safeguards, such as the EU-US Privacy Shield, are in place.


8. How long do you keep my personal data?

We will only retain your personal data as long as is necessary for the purposes described above. We may still need to hold your personal data for a period of time to satisfy statutory/legal obligations and/or to meet administrative requirements. Data will be securely destroyed when no longer required.

Generally speaking, we will retain your personal data for 6 years after the end of your accommodation contract, but if there is no need for us to keep such information for that long then we will delete it sooner. If you create an accommodation account but decide not to proceed, or you start an application for accommodation which is not then submitted, we will retain your information for a maximum of 3 months beyond the end of the academic year you were applying for. 

9. How do you secure my personal data?

We take a range of measures to protect your information, including:

  • Limiting access to our buildings by passes and key cards
  • Using secure access e.g. firewalls and encryption to secure file servers
  • Granting appropriate levels of access to the accommodation management software for individual members of staff
  • Filing paper documents in locked storage


10. What can I do if I have any concerns?

Derwent Students/FM is a subsidiary of Places for People Group. To find out more about Places for People Groupclick here.  We aim to be transparent about the way we process your personal data but we understand that you may still have questions or concerns.

If there is anything you are unclear about then please contact the Places for People Group Data Protection Officer via [email protected] who shall be happy to help.  

If you remain dissatisfied then you have the right to complain to the ICO. Further advice on how you can raise a concern with us or escalate a matter to the ICO is available via the ICO website:


11. Marketing Consent

We would like keep you informed of special events which are being held at our Residences. We feel that these are an important way to enhance your experience of your living standards. You will be asked whether you are happy to give your consent to receive these email communications as part of your accommodation application. 

Any marketing emails you receive from us will have a link to enable you to unsubscribe from that mailing list at any time. Please be aware that you may continue to receive some communications whilst we update our systems with your request.

Please note: We will also contact you via email at various key stages of the accommodation application process, and subsequently to advise you of operational matters relating to your residence such as planned maintenance, changes to residence reception opening times, forthcoming inspections etc. These are contractual or in mutual legitimate interest to receive rather than “marketing” communications and are therefore not subject to consent requirements.


12. Visiting our websites

When you visit one of our websites, we collect standard internet log information for statistical purposes.

  • We use cookies to collect information in an anonymous way, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.
  • We do not make any attempt to identify visitors to our websites. We do not associate information gathered from our sites with personally identifying information from any source.
  • When we collect personal information, for example via an online form, we will explain what we intend to do with it.

Our websites contain links to various third party websites. We are not responsible for the content or privacy practices of any external websites that are linked from our sites.

13. How we use your telephone number and email address

Contact via telephone or email provide a direct way to contact and share information with you about the services we can deliver to you. It can also help you receive important messages about your tenancy or which may interest or a help you to you such as new online services.

If you provide your telephone number or email address we may keep in contact with you by these methods.

Operational email messaging and calls

If you supply us with your telephone or email contact details, we may use them to call or send you operational messages.

Examples of operational messages include:

  • Confirming a repair and/or a time and date for a repairs contractor to visit
  • Rent Account updates, arrears actions
  • Sending a reminder about an appointment
  • Asking you to contact a named person or department
  • Satisfaction surveys

Sharing your telephone number with third parties

We may pass your telephone number to third parties so that we can meet our contractual obligations with you. We may also share your telephone numbers if we are required to by law.

We may supply the details to our approved third party contractors who are delivering or performing services on our behalf, and these companies must not use your information for any other purpose. We never share or sell your telephone numbers to telesales/marketing companies.

14. Who do we share your information with?

We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements there is always an agreement in place to make sure that the organisation complies with data protection law. 

We may enter into partnerships with other organisations such as local authorities and the police. For example, we may join a partnership to help prevent and control anti-social behaviour.  In order to protect your information, we will enter into a legally binding data sharing agreement with partner organisations before any sharing takes place. It is not always possible for us to tell you that personal information is being shared, for example when we are working with the police or other agencies to help the investigation or detection of a crime as to do so may prejudice that investigation.

We are likely to share your personal information with the following:


  • Property Services and Repairs

Contractors and third supply chain service providers for the purposes of carrying out property related inspections and repairs.  Generally we will only share your name, the property address and your contact details so that they can arrange an appointment with you. In some cases we may also share customer service information with them, for example where you have told us that you need longer to answer your door. We may also need to share information where we have recorded there is a potential risk to operatives or other representatives.


  • Local Authorities

We will share your personal information with local authorities usually for the purposes of providing services processed by that local authority such as Council Tax. 


We may also share information with local authorities for the purpose of investigating tenancy fraud or other types of fraud or criminal investigations. You will not have a right be told about this type of sharing because to do so may affect those investigations we will take steps to protect your information and only share what is necessary for those investigations.


  • Police

We may share your personal information with the police for the purposes of preventing or detecting a crime or fraud.


  • University and Higher Education Providers

We may need to share your personal information with various departments within university or higher education if we suspect that there may be concerns around your general wellbeing which could affect yourself and those around you.


  • Debt Recovery Agents

We may share your personal information with debt recovery agents for the purposes of recovering any outstanding charges owed to us.


  • Legal Services and Partners

We may share your personal information with our legal services or solicitors if we are preparing or defending a legal claim.

Where there is a high risk to your personal information we will complete a privacy assessment before we share personal information to make sure we protect privacy and comply with the law.


Sometimes we have a legal duty to provide personal information to other organisations, this is often because we need to give that data to the police, courts, local authorities or government bodies.


We may also share your personal information when we feel there’s a good reason that’s more important than protecting your privacy. This doesn’t happen often, but we may share your information:


  • in order to detect and prevent a crime and fraud; or 
  • if there are serious risks to the public, our staff or to other professionals;
  • safeguarding of vulnerable individuals


If we’re worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we’ll discuss this with you and, if possible, get your permission to tell others about your situation before doing so. 


For all of these reasons the risk must be serious before we can override your right to privacy. 


We may still share your information if we believe the risk to others is serious enough to do so.


There may also be rare occasions when the risk to others is so great that we need to share information straight away. 


If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why if we think it is safe to do so and will not cause harm, distress or further risks to you, our staff, other professionals and/or the public.


15. How to tell us of a data breach

Derwent Students and Places for People Group takes responsibility to protect the personal information we hold about those with whom we work seriously. We are accountable for our processing and take necessary technical and operational steps to information security protections.

If you suspect your personal information or that of others may have been at risk of a data protection breach Click Here to let us know

The above email is available to everyone with whom we deal so that customers, employees and supply chain processors can tell us without undue delay of potential or actual breach.

16. Where can i get advice?

If you have any questions about how your personal information is handled please contact our Data Protection Officer at [email protected]

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner's Office

Wycliffe House

Water Lane


Cheshire SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively visit or email [email protected].