Privacy Policy

This Privacy and Data Protection Policy sets out how personal data is collected, processed, stored, shared, and protected by Ward Group Investments, operating under the student accommodation brand Cabana Student Living. It is intended to ensure transparency, accountability, and compliance with all applicable data protection legislation.

This policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Human Rights Act 1998 (Article 8 – Right to Respect for Private and Family Life), and other relevant UK legislation and regulatory guidance issued by the Information Commissioner's Office (ICO).

Ward Group Investments recognises the importance of protecting personal data and is committed to processing data lawfully, fairly, and transparently. We ensure that personal data is collected for specified, explicit, and legitimate purposes, is adequate and limited to what is necessary, is kept accurate and up to date, is retained only for as long as necessary, and is processed securely.

This policy explains the rights of individuals, our responsibilities as a data controller, and the safeguards we have in place to protect personal information.

1. Who we are

For the purposes of data protection legislation, Ward Group Investments is the Data Controller. This means we are responsible for determining how and why personal data is processed.

Cabana Student Living is the student accommodation brand operated by Ward Group Investments.

Our registered address will be provided within this policy. A general contact email address for Cabana will be introduced and published once established. Until then, queries relating to this policy may be directed through the usual communication channels provided to residents and applicants.

2. Scope of this policy

This policy applies to all personal data processed by us in connection with the provision and management of student accommodation. It covers, but is not limited to, residents, prospective residents, guarantors, visitors, contractors, and members of the public who interact with us.

This policy applies across all Cabana Student Living-operated properties and services and should be read alongside any other relevant policies, including our Complaints Policy and Equality, Diversity and Inclusion Policy.

3. Personal data we collect

We collect and process personal data only where it is necessary for legitimate operational, contractual, or legal purposes. The types of personal data we may collect include contact details, application and tenancy information, guarantor details, payment and rent records, maintenance and repair requests, complaints and correspondence, emergency contact details, and records relating to health and safety incidents.

We do not routinely collect equality, diversity, or accessibility data. Where resident feedback is gathered through satisfaction surveys, this information is collected anonymously and cannot be used to identify individuals.

4. How and why we use personal data

Personal data is processed in order to manage accommodation applications and tenancies, communicate with residents and guarantors, collect rent and manage financial accounts, respond to maintenance requests, manage health and safety obligations, ensure the security of our buildings, investigate incidents or complaints, and comply with legal or regulatory obligations.

The lawful bases on which we rely to process personal data include the performance of a contract, compliance with legal obligations, legitimate interests in managing and protecting our properties and residents, and consent where required.

5. CCTV and security monitoring

CCTV is operated in communal areas of Cabana Student Living properties for the purposes of safety, security, and crime prevention. CCTV coverage is limited to external areas and internal communal spaces such as entrances, corridors, and locations where post and deliveries are stored. CCTV is not used for monitoring residents' private living spaces.

Access to CCTV footage is strictly controlled and restricted to authorised personnel only. Footage may be reviewed in response to incidents, safety concerns, complaints, or alleged breaches of tenancy agreements.

CCTV footage is retained only for as long as is necessary to fulfil its purpose. In some cases, footage may be retained for longer periods where it is required to investigate incidents or matters raised at or towards the end of a tenancy, or where there is an ongoing complaint or legal consideration.

6. Sharing of personal data

We do not sell or trade personal data. Personal data may be shared with third parties only where necessary and appropriate.

Maintenance contractors may be provided with limited personal information where required to complete works or address issues within a resident's accommodation. Where this occurs, residents will be informed where reasonably practicable.

Payment-related information is shared internally with our appointed accountants for the purposes of financial management and compliance. As Cabana Student Living properties operate on a bills-inclusive basis, personal data is not shared with utility providers.

Personal data may be shared with accreditation bodies such as ANUK where required, for example in connection with the escalation of a complaint, and only where the individual is aware of and involved in that process.

In rare circumstances, personal data may be shared with legal advisers, regulatory bodies, or emergency services where required by law, to protect vital interests, or where there are serious concerns for an individual's health or safety, including mental health emergencies.

7. Data retention

Personal data is retained only for as long as is necessary to fulfil the purposes for which it was collected, including contractual obligations, legal requirements, regulatory compliance, and legitimate operational needs. Retention periods may vary depending on the nature of the data and the context in which it is held.

In determining appropriate retention periods, we take into account statutory limitation periods, guidance issued by regulators, the potential need to resolve disputes or complaints, and the requirement to evidence compliance with legal or accreditation obligations.

Certain categories of data, such as CCTV footage, incident records, complaints, and tenancy documentation, may be retained for longer periods where issues are raised towards the end of a tenancy, where investigations are ongoing, or where there is a reasonable anticipation of legal or regulatory action. Once data is no longer required, it is securely deleted, overwritten, or anonymised in accordance with our internal data retention and disposal procedures.

8. Your rights

Individuals have rights under UK GDPR in relation to their personal data. These include the right to request access to their data, request correction of inaccurate information, request deletion of data where applicable, restrict or object to certain processing activities, and request data portability.

Where processing is based on consent, individuals have the right to withdraw that consent at any time.

Requests relating to personal data will be handled in accordance with data protection legislation and within statutory timescales.

9. Data security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of personal data. These measures are designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Such measures may include access controls, role-based permissions, secure storage systems, password protection, staff confidentiality obligations, and controlled sharing of information with third parties. All staff and contractors who process personal data on our behalf are required to handle it in accordance with this policy and applicable data protection law.

We also maintain internal procedures for identifying, managing, and reporting personal data breaches. In the event of a personal data breach, we will assess the risk to the rights and freedoms of affected individuals. Where required under UK GDPR, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to individuals, we will also notify affected individuals without undue delay, in accordance with legal requirements.

10. Complaints and further information

If you have concerns about how your personal data is handled, you are encouraged to raise these with us in the first instance so that we can address them promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection matters.

11. Review of this policy

This policy is reviewed periodically to ensure it remains accurate, compliant with legislation, and reflective of how we operate. Updates will be published as required.