Last updated May 2024
Who we are
Atalia Student Residences DAC (“we” or “us”) is a designated activity company (private limited company) registered in Ireland under company number 402106. We are in business for 18 years.
This Privacy Notice applies to the processing of your personal data by Atalia Student Residences DAC as the data controller. Inquiries regarding this Privacy Notice and data subject rights can be made via email to gdpr.atalia@universityofgalway.ie
Scope of this Privacy Notice
This privacy notice informs website visitors, business partners, customers and other stakeholders about how we process personal data. We are committed to processing personal data responsibly, securely and proportionally.
Atalia Student Residences DAC may change this policy from time to time by updating this webpage. You should check this website regularly to ensure that you are aware of any changes.
How we collect your personal data
We collect personal data both directly and indirectly from individuals
Personal data is obtained directly from individuals in a variety of ways, including but not limited to, when/from:
• you subscribe to our newsletters and /or marketing material
• you complete a contact form on our website
• you visit our campus accommodation and/or offices
• we are establishing a business relationship with you
• we are performing services pursuant to a contract
• you volunteer personal data including photographs, video or survey responses
• you provide details for payment for services
• your image and audio are captured on body worn cameras by contracted security personnel
• you enter and leave the environs of the campus accommodation your image, audio, behaviour and movements are captured on our CCTV
• you contact and or interact with us via social media, online platforms or direct messaging platforms
• you complete an accommodation application form and provide details to make a residency booking for the academic year via our booking platforms – for example, TCAS Online
• when you login and provide information through the resident portal TCAS Student
• where we correspond with you via email
Personal data is obtained indirectly about individuals from a variety of sources, including but not limited to:
• University of Galway – for example, Student Services
• public and open data sources such as public registers, news articles and internet searches, and social media or professional networking sites.
• contracted security companies providing services to Atalia Student Residences DAC
• contracted security companies providing services to University of Galway
• trusted third party systems for payments, marketing material, contact forms and newsletter – for example, Campaign Monitor
• from third party providers – for example, partner universities
• from TCAS Student which is part of TCAS Online enterprise platform for managing and supporting the full lifecycle of student accommodation reservations
• accommodation
The personal data types we collect
We collect the following types of personal data about individuals including:
• contact details – for example:
- first and last names
- contact phone/mobile phone numbers
- email address
- postal addresses
- next of kin
• demographic data for example:
- country, country of residence
- age, date of birth
- gender
• student status, University of Galway student number and details of the course you are attending at the university, as applicable
• language preference
Where you provide your name and room number on baggage, luggage and delivery items as may be left into reception.
We collect the following types of special categories of personal data about individuals including:
• health data, physical and or mental – for example:
o disability and any resultant required reasonable accommodations
o dietary restrictions, including food and airborne allergies as applicable
o ongoing medical condition which may be a factor in apartment /room allocation
• identification document, country of issue, photograph
• next of kin and or emergency contacts
• financial information, including bank account details, payments, debit card and/or credit card details
• where you use TCAS and where you have consented to Atalia Student Residences DAC to 'save card details for future payments'
• Name and contact details for financial guarantor where consent has been provided
• where you volunteer information relating to religious beliefs or philosophical beliefs and any reasonable accommodations required
• any behaviour or activity that falls outside our code of conduct or your contractual obligations during your stay with us
• device information when you log on to our Wi-Fi network – for example, IP address, MAC address
• device information (IP address, MAC address) when you log onto shared Wi-Fi networks between Atalia Student Residences DAC and the University as applicable to some of our sites
• where you choose to provide your PPSN provision of your PPSN is optional
The lawful basis for processing your personal data
We process personal data on the following bases:
• consent – when you provide us with your personal data directly, for example when you make a direct booking with us
• contract – when processing is necessary for the performance of a contract with you
• legal obligations – we will process personal data to comply with legal obligations we are subject to
• legitimate interests – we process personal data when it is necessary for us to achieve the following legitimate interests:
o enhancing our services and offerings
o undertake direct marketing, promotional material and provide insights which we believe is welcomed by our service users, subscribers and individuals that have interacted with us
What we do with your personal data
We process your personal data with the purpose of:
• internal record keeping
• to process accommodation applications and bookings
• providing accommodation services
• ensuring that adequate records are retained
• ensuring that applicable policies and procedures are fulfilled
• administering, maintaining and ensuring the security of our information systems, applications and websites
• processing online requests or queries, including to respond to communications from individuals, requests for quotations and accommodation availability
• promoting our services sending promotional materials and emails about special offers or other information which we think you may find interesting
• to process refunds, issue fines, recover costs or issue corrective actions
• using your information to contact you for market research purposes
• using the information gathered on our website to customise the website according to your interests. Record the items that are of interest to you on our website and pages visited, and how many times it has been visited
How we secure your personal data when we process it
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in the following appropriate technical and organisational security policies and procedures in place to protect personal data including sensitive personal data from loss, misuse, alteration or destruction:
• access to your personal data is limited to only those who need access to it
• our servers stored at our location have security controls including access logs and audit trails, user authentication, password protection, automatic screen savers firewall
• anti-virus, anti-malware which is regularly updated
• regular software and Operating System updating
• regular Back-up
• Incident response plan
• secure equipment disposal and secure manual data disposal – for example, shredding
• pseudonymisation and anonymisation
• on-site physical security alarms, locked rooms, building entry and exit access controls, CCTV, Body Worn Cameras (BWCs), Security patrols
• restricted access areas
• we limit the use of portable devices such as USB keys, smartphones, PDAs, laptops and where such devices are absolutely necessary, we ensure that they have a strong password and employ encryption
Do we share your information with third parties?
We share your personal data with trusted third parties to help us to deliver efficient and quality services. When we do so, we ensure that the recipients are contractually bound to safeguard the data that we entrust to them before we share any data. We engage several of the following categories of recipients:
• partners to support us as we provide our services – for example, cloud-based software services such as Microsoft or Google
• financial and accounting software providers, accounting services and HR advisors.
• payment service providers
• professional and legal advisors including lawyers, auditors, insurers and data protection advisors
• marketing services providers.
• third party service providers – for example, catering providers, IT providers etc.
• University of Galway including Information Solutions and Services (ISS)
• law enforcement or other government and regulatory agencies – for example, Revenue Commissioners or to other third parties as required by, and in accordance with applicable law or regulation
• where we use external providers to shred and securely delete data both manual (paper) and electronic data
• when you make a booking for an academic residency through the student portal TCAS we share registration details with Residential Tenancies Board in line with registration requirements and to meet with our legal obligations under the Residential Tenancies Act (Amendment) Act 2019
• where you use TCAS and where you have consented to Atalia Student Residences DAC to 'save card details for future payments' . Where this option is consented to your details are stored by Elavon Ireland
• we share records of payments or non-payment with your guarantor where applicable
• where you have consented for us to do so we share limited information where a reference is requested. This is limited to confirming only (a) whether all payments have been made, (b) default of payment, (c) confirming if any fines or corrective actions were issued , (d) residence address and duration of tenancy
Do we transfer your information outside the European Economic Area?
It is our preference to have personal data processed within the European Economic Area (EEA) as much as possible. We store personal data on servers located in the EEA. We use providers who process and store data on servers which may be in a territory outside the EEA such as the United Kingdom, the United States or Australia. When transferring data to the outside the EEA, we rely on the relevant Standard Contractual Clauses in accordance with the Commission Implementing Decision 2021/914. We also ensure that our providers do the same.
How we use cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
Cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
Where cookies are used, a statement will be sent to your browser explaining the use of cookies. To learn more, please refer to our cookie banner on our website.
We use the following cookies and similar technologies:
• Strictly necessary cookies. These cookies are essential for the operation of our website and online tools or services. They include, for example, cookies that enable you to log into private areas of our website
• Performance/Statistics cookies. These cookies allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. We have configured our analytics solution to preserve our visitor’s privacy, such as for example – anonymising IP addresses. All information these cookies collect is aggregated and therefore anonymous. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily
• Functional cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you and remember your preferences, for example your username, language or text size. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites
We use Google Analytics 4 to:
• measure website traffic
• understand the customer journey
• use event-based data
• setting privacy controls including cookieless measurement, behavioural and conversion modelling.
• Predictive capabilities
• Integration to media platforms to help drive our website for content management
Links to other websites
A visit to our website may generate “first-party” cookies and “third-party” cookies. Third-party cookies are only generated with your agreement. We use third-party cookies to provide enhanced site functionality such as embedded video content.
Our website may contain links to other websites including other websites maintained by Atalia Student Residences DAC that are not governed by this Privacy Notice. In addition, links to the website of the University of Galway or other websites of interest are included such as local amenities or attractions. Please review the destination websites’ privacy policies before submitting personal data on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.
Once you have used these links to leave our site, you should note that we do not have any control over any other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement.
AdWords Remarketing
This website uses the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our site. It means that we advertise to previous visitors who haven’t completed a task on our site, for example using a contact form to make an enquiry. This can be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the Campus Accommodation website. Any data collected will be used in accordance with our own privacy policy and Google’s privacy policy.
You can set preferences for Google at: https://g.co/privacytools
We will not sell, distribute or lease your personal information to third parties unless we have your permission to do so.
Your data protection rights
You can exercise your rights by emailing us at gdpr.atalia@universityofgalway.ie. You have the following rights in relation to your personal data that we process including:
• Right to Withdraw Consent – You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. You may withdraw consent at any time for any or no reason. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case
• Right of access – You can ask us to verify whether we are processing personal data about you, and if so, to have access to a copy of such data
• Right to rectification and erasure – You can ask us to correct our records if you believe they contain incorrect or incomplete information about you or ask us to erase your personal data after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected
• Right to restriction of processing – You can ask us to temporarily restrict our processing of your personal data if you contest the accuracy of your personal data, prefer to restrict its use rather than having us erase it, or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we have overriding legitimate grounds to process it. You can ask us to inform you before we lift that temporary processing restriction
• Right to data portability – In some circumstances, where you have provided personal data to us, you can ask us to transmit that personal data (in a structured, commonly used, and machine-readable format) directly to another company
• Right to Object – You can object to our use of your personal data for direct marketing purposes, including profiling or where processing has taken the form of automated decision making. However, we may need to keep some minimal information – for example, email address to comply with your request to cease marketing to you
• Right to make a complaint – You can contact the Data Protection Commissioner regarding any concerns you may have about our data handling practices (https://www.dataprotection.ie/en/contact/how-contact-us)
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make an initial request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds. A small fee will be payable.
If you believe that any information, we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect. If you would like a copy of the information held on you, please write to Atalia Student Residences DAC, Upper Newcastle, Galway, H91 F78F, Ireland.
How long do we retain personal data?
We retain personal data to provide our services, stay in contact with you and to comply with applicable laws, regulations and professional obligations that we are subject to. Unless a different time frame applies as a result of business needs or specific legal, regulatory, or contractual requirements, we retain personal data in line with our legal obligations but no longer than a period of 11 years.
For manual paper data we securely delete it by secure shredding paper data, and we use secure deletion (multiple overwrite) of electronic data this includes backup data and back up media. In other cases, we irrevocably anonymise your information or securely delete it.
Do we change this Privacy Notice?
We regularly review this Privacy Notice and will post any updates to it on this webpage. This Privacy Notice was last updated on February 19, 2024.
How to contact us
If you have any concerns as to how your data is processed, you can contact us per email or per post:
Atalia Student Residences DAC, Upper Newcastle, Galway, H91 F78F, Ireland.
Phone: 091 527112. Email: gdpr.atalia@universityofgalway.ie
We will respond to your queries within 30 days from when we receive them.
END.