Privacy Policy

Last updated May 2024

Who we are

Atalia Student Residences DAC (“we” or “us”) is a designated activity company (private limited company) registered in Ireland under company number 402106. We are in business for 18 years.

This Privacy Notice applies to the processing of your personal data by Atalia Student Residences DAC as the data controller. Inquiries regarding this Privacy Notice and data subject rights can be made via email to gdpr.atalia@universityofgalway.ie

Scope of this Privacy Notice

This Privacy Notice aims at informing website visitors, business partners, customers and other stakeholders, about how we process personal data. We are committed to processing personal data responsibly, securely and proportionally.

Atalia Student Residences DAC may change this policy from time to time by updating this webpage. You should check this website regularly to ensure that you are aware of any changes.

How we collect your personal data

We collect personal data both directly and indirectly from individuals.

We obtain personal data directly from individuals in a variety of ways, including but not limited to obtaining personal data when/from:

you subscribe to our newsletters and /or marketing material
you complete a contact form on our website
you visit our campus accommodation and/or offices
we are establishing a business relationship with you
we are performing services pursuant to a contract
you volunteer personal data including photographs, video or survey responses
you provide details for payment for services
your image and audio are captured on body worn cameras by contracted security personnel
you enter and leave the environs of the campus accommodation your image, audio, behaviour and movements are captured on our CCTV
you contact and or interact with us via social media, online platforms or direct messaging platforms
third party providers and direct bookings and/or booking engine platforms e.g. NetAffinity
promotion codes used for bookings via direct bookings and/or booking engine platforms e.g. NetAffinity

We obtain personal data indirectly about individuals from a variety of sources, including but not limited to obtaining personal data from the following sources:

University of Galway – for example, parking
public and open data sources such as public registers, news articles and internet searches, and social media or professional networking sites.
contracted security companies providing services to Atalia Student Residences DAC
contracted security companies providing services to University of Galway
trusted third party systems for marketing material, contact forms and newsletter e.g. Campaign Monitor
from third party providers and direct bookings and or booking engine platforms e.g. NetAffinity

The personal data types we collect

We collect the following types of personal data about individuals including:

Contact details – for example:

- first and last names

- contact phone/mobile phone numbers

- personal, university, work email address

- postal addresses

Demographic data for example:

- Adult and whether the adult are a parent/guardian

- Child

- Country

- Age

Student status and details of the course you are attending at the university, if applicable
Language preference
Purpose of your visit e.g. work or personal, relating to an event or group
Number of persons in a group

In addition

We can infer, derive and/or observe your affiliation to groups, organisations, clubs or workplaces where you use promotion codes for bookings via third party providers or where you use promotion codes for direct bookings via booking engine platforms e.g. NetAffinity
Where you provide your name and room number on baggage/luggage tags

We collect the following types of special categories of personal data about individuals including:

health data physical and or mental – for example:

- disability details and any required reasonable accommodations

-dietary restrictions, including food and airborne allergies as applicable

- next of kin and or emergency contacts where consent has been provided

expense forms submitted for re-imbursement
financial information, including bank account details, payment details, credit card details, payment default etc.
where you volunteer information relating to religious beliefs or philosophical beliefs and any reasonable accommodations required
Any behaviour or activity that falls outside our code of conduct during your stay with us
device information when you log on to our Wi-Fi network e.g. IP address, MAC address
device information (e.g. IP address, MAC address) when you log onto shared Wi-Fi networks between Atalia Student Residences DAC and the University as applicable to some of our sites

The lawful basis for processing your personal data

We process personal data on the following bases:

Consent – when you provide us with your personal data directly, for example when you make a direct booking with us
Contract – when processing is necessary for the performance of a contract with you
Legal obligations – we will process personal data to comply with legal obligations we are subject to
Legitimate interests – we process personal data when it is necessary for us to achieve the following legitimate interests:

- enhancing our services and offerings

- undertake direct marketing, promotional material and provide insights which we believe is welcomed by our service users, subscribers and individuals that have interacted with us

What we do with your personal data

We process your personal data with the purpose of:

internal record keeping
using the information gathered on our website to customise the website according to your interests. Record the items that are of interest to you on our website and pages visited, and how many times it has been visited
providing accommodation services
promoting our services sending promotional materials and emails about special offers or other information which we think you may find interesting
using your information to contact you for market research purposes
administering, maintaining and ensuring the security of our information systems, applications and websites
processing online requests or queries, including to respond to communications from individuals, requests for quotations and accommodation availability

How we secure your personal data when we process it

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in the following appropriate technical and organisational security policies and procedures in place to protect personal data including sensitive personal data from loss, misuse, alteration or destruction:

Access to your personal data is limited to only those who need access to it
Our servers stored at our location have security controls including access logs and audit trails, user authentication, password protection, automatic screen savers firewall
Anti-virus, anti-malware which is regularly updated
Regular software and Operating System updating
Regular Back-up
Incident response plan
Secure equipment disposal and secure manual data disposal – for example, shredding
On-site physical security alarms, locked rooms, building entry and exit access controls, CCTV, Body Worn Cameras (BWCs), Security patrols
Restricted access areas
We limit the use of portable devices such as USB keys, smartphones, PDAs, laptops and where such devices are absolutely necessary, we ensure that they have a strong password and employ encryption

Do we share your information with third parties?

We share your personal data with trusted third parties to help us to deliver efficient and quality services. When we do so, we ensure that the recipients are contractually bound to safeguard the data that we entrust to them before we share any data. We engage several of the following categories of recipients:

Partners to support us as we provide our services – for example, cloud-based software services such as Microsoft or Google
Financial and accounting software providers, accounting services and HR advisors.
Payment service providers
Professional and legal advisors including lawyers, auditors, insurers and data protection advisors
Marketing services providers.
Third party service providers e.g. catering providers, IT providers etc.
University of Galway including Information Solutions and Services (ISS)
Law enforcement or other government and regulatory agencies – for example, Revenue Commissioners or to other third parties as required by, and in accordance with applicable law or regulation
Where we use external providers to shred and securely delete data both manual (paper) and electronic data

Do we transfer your information outside the European Economic Area?

It is our preference to have personal data processed within the European Economic Area (EEA) as much as possible. We store personal data on servers located in the EEA. We use providers who process and store data on servers which may be in a territory outside the EEA such as the United Kingdom, the United States or Australia. When transferring data to the outside the EEA, we rely on the relevant Standard Contractual Clauses in accordance with the Commission Implementing Decision 2021/914. We also ensure that our providers do the same.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Where cookies are used, a statement will be sent to your browser explaining the use of cookies. To learn more, please refer to our cookie banner on our website.

We use the following cookies and similar technologies:

Strictly necessary cookies. These cookies are essential for the operation of our website and online tools or services. They include, for example, cookies that enable you to log into private areas of our website
Performance/Statistics cookies. These cookies allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. We have configured our analytics solution to preserve our visitor’s privacy, such as for example – anonymising IP addresses. All information these cookies collect is aggregated and therefore anonymous. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily
Functional cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you and remember your preferences, for example your username, language or text size. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites

We use Google Analytics 4 to:

measure website traffic
understand the customer journey
use event-based data
setting privacy controls including cookieless measurement, behavioural and conversion modelling.
Predictive capabilities
Integration to media platforms to help drive our website for content management

Links to other websites

A visit to our website may generate “first-party” cookies and “third-party” cookies. Third-party cookies are only generated with your agreement. We use third-party cookies to provide enhanced site functionality such as embedded video content.

Our website may contain links to other websites including other websites maintained by Atalia Student Residences DAC that are not governed by this Privacy Notice. In addition, links to the website of the University of Galway or other websites of interest are included such as local amenities or attractions. Please review the destination websites’ privacy policies before submitting personal data on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.

Once you have used these links to leave our site, you should note that we do not have any control over any other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement.

AdWords Remarketing

This website uses the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our site. It means that we advertise to previous visitors who haven’t completed a task on our site, for example using a contact form to make an enquiry. This can be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the Campus Accommodation website. Any data collected will be used in accordance with our own privacy policy and Google’s privacy policy.

You can set preferences for Google at: https://g.co/privacytools

We will not sell, distribute or lease your personal information to third parties unless we have your permission to do so.

Your data protection rights

You can exercise your rights by emailing us at gdpr.atalia@universityofgalway.ie. You have the following rights in relation to your personal data that we process including:

Right to Withdraw Consent – You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. You may withdraw consent at any time for any or no reason. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case
Right of access – You can ask us to verify whether we are processing personal data about you, and if so, to have access to a copy of such data
Right to rectification and erasure – You can ask us to correct our records if you believe they contain incorrect or incomplete information about you or ask us to erase your personal data after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected
Right to restriction of processing – You can ask us to temporarily restrict our processing of your personal data if you contest the accuracy of your personal data, prefer to restrict its use rather than having us erase it, or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we have overriding legitimate grounds to process it. You can ask us to inform you before we lift that temporary processing restriction
Right to data portability – In some circumstances, where you have provided personal data to us, you can ask us to transmit that personal data (in a structured, commonly used, and machine-readable format) directly to another company
Right to Object – You can object to our use of your personal data for direct marketing purposes, including profiling or where processing has taken the form of automated decision making. However, we may need to keep some minimal information – for example, email address to comply with your request to cease marketing to you
Right to make a complaint – You can contact the Data Protection Commissioner regarding any concerns you may have about our data handling practices (https://www.dataprotection.ie/en/contact/how-contact-us)

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make an initial request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds. A small fee will be payable.

If you believe that any information, we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect. If you would like a copy of the information held on you, please write to Atalia Student Residences DAC, Upper Newcastle, Galway, H91 F78F, Ireland.

How long do we retain personal data?

We retain personal data to provide our services, stay in contact with you and to comply with applicable laws, regulations and professional obligations that we are subject to. Unless a different time frame applies as a result of business needs or specific legal, regulatory, or contractual requirements, we retain personal data in line with our legal obligations but no longer than a period of 11 years.

For manual paper data we securely delete it by secure shredding paper data, and we use secure deletion (multiple overwrite) of electronic data this includes backup data and back up media. In other cases, we irrevocably anonymise your information.

Do we change this Privacy Notice?

We regularly review this Privacy Notice and will post any updates to it on this webpage. This Privacy Notice was last updated on November 07, 2023.

How to contact us

If you have any concerns as to how your data is processed, you can contact us per email or per post:

Atalia Student Residences DAC, Upper Newcastle, Galway, H91 F78F, Ireland.

Phone: 091 527112. Email: gdpr.atalia@universityofgalway.ie

We will respond to your queries within 30 days from when we receive them.

END.