Last updated: 24 April 2026
We (Professional Cribs) take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use, and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
We collect, use, and are responsible for certain personal data about you. When we do so, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy should be read alongside our Cookie Policy, which explains in more detail how we use cookies and similar technologies on our website.
Key terms
| Term | Meaning |
| We, us, our | Professional Cribs Limited, a company registered in England and Wales under company registration number [07247566]. Our registered office is at 33 Cavendish Square, Margaret Street, London, W1G 0PW |
| Personal data | Any information relating to an identified or identifiable individual |
| Special category personal data | Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; data concerning health, sex life, or sexual orientation; genetic or biometric data |
| Data subject, you, your | The individual who the personal data relates to (i.e. you) |
Personal data we collect about you
We may collect and use the following personal data about you:
- your name and contact information, including email address, telephone number, and (where relevant) company details;
- information to check and verify your identity, such as your date of birth, photo ID, and nationality;
- proof of right to rent in the UK (as required by the Immigration Act 2014);
- your billing information, including transaction and payment card information;
- employment, student, or income information (for referencing and affordability checks);
- information about your guarantor (where required);
- your personal interests and preferences regarding property features and locations;
- your contact history, including regarding property enquiries, viewings, and tenancies;
- information from accounts you link to us (for example, if you log in via Facebook or Google);
- information to enable us to undertake credit or other financial checks on you;
- information about how you use our website, IT, communication, and other systems;
- your responses to surveys, competitions, and promotions;
- CCTV footage where installed at our properties or offices, for security purposes (clearly signed).
We collect and use this personal data to provide products and/or services to you. If you do not provide the personal data we ask for, it may delay or prevent us from providing products and/or services to you — for example, we may not be able to let a property to you, arrange maintenance, or collect rent. You will not be able to sign up to view a property or enter into a tenancy without agreeing to us processing your personal data in accordance with this policy.
How your personal data is collected
We collect most of this personal data directly from you, in person, by telephone, text, email, and/or via our website. This may include when you fill out an enquiry or registration form, book a viewing, apply for a tenancy, submit a maintenance request, or enter a competition.
We may also collect information about you:
- directly from third parties, such as credit reference agencies, referencing providers (e.g. HomeLet, Goodlord, or similar), customer due diligence providers, previous landlords, or guarantors for your and your co-tenants’ rent;
- from a third party with your consent, such as your bank or building society;
• from cookies on our website — for more detail, please see our Cookie Policy;
- via our IT systems, including door entry systems and reception logs, automated monitoring of our websites and technical systems, CCTV and access control systems, and email and messaging systems.
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper lawful basis, such as:
- where you have given us consent;
- to comply with our legal and regulatory obligations;
- for the performance of a contract with you, or to take steps at your request before entering into a contract;
- for our legitimate interests or those of a third party, provided this is not overridden by your own rights and interests.
The table below explains what we use your personal data for and why:
| Purpose | Lawful basis |
| Providing lettings services, managing viewings, tenancies, and maintenance | Performance of a contract with you or steps prior to entering one |
| Carrying out Right to Rent checks | Legal obligation (Immigration Act 2014) |
| Carrying out credit, referencing, and affordability checks | Legitimate interests (to ensure customers can meet their obligations) |
| Collecting rent and other payments | Performance of a contract |
| Preventing and detecting fraud | Legitimate interests / legal obligation |
| Preventing misuse of our property | Legitimate interests (to protect the property, other tenants, and neighbours) |
| Ensuring safe working practices and health & safety compliance | Legal obligation / legitimate interests |
| Updating and enhancing customer records | Contract / legal obligation / legitimate interests |
| Providing information to local councils (e.g. for electoral roll or council tax) | Legal obligation |
| Operational reasons, such as improving efficiency, training, and quality control | Legitimate interests |
| Statistical analysis to help us manage our business | Legitimate interests |
| Marketing our services to existing and former customers | Legitimate interests (soft opt-in under PECR) |
| Marketing to prospects who have consented | Consent |
| Website analytics and advertising via cookies | Consent (via our cookie banner) |
| External audits and accreditation (e.g. ISO, NRLA, ANUK) | Legitimate interests / legal obligation |
Where we process special category personal data (for example, health information relevant to a tenancy or reasonable adjustments), we will only do so where a specific condition under data protection law applies — most commonly your explicit consent, to protect someone’s vital interests, or to establish, exercise, or defend legal claims.
Marketing
We may use your personal data to send you updates (by email, text message, telephone, or post) about our products and services, including exclusive offers, promotions, and new services.
Where required by law we will ask for your consent before sending marketing. In other cases we rely on our legitimate interests (such as contacting existing or former customers about similar services). You have the right to opt out of marketing communications at any time by:
- contacting us at lettings@professional-cribs.com or privacy@professional-cribs.com; or
- using the “unsubscribe” link in any marketing email, or replying STOP to marketing text messages.
Who we share your personal data with
We routinely share personal data with:
- companies within our group (including Student Cribs Limited, where relevant and lawful);
- third parties we use to help deliver our services, such as referencing agencies, payment processors, maintenance contractors, cleaners, IT providers, and delivery companies;
- other third parties that help us run our business, such as marketing agencies and website hosts;
- advertising technology partners whose tracking pixels and cookies we use on our website, including Google (Google Ads, Google Analytics), Meta Platforms Ireland Ltd (Facebook/Instagram), TikTok Technology Limited (TikTok), Snap Inc. (Snapchat), and Spotify AB (Spotify) — see our Cookie Policy for details;
- third parties approved by you, such as social media platforms you choose to link your account to;
- credit reference agencies;
- our insurers and brokers;
- our banks;
- guarantors, where they are party to your tenancy;
- debt collection agencies, where tenants or guarantors have failed to pay sums due;
- external auditors, in connection with accreditation or financial audits;
- law enforcement, regulators, and other public authorities where required by law.
We only allow our service providers to handle your personal data where we are satisfied they take appropriate measures to protect it, and we impose contractual obligations on them to use it only to provide services to us and to you.
We may also share information with potential buyers in the event of a sale, merger, or restructuring of our business. Where possible, information will be anonymised; in any case, the recipient will be bound by confidentiality obligations.
Where your personal data is held
Personal data may be held at our offices and those of our group companies, third-party agencies, service providers, representatives, and agents. Some of these third parties may be based outside the UK and the EEA. For more information, see “Transferring your personal data outside the UK and EEA” below.
How long your personal data will be kept
We will keep your personal data while you have an account with us or while we are providing services to you. After that, we will keep your personal data only for as long as is necessary:
- to respond to questions, complaints, or claims made by you or on your behalf;
- to demonstrate that we treated you fairly;
- to keep records required by law (for example, Right to Rent checks must be retained for at least one year after the tenancy ends; financial records must generally be retained for six years).
When it is no longer necessary to keep your personal data, we will delete or anonymise it.
Transferring your personal data outside the UK and EEA
To deliver services to you, it is sometimes necessary for us to share your personal data outside the UK/EEA — for example, where our service providers (such as cloud hosts or marketing platforms like Google, Meta, TikTok, Snap, and Spotify) are based in the United States or elsewhere.
We only transfer personal data outside the UK/EEA where:
- the UK government has made an adequacy decision for that country (including the EEA, Gibraltar, Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay, and the US under the UK Extension to the EU-US Data Privacy Framework where the recipient is certified);
- appropriate safeguards are in place, typically the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum; or
- a specific exception under data protection law applies (for example, your explicit consent or necessity for a contract).
If you would like more information about a specific transfer, please contact us.
Your rights
You have the following rights in relation to your personal data, which you can exercise free of charge:
- Access — the right to be provided with a copy of your personal data.
- Rectification — the right to require us to correct any mistakes in your personal data.
- Erasure (right to be forgotten) — the right to require us to delete your personal data in certain situations.
- Restriction of processing — the right to require us to restrict processing in certain circumstances.
- Data portability — the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to a third party in certain circumstances.
- To object — the right to object at any time to direct marketing, and in certain other situations to our processing of your personal data.
- Not to be subject to automated decision-making — the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects.
- To withdraw consent — where we rely on consent, you have the right to withdraw it at any time.
For further information, see the Information Commissioner’s Office (ICO) guidance on individuals’ rights.
To exercise any of these rights, please email, call, or write to us (see “How to contact us” below), providing enough information to identify yourself and details of the request.
Keeping your personal data secure
We have appropriate technical and organisational security measures in place to prevent personal data from being accidentally lost, used, or accessed in an unauthorised way. We limit access to your personal data to those with a genuine business need, and they are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator where we are legally required to do so.
How to complain
Please contact us if you have any query or concern about our use of your personal data (see “How to contact us” below). We hope we will be able to resolve any issues.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Online: https://ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this privacy policy
We may change this privacy policy from time to time. When we make significant changes, we will inform you and update the “Last updated” date at the top of this page.
How to contact us
You can contact us by post, email, or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law, or to make a complaint:
Email: privacy@student-cribs.com
Telephone: 020 3758 7000
Post: Professional Cribs, 33 Cavendish Square, Margaret Street, London, W1G 0PW