Privacy Notice

Last updated: 20/03/2025

This privacy notice sets out how Yugo collects, uses and shares your personal information. It also gives you information about your privacy rights and how to exercise these.

Operating globally, in providing privacy information we’ve used the General Data Protection Regulation (EU) and UK GDPR as a benchmark and provided specific information in relation to US State privacy laws.

In some circumstances, your relationship will be directly with a university, with Yugo providing a service on the university’s behalf. In such situations, the university should be your first point of call for any data protection related queries. 

We regularly review this privacy notice and may update it to make improvements or to reflect regulatory changes. We encourage you to check it from time to time. If we make any significant changes, we’ll endeavour to notify you. Please also remember when using our website if you click on a link to go to another organisation’s website this privacy notice will no longer apply.

About us and contact details

Yugo provides student accommodation across the globe, and we strive to provide safe, affordable, comfortable, high-quality accommodation for students.

Yugo and its affiliates, subsidiaries and/or holding company respect your privacy. In this privacy notice, when we refer to “Yugo”, “we”, “us”, or “our”, we are referring to the group company you are engaging with. For example, you may make an enquiry and/or enter into an agreement for the provision of accommodation in Spain with Yugo Student Spain SLU. Please see the list of companies in our group below.

If you have any queries about this privacy notice or any data protection related matter, please email us: gdpr@yugo.com. Or you can write to us, using the relevant postal address below.

The personal information we collect and use

To provide our accommodation services we need to collect and handle personal details about you. We collect information about enquirers, residents, visitors to our website or premises, suppliers and clients. The nature of the personal information we hold about you will depend on our relationship with you.  

Information you give us

You may give us personal information when filling in online enquiry, booking or application forms, over the telephone, by email or in person. You may also give us information when you engage with us on social media, enter a competition, complete a survey or raise queries about your accommodation. We have categorised the types of personal details we may collect from you as follows:

Prospective Resident, Licensee, Occupant, and Tenant

• Identity Data - Your name, date of birth, gender, personal description, photograph, nationality, marital status, emergency contact or Next of Kin including relationship, Guarantor, driving licence, passport information, visa information, entitlement to live in the UK, National Insurance Number, utility bill or similar identifiers;

• Contact Data - Contact details: postal and e-mail address, phone number;

• Course Data - Details of your University, College or Institution and your Faculty, Course and length of study

• Employer’s details (if applicable)

• Financial Data - Financial and credit card information, details of your bank account and information about your remuneration and/or earnings and transaction data including details about payments to and from you;

• Preference Data - Your preferences in relation to accommodation requirements.

• CCTV - Images of you in the property or an external area covered by our CCTV cameras. We use CCTV to prevent and detect criminal activity, fraud and misuse of or damage to our property.

• Marketing and Communication Data- Your marketing preferences in receiving promotional messages from us.

• More sensitive data – we may in specific circumstances collect personal information which is considered more sensitive under data protection laws, and known as ‘Special Category Data’ under EU and UK GDPR. For example, information relating to your health and/or any disability you may have or your religious views or ethnic origin. This is so we can assess your accommodation needs and make sure any accommodation we offer meets your requirements.

Guarantor and next of kin

We collect information about guarantors and next of kin, which is routinely limited to name, address, telephone and email, date of birth, Photo ID, and proof of address. We request bank details for guarantors, and for next of kin we collect relationship to student.

Physical location data

• CCTV systems are installed at all of our premises.  All internal and external CCTV cameras are clearly labelled or otherwise notified to staff and visitors and are visible

• Electronic entry systems including, swipecard and fob entry, are installed at the majority of our sites to allow you access to our premises

• Meter readings

Client and Landlord

If you are a client the information you give us may include:

• Your name, contact details: postal and e-mail address, phone number, date of birth and national insurance number;

• Details about your organisation, Know Your Client details (KYC), ownership structure, shareholders

• Your name, address and contact details, for majority shareholders above 25%

• Photo ID and proof of address for majority shareholders;

Supplier

If you are a supplier the information you give us may include:

• Your name, contact details: postal and e-mail address, phone number, date of birth and national insurance number;

• Company details, contact details: postal and e-mail and phone number,

• Health and safety and insurance certificates,

• Information on the performance of the company

• Ownership structures and shareholder details

Information we receive from other sources

• We work with other organisations who may provide us with personal information about you, such as landlords, universities, referral partners, or credit reference agencies to enable us to provide our services

• We may receive information if you have provided permission to referees or other organisations to share it with us. 

• In order to manage and provide our services, we work with a number of other partners including to process payments for rent or other monies we are owed, to verify your identity or status through credit reference checks.

• We may also search publicly available records, including business records; social and other media outlets and Post Office’s National Change of Address Database and credit reference agencies

• We may combine this information with information you give to us and information we collect about you.

Our use of cookies & similar technologies

Our website uses cookies (and similar technologies), which collect both non-personal and personal data. Some of this technology is essential for our website to operate. We use site performance cookies to better understand how visitors browse our website and to make sure we improve the user experience. We also use advertising cookies to help promote our services. We collect your consent to use any non-essential cookies and similar technologies. To find out more and to update your cookie preferences please see: Cookie Policy UK English Page.

How we use your personal information & our lawful bases

We use your personal information for the following purposes. This section also explains the lawful bases we rely on under EU and UK data protection law.

• to manage your application for a tenancy or guarantor

• to deliver accommodation services to those who book with us

• to manage and administer accommodation bookings

• to communicate with you in relation to your accommodation and respond to your queries.  

• to manage accommodation payments (including where necessary to recover any unpaid sums due to us or the landlord)

For the above purposes we routinely rely on the lawful basis of performance of a contract (including necessary steps before entering into a contract).  

• Routine business operations and administration

• Developing and improving our service operations

• Internal management and reporting

• Surveys and analysis to gain insight into how we can improve our services

• To promote our services to business contacts (where permitted in certain jurisdictions without consent)

• To prevent and detect criminal activity, fraud or misuse of or damage to property.

• To handle personal details related to next of kin, or emergency contacts.

• For security purposes and the prevention and detection of crime e.g. CCTV

• To gather references, including credit checks.

For the above purposes we rely on the lawful basis of legitimate interests, where we have assessed this to be necessary for our business operations, and where we’ve also assessed such activity doesn’t negatively impact on your rights and freedoms.

• To send email marketing communications.

We collect consent to send promotional emails. You can opt-out at any time using the unsubscribe mechanism on our emails or by contacting gdpr@yugo.com.

• Where necessary, to assess specific accommodation needs, make sure accommodation we offer is suitable, and provide ongoing assistance. To do this you may provide us with health information and/or disability needs.

We either collect your explicit consent to handle health-related information, and may also rely on the public interests condition of supporting individuals with a particular disability or medical condition. 

Emergency situations - In exceptional and limited circumstance we may need to collect and share personal information to support people in an emergency. This would include sharing personal information with next of kin. We may also in emergency situations pass information to universities, or other agencies such as the police or emergency services. We may rely on the lawful basis of vital interests in such situations.

Our legal obligations - We may be required by law to collect, hold or share personal information. For example we may be ordered by a court of law to disclose information, and we are obliged to respond to any complaints.

Yugo does not sell personal information to third parties.

Who we share personal information with

Intra group

Yugo operates globally and, as such, has a number of subsidiary companies in various jurisdictions around the world. Your personal information may be shared amongst Yugo group companies, but only when this is necessary to do so to provide the services you have requested.

To make sure appropriate safeguard measures are in place to protect your personal information when shared in with different jurisdictions, we have an intra-group Data Transfer Agreement in place which incorporates EU Standard Contractual Clauses, with an Addendum for the UK and United Arab Emirates.

Service providers

Yugo uses service providers to support the efficient running of our business operations. Where necessary we will pass personal information to our service providers, or provide them with access to it. This will be limited to what is necessary to provide their services. They only handle this information on our behalf and under appropriate contractual terms. For example; our service providers deliver the following types of services

• Accounting

• Contractor services such as Security Guards and Cleaners

• Software Providers including our property management systems

• Referral partners

• Insurance such as Endsleigh

• Internet

• Credit and Sanction checks

Where this involves the transfer of personal data from the UK or EEA to a service provider based outside these regions, we endeavour to make sure appropriate safeguard measures are in place. Such measures include an EU/UK adequacy decision, EU Standard Contractual Clauses (SCCs) and the UK Addendum to EU SCCs.

We also ensure appropriate safeguards are in place for any transfer of data from the United Arab Emirates, or other jurisdictions.

Other organisations

Where necessary we will share personal information with other organisations such as universities and landlords.

Where necessary we will share your personal details with debt recovery, deposit protection and credit reference agencies who we may use in relation to our contract with you, or to take necessary steps before entering into a contract.

We may also share personal details where we have a legal obligation to do so, or believe there is an overriding justification for doing so. For example sharing personal information with the police to assist in crime prevention or detection.

We will also share personal information where this is necessary to do to protect or defend our legal rights or the rights of others. In the event of a sale or acquisition, our data assets would be shared with the third-party acquirer.

In the event that the landlord sells or buys any business or assets, for which Yugo are the data controller, in which case we may be required to disclose your personal data to the prospective seller or buyer, managing agent and solicitors of such business or assets.

How we keep personal data secure

Yugo makes sure any personal information you provide to us is securely stored on our systems and servers and that any paper-based records of your personal information will be stored and destroyed in accordance with our data retention policies and procedures. We treat data security with the utmost seriousness and take appropriate measures to implement industry-leading standards to protect your personal information.

Yugo further ensures that only relevant members of staff have access to your personal information. This is achieved by our Data Access Policy which provides that your personal information will only be available to relevant members of staff who have a legitimate reason for accessing your personal information.

How long we keep your personal information for

Yugo will keep your personal details for as long as is necessary for the reasons we are using them for. How long, varies depending on our relationship with you, and any legal obligations which may dictate the length of time your personal information is kept. We use the following criteria to establish retention periods, and then securely dispose of personal information when no longer required.

• A legal or statutory obligation to keep information for a minimum period of time.

• Sector specific good practice

• An assessment of our business necessity to keep personal details, balanced with people’s reasonable expectations.

• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations).

If you’d like to learn more about our retention periods, please contact us: gdpr@yugo.com.

Your privacy rights

You have a number of privacy rights, provided under UK and EU data protection legislation. These are listed below, along with our contact details, should you wish to make a request. If relevant, please also see the section: Privacy Information for US Residents.

• Right to be informed: You have the right to be informed about how we handle your personal information. This privacy notice is one of the ways we endeavour to fulfil this right.

• Right of Access: You have the right to ask for a copy of the personal data we hold about you and the purposes for which we are using it. ‘Personal data’ is any information which can directly, or indirectly, identify you.

• Right to Rectification: You have the right to ask us to change any details which are incorrect or need updating.

• Right of Erasure: You have the right to ask us to delete your personal details. Please note this not an absolute right, and there may be circumstances in which we can justifiably decline a request.

• Right to Object: You have the absolute right to object to receiving direct marketing from us. You also have the right to raise an objection about how we are handling your personal information in certain circumstances.

• Right of Restriction: This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

• Right to Portability: You have the right to obtain and reuse your personal information across different services. This right allows you to request that we move, copy or transfer your personal information easily from our systems to another organisation’s systems, or directly to you.

• Rights in relation to automated decision making and profiling: UK and EU data protection legislation contains rules aimed at protecting individuals where there is solely automated decision-making that has legal or similarly significant effects on them. We can confirm Yugo does not carry out this type of activity.

• Right to withdraw consent: Where you have provided your consent for us to use your personal data for a specific purpose or purposes, you can withdraw this consent at any time. This can be done either in writing or verbally. The lawfulness of our use of your information before consent was withdrawn is not affected.

If you’d like more information or would like to exercise any of the above rights, please email us at gdpr@yugo.com

Alternatively you can write to the relevant company in the Yugo Group. Please see the About us and how to contact us section of this privacy notice.

To fulfil certain requests and depending on our relationship with you, we may need to ask you for proof of identity. We’ll handle any requests as soon as possible, at least within one calendar month. In some circumstances we may need to extend the timescale for our responses to the right of access. Please also note our obligations to fulfil the above rights may be subject to certain exemptions.

If you’re concerned about the way in which we have collected and used your personal information, please contact us and we’ll do our utmost to resolve this with you. If you remain unhappy with how we have handled your personal information, you have the right to raise a complaint with an EU Data Protection Authority or the UK’s Information Commissioner’s Office.

Privacy information for US residents

This section covers certain US State Privacy Laws, and should be read in conjunction with the rest of this privacy notice.

What categories of personal information do we collect?

Please see below a list of categories of personal information, which indicates whether we have collected this type of information in the past twelve (12) months:

Identifiers - Examples: Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name.

Collected: YES

Protected classification characteristics under state or federal law - Examples: Race, sex, religion, age, disability, pregnancy, veteran status, genetic information, citizenship.

Collected:  YES

Commercial information - Examples: Transaction information, purchase history, financial details, and payment information

Collected: YES

Biometric information - Examples: Fingerprints and voiceprints

Collected: NO

Internet or other similar network activity - Examples: Browsing history, search history, online behaviour, interest data, and interactions with our and other websites, applications, systems, and advertisements

Collected: YES

Geolocation data - Examples: Device location

Collected: YES  

Sensory data: Examples: Images and audio, video or call recordings created in connection with our business activities

Collected: YES

Professional or employment-related information - Examples: Business contact details in order to provide you our services at a business level or job title, work history, and professional qualifications if you apply for a job with us

Collected: YES  

Education information - Examples: student records and directory information

Collected: YES

Inference data - Examples: Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics

Collected: YES

Sensitive personal information - Examples: Personally identifiable information (PII), financial information, trade secrets, and health insurance information

Collected: YES

Personal information as defined in the California Customer Records statute - Examples: Name, contact information, education, employment, employment history, and financial information

Collected: YES

We will use and retain the collected personal information as needed to provide our services for:

• A. Identifiers – e.g. online identifiers such as an IP address, as long as the user has consented to their personal data being processed by us

• F. Geolocation data - As long as the user has consented to their personal information being processed by us

How we use and share your personal information

Please see the following sections of this privacy notice for more detail:

How we use your personal information and Who we share your personal information with

CALIFORNIA RESIDENTS

California ‘Shine the Light’ Law

This law permits residents of the State of California to ask us to provide them with a list of the types of personal information (if any) we have disclosed during the preceding year to third parties for marketing purposes, and the identity of those third parties. If you’re a Californian resident and would like to request this, please contact us. Please include your name, contact details, address and any other identifiers which will help us locate your information. 

California Residents’ Rights

The California Consumer Privacy Act of 2018 (“CCPA”) and California Privacy Rights Act of 2020 (“CPRA”) give residents of California certain rights. This section will apply if are a “California Consumer” and you use our services.

Please also see other sections this privacy notice in relation to the personal information we collect about you, and who it is shared with and how long we retain it.

You have the right to request, twice during a twelve-month period, the following information we have collected about you during the past twelve months:

• the categories and specific personal information we have collected about you;

• the categories of sources from which we collected the personal information;

• the business or commercial purpose for which we collected or sold the personal information (if relevant)

• the categories of third parties with whom we shared the personal information;

• the categories of personal information that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose.

• the specific personal information we obtained from you in a format that is easily understandable, and to the extent technically feasible, in a commonly used, machine-readable format.

In accordance with applicable law, we are not obliged to provide or delete consumer information which is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Deletion - under certain circumstances you may have the right to ask us to delete your personal information. If you ask us to delete your personal information, we will take reasonable steps to respond to your request in accordance with applicable legal requirements. If the personal information is no longer needed for any purposes that justify its retention and we are no required by law to retain it, we will delete, destroy or permanently de-identify it.

Correction or restriction - You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights - we will not discriminate against you if you exercise your privacy rights.

Right to Limit Use and Disclosure of Sensitive Personal Information – this includes, but is not limited to; biometric data, health information, financial information, precise geolocation, racial or ethnic origin, citizen or immigration status, union membership, religious or philosophic beliefs, political beliefs, sexual orientation, information about your sex life and criminal convictions.

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g. phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

Other rights

• Right to Opt-out - You may request to opt out from future selling or sharing of your personal information to third parties (if relevant). Upon receiving an opt-out request, we will act upon the request as soon as feasibly possible, but no later than fifteen (15) days from the date of the request submission.

• Under 18s - If you are a resident of California and are under 18, and have provided personal information in connection with our services, you have the right to ask us to remove unwanted information you’ve publicly posted on our services. To make such a request, please contact us, and we will make sure, where relevant, this information is no longer publicly displayed.

How to exercise your rights

To exercise any of the above rights, you can contact us by email at gdpr@yugo.com, or by writing to us as Yugo (USA) LLC, 250 Fillmore Street, Suite 150, Denver, CO 80206

You may designate an agent to make requests to exercise your rights under CPRA as described above. We will take steps to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorised to make a request on your behalf through providing us with a signed written authorisation or a copy of a power of attorney.

COLORADO, UTAL, CONNECTICUT AND VIRGINIA RESIDENTS

The Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CDPA”), Virginia Consumer Data Protection Act (“VCDPA”) and Utah Consumer Privacy Act (“UCPA”) each provide certain rights respectively to residents of Colorado, Connecticut, Virginia and Utah. These rights will apply if you are a resident of the above states and use our services.

Please read the following in conjunction with the rest of this privacy notice. Some of the terms used below have the meanings given to them in respective privacy laws.

SPECIFIC PROCESSING ACTIVITIES

The right to opt out of the sale and/or processing of your personal data – you have the right to opt out of the sale of your personal data to a third party and/or the processing of your personal data for the targeted advertising and profiling.

If you would like to opt out, you may do so by contacting you can contact us by email at gdpr@yugo.com.

De-identified or pseudonymous data – In addition to the collection of personal information we process de-identified data. With regard to our processing of de-identified data, we take reasonable measures to ensure the de-identified data cannot be associated with a natural person and commit to maintain and use such de-identified data without attempting to re-identify the data, and we require all of our service providers and partners in receipt of such de-identified data from us treat the data in the same manner.

Right to Appeal: (Virginia & Connecticut Residents) - If we decline to take action regarding your request, we will inform you of our decision and reasoning behind it. If you wish to appeal our decision, please email us at gdpr@yugo.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal if denied, Virginia residents may contact the Attorney General to submit a complaint.

Right of Appeal (Colorado Residents) - If we decline to take action regarding your request and you wish to appeal our decision, please email us gdpr@yugo.com. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

You can contact us by email at gdpr@yugo.com, or by writing to us as Yugo (USA) LLC, 250 Fillmore Street, Suite 150, Denver, CO 80206