EU Privacy Policy

Privacy Policy for EU Products and Services- Spain
For Privacy Policy for U.S. Products and Service, click here.

PRIVACY POLICY

This Privacy Policy was last updated: October, 2018.

This Privacy Policy applies to the resa.es website operated by the company Residencias de Estudiantes, S.L. (referred to herein as RESA), part of the Greystar group of companies and their subsidiaries (referred to herein as “Greystar”, “we”, “us”, or “our”) This Privacy Policy applies to information, products and services provided by Resa in Spain.

Greystar recognizes the importance of protecting the privacy of individual-specific information (“Personal Information”) collected from and about our website users (referred to as “you” or “your” in this “Privacy Policy”). This Privacy Policy describes what Personal Information we gather, how we use it and how you can correct, change and limit our use of it. It is our intention to give you as much control over your Personal Information as possible to preserve your privacy, while still allowing us to utilize that Personal Information to provide you a valuable service and hopefully to have you as a resident of one of our residence halls.

In some instances, and in particular, if you are asked to submit registration data details through this site, you may be requested to agree to additional terms regarding our use of your Personal Information, and those additional terms will apply in that context. Any additional terms will be provided for your review at the time of registration.
We encourage you to read this Privacy Policy and our website Terms of Use before you send or share Personal Information with us or use our website and to read them again when you return to it.

WHAT PERSONAL INFORMATION DOES GREYSTAR-RESA COLLECT?

We collect Personal Information from our website in order to provide you with information on the Greystar-RESA products and services you have expressed an interest in to provide you with information on other similar Greystar products and services we believe will be of interest to you and to better understand how we can help prospective residents (hereafter, “User”) Please see the section “RGPD Information” below.

The type of Personal Information we collect will depend upon what we will need to provide you with the particular product or service you are interested in. In the case of prospective residents, the information requested on our registration form includes, among others, some or all of the following Personal Information: name and address, age or date of birth, email address, occupation/studies, telephone number, educational background and national identity card/Passport/NIE and university/institute/academic center where you plan to study. Those interested in becoming residents will be asked to include most of the following further information: the kind of service you are requesting, the apartment/ studio size you are looking for, where you want to live, if you want to share a room with another person, etc.

Our residential establishments managed by RESA use this web site for the processing of accommodation applications and accommodation agreements and also to assist our residents with other tasks which are required or helpful to them, such as paying online the reservation (booking) fee or the bond. Please read and review this “Privacy Policy” before using this website or if you are interested in reserving a room in any of our residences and contract de accommodation and other optional services. See also the Section Third-Party Site Links below.

USAGE TRACKING: USE OF IP ADDRESSES

An IP address is a number that is automatically assigned to your computer whenever you are surfing the Internet. Web servers, the main computers that serve up web pages, automatically identify your computer by its IP address. As permitted under applicable law, Greystar and RESA collects IP addresses for the purposes of system administration, gathering and analyzing aggregated information, creating a better experience for users and auditing the use of our site.

We do not normally link IP addresses to anything personally identifiable, which means that your session will be logged, but you remain anonymous to us. We will seek to link your IP address when we feel it is necessary to protect this site and other users from harm and to prevent criminal misconduct.

USE OF “COOKIES”

Please see the Cookie Policy available on the Resa website.

WHAT INFORMATION DO WE SHARE OR DISCLOSE?

As a general rule, Greystar-RESA will not disclose Personal Information except when we have your permission or under special circumstances, such as when we believe, in good faith, that the law requires our disclosure. We may also disclose Personal Information for some business operations as described below.

We do not commercialize or share your Personal Information with third parties, unless:

• Such information is shared and/or commercialized following receipt of a specific request and/or permission from users;
• Such information is shared with affiliated companies and/or potential investors (in any form of business transaction, including purchase or merger) pursuant to an specific agreement which contains reasonable confidentiality arrangements;
• Such information is shared with contractors who work with us pursuant to an agreement which contains reasonable confidentiality arrangements;
• Such information is shared in order to comply with or in accordance with any applicable law and/or court orders and/or in order to prevent suspected illegal acts, frauds, situations involving potential threats to the safety of any person, or as otherwise required by law. This includes responding to lawful requests by public authorities, including to meet national security or law enforcement requirements;
• Such information is shared in order to help Greystar defend against claims and/or establish or exercise any legal right that Greystar may have;
• Such information could be shared in order to help Greystar-RESA prevent violations of the Greystar-RESA Terms of Use and this Privacy Policy or to otherwise protect the rights, property, or safety of Greystar-RESA employees, residents/customers and other persons others, including exchanging information with third parties for fraud protection.

Greystar may be liable to you for any transfer of your Personal Information by Greystar in violation of applicable laws.

BUSINESS TRANSITIONS

In the event that Greystar goes through a business transition, such as a merger, being acquired by another company, or selling all or part of its assets, users’ Personal Information will, in most instances, be part of the assets transferred. By using this website and providing your Personal Information, you consent to this transfer, provided use of the Personal Information will remain in accordance with the Privacy Policy in place at the time of the transfer.

THIRD-PARTY SITE LINKS

You should be aware that when you are on the Greystar website you could be directed to other third party sites that are beyond our control. There are links to other sites from Greystar -RESA, which take you outside our service. For example, if you “click” on a banner, an advertisement or a search result, the “click” may take you off the Greystar-RESA web site. These other web sites may include sites of other advertisers, sponsors and partners that may use their logo with ours as part of a co-branding agreement.

These other sites may send their own cookies to visitors to collect data or solicit information. Greystar does not control these sites and therefore is not responsible for their content. The inclusion of hyperlinks to any other sites by Greystar-RESA does not imply any endorsement of the material on such sites, nor any association with their operators.

Greystar policies do not extend to anything that is inherent in the operation of the Internet, which is beyond our control. Remember that whenever you give out Information online, that information may be collected and used by people you do not know.

SECURING INFORMATION

Greystar takes reasonable technical and organizational measures in accordance with applicable laws to safeguard users’ Personal Information. While Greystar strives to protect your Personal information and therein your privacy, we cannot guarantee the security of any Personal Information you disclose online and you therefore disclose such Personal Information at your own risk.

We limit access to Personal Information only to employees who we believe reasonably need to receive such information to provide or manage our services or in order to do their jobs, and we take the precautions we deem reasonable to protect the security of users’ Personal Information. We also work very hard to ensure that our employees are aware of the sensitivity of the data send by the users and submitted to us and that they handle it with extreme care, being careful not to allow any improper access by third parties. However, as in many computer systems, internet applications and software programs, unauthorized use, failure of hardware or software, etc. may be injurious to the confidentiality of users’ Personal Information.
If users have any questions about Security, please contact us using the information in the “Contact Information” section below.

ENCRYPTION

Because the security of all Personal Information associated with our users is of utmost concern to us, we periodically review and improve our Security and this Privacy Policy as necessary when new technology becomes available. This includes use of software which encrypts (generally processed at 256 bits) or distorts data submitted to us.

EMAIL CONSENT AND OPT-OUT

Your provision of Personal Information on a registration form in the course of our providing a product or service to you constitutes your affirmative consent that we may contact you by email to provide you with information and notices relating to the residence hall where you reside, on various similar services available to you at or through that residence hall and on various other residence halls that may be available and of interest to you in the future. It also means we may email you regarding updates to this Privacy Policy. We notify you of this at the time you choose to register, and we will provide you the option not to receive further marketing communications from us at the time you register. If we do not provide products and services to you and you are interested in receiving information, you may fill in a new registration form and request that we provide you with commercial information.

You may choose to opt out of receiving future commercial email messages from us as a result of your registrations with us. Each mass commercial email sent by us contains a link with instructions on how to remove yourself from our email list. Please see the section on Third-Party Site Links.

CHILDREN’S PRIVACY

We do not collect or maintain information at our site from those we know are under 16 unless such information is provided by their parents or guardian, and we do not permit children under 16 years of age to become registered users of our site. No part of our site is structured to attract anyone under 16. By using our site, you represent that you are not under 16 years of age. If you are a parent or guardian and you believe that your child under age 16 may have provided personally identifiable information through the Website, please contact us using the information in the “Contact Information” section.

DATA TRANSFERS

Please be aware that if you provide Personal Information to us, it may be transferred to and processed on computers in the U.S. and other countries which are not in the EEA. Please do not provide your Personal Information to us if you do not want this information to be transferred outside of your country, or if the laws in your country restrict these types of transfers.
We mainly transfer your Personal Information to our affiliate in the United States, Greystar Real Estate Partners. Greystar Real Estate Partners (“Greystar US”) complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S.

Department of Commerce (“Privacy Shield”) regarding the collection, use, and retention of personal information from European Union member countries. Greystar US has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov/.

In compliance with the EU-U.S. Privacy Shield Principles, Greystar US commits to resolve complaints about your privacy and our collection or use of your Personal Information. European Union residents with inquiries or complaints regarding this Privacy Policy should first contact Greystar. Please use the details in the Contact Information section to do so.
Greystar US has further committed to refer unresolved privacy complaints under the EU-U.S. Privacy Shield Principles to BBB EU PRIVACY SHIELD, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers/ for more information and to file a complaint.

Greystar has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) with regard to unresolved Privacy Shield complaints concerning human resources data transferred from the EU in the context of the employment relationship.
Please note if your EU originating complaint concerning Greystar US is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel.
Greystar US is subject to the Federal Trade Commission in respect of its compliance with the Privacy Shield.

CORRECTING AND DEACTIVATING PERSONAL INFORMATION

You have the right, freely and at reasonable intervals, to request that Greystar inform you as to whether Personal Information relating to you is being processed. You have the right to request that Greystar correct, supplement, delete or block your Personal Information in the event that the data are factually inaccurate, incomplete or irrelevant to the purposes of the processing activities or if the Personal Information is being processed in any other way which infringes a legal provision. If you wish to exercise your rights or if you have any questions or suggestions regarding the use, collection, or security of your Personal Information, please contact us using the contact details in the “Contact Information” section.

When a request for user deletion is received, we will make all reasonable efforts to purge that data from our systems. Due to the nature of our service, some information may not be fully removed due to backups or archived copies; however, such information will only be used for the purpose of performing a contract that the user has entered into with us.

NOTIFICATION OF CHANGES

If we decide to change our Privacy Policy, we will advise users of those changes through a general description at the top of this Privacy Policy and may also post these details to other places we deem appropriate so our users are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. We may also email you.

CONTACT INFORMATION

If a user’s Personal Information changes (such as zip/postal code, phone, email or postal address), or if a user no longer desires to be registered with this site, we provide a way to correct, update or delete/deactivate users’ Personal Information. This can usually be done at the Registered User account settings page or by emailing privacy@greystar.com.
You may use this email to get in touch with us for any other reason relating to this Privacy Policy. If you send us an e-mail, our communication should clearly be marked as a data protection query and as being time sensitive.

You may also contact us at RESA, Paseo de Recoletos nº6 5º 1ª2º, 28001 Madrid. If you contact us by mail, your communication should clearly be marked as a data protection query.

GDPR INFORMATION

In accordance with the provisions of the General Data Protection Regulation EU 2016/679 (hereinafter, “RGPD”), Greystar and RESA inform Users about the following aspects relating to the processing of the personal data collected on this website. This section of the Privacy Policy constitutes a Notice to you as a data subject for purposes of the RGPD and describes our processing of your personal data (as defined in the RGDP).

A. Responsible for the processing of personal data:
RESA informs Users that the Company “Residencias de Estudiantes S.L.”, (hereinafter, RESA), with registered address at Paseo de Recoletos nº6 5º 1ª2º, 28001 Madrid (Spain), with Tax ID number B-60109188, and e-mail address privacy@greystar.com, will be responsible for the data collected on this page.

B. Purposes of the collection of personal data
RESA and Greystar processes the data collected on this website for the following purposes:
– The data collected through the forms found on the website will be used to manage the success of the request made through the form itself. Specifically:
– The data coming from the contact form will be used to manage the queries that the Users have sent through this form.
– The data coming from the “Visit Us” form will be used to manage the visit with the Residence in which the User is interested.
– The data coming from the “Suggestions” form will be used to manage the comments or suggestions that the Users have sent through this form.
-The data collected through the chat will be used to manage the queries that the Users submit through the chat.
– The data collected through the booking process will be used to manage the booking as well as the admission process in the selected residence and the contractual process.
Also, in the event that the User consents to the processing of their data for commercial purposes (through the boxes provided for this purpose in the booking process and forms), the data provided will be used to send the User commercial information and offers of RESA-Greystar products and services.

The personal data provided will be retained:

– Personal data provided solely for the purpose of handling a query via a contact/suggestion form or chat will be kept for a period of one month, unless legally required to retain the information for a longer period.
– Personal data provided for commercial purposes will be retained as long as no request for deletion is made by the data subject consistent with Greystar’s Data Retention Policy.
– The personal data provided to manage the reservation of accommodation will be kept as long as the business relationship is maintained and, once it is completed, as long as possible legal actions related to the reservation can be derived.
– The data provided to manage the visit to the residence hall will be kept as long as the visit is being managed and as long as possible legal actions related to the visit can be derived.

C. Legal basis for the processing of personal data

The legal basis on which RESA relies for the processing of the data to carry out the management of the reservation is the execution of the accommodation contract. The same legitimate basis applies to the transfer of data that RESA carries out to manage the User’s admission to the chosen residence.

In the case of other uses, RESA will rely on the consent given by the User through checking the boxes that appear on the forms, together with the action of validating and sending the form. In this respect, RESA notes that in order to carry out the aforementioned treatments, it is only necessary to fill in the fields marked as obligatory.
Likewise, in order to send the form, RESA informs the User that it will not be necessary to tick the boxes for accepting the sending of commercial communications and the transfer of data for commercial purposes, so that the refusal to tick these boxes will not impede the purpose of the form.

In this sense, RESA relies on the consent to transfer the User’s data to the company that manages the accommodation selected in this form. Likewise, the User’s consent is also required for the sending of commercial communications.

D. Recipients of personal data

In accordance with what is mentioned in the previous section, RESA will transfer the data to the residence in which the User has chosen to stay in the event of completing the booking process. On the other hand, if the User consents to this in the form filled in, RESA will transfer the data to the entities of the Resa-Greystar Group for commercial purposes. You can consult the list of affiliated entities at the following URL: https://www.resa.es/es/aviso-legal/

The processing of personal data may include the international transfer of data to countries outside the EU. As required by law, we will only make such transfers to countries or organizations that provide an adequate level of protection for personal data. The transfer of this data will not affect your rights or our obligations under the RGPD, as our international data transfers are covered by the Privacy Shield.

E. Rights

By virtue of the RGPD, RESA and Greystar informs Users that they have rights in relation to the processing of their personal data, including the right to portability, access, rectification, suppression or limitation of the data. RESA also informs about the User’s right to lodge a complaint with a data protection authority.
The User can exercise the aforementioned rights by contacting RESA through privacy@greystar.com.

ACCEPTANCE OF THESE TERMS

By using this site, or providing information to us, you acknowledge your awareness of the terms of this Privacy Policy. If you are not happy with its terms or any amended terms that are made in accordance with this Privacy Policy, you are not authorized by Greystar to use this site.