Who we are
This Privacy Policy explains how Student Market Ltd ("Student Market", "we", "us", "our") collects and uses your personal data when you join our waitlist or visit our landing page at https://www.student-market.co.uk/.
For the purposes of UK data protection law — the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — Student Market Ltd is the data controller of the personal data described in this policy.
- Company: Student Market Ltd, a company registered in England and Wales (company number 17255913)
- Registered address: Orchardmains House, Coldharbour Lane, Hildenborough, TN11 9JX
- Contact for privacy queries: [email protected]
What this policy covers
This policy applies to our promotional website and the waitlist sign-up form on it. It does not cover the Student Market platform itself once it launches — we will publish a separate, fuller privacy notice for the live marketplace, and we will let waitlist subscribers know when it is available.
The personal data we collect
Information you give us
When you complete our waitlist form, we collect:
- Your email address — so we can contact you about the launch.
- Your university — so we know which campus you are interested in and can prioritise our rollout.
- The role you select ("I am a…") — to understand who is joining our waitlist (for example, whether you are a student, SU representative, or staff member).
- Your beta-testing preference — if you tick the box to be considered for our closed beta, we record that you have opted in.
Information we collect automatically
To keep the form secure and the website running, a limited amount of technical data is collected when you interact with the page:
- Security and anti-bot data. Our form is protected by Cloudflare Turnstile, which checks that submissions come from real people rather than automated bots. To do this, Turnstile processes technical signals such as your IP address, browser and device characteristics, and interaction patterns on the page. Turnstile does not use advertising or tracking cookies.
- Server and log data. Our website and infrastructure may automatically record standard technical information such as your IP address, browser type, and the date and time of your visit, for security, troubleshooting, and to keep the service available.
We do not ask for, and you should not submit, any special category data (such as health, ethnicity, or religious information) through this form.
Why we use your data, and our legal basis
Under UK GDPR we must have a lawful basis for using your personal data. The bases we rely on are:
| What we do | Why | Legal basis |
|---|---|---|
| Add you to the waitlist and email you about our launch, early access, and related updates | To deliver the service you signed up for | Consent — you give this by submitting the waitlist form |
| Record your university and selected role | To plan and prioritise our campus rollout and understand our audience | Consent — provided as part of your waitlist sign-up |
| Consider you for the closed beta | To invite the right people to early testing | Consent — given when you tick the beta box |
| Protect the form from spam and abuse (Cloudflare Turnstile), and keep the website secure and available | To run our site safely and prevent misuse | Legitimate interests — our interest in operating a secure, functioning service, balanced against your rights |
You can withdraw your consent at any time (see Your rights and Marketing emails below). Withdrawing consent does not affect anything we did before you withdrew it.
Marketing emails
If you join the waitlist, we will send you emails about Student Market — for example, launch announcements, early-access invitations, and beta updates. Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or by emailing us at [email protected]. We will not pass your details to other companies to market their own products to you.
Who we share your data with
We do not sell your personal data. We share it only with the service providers that help us run the waitlist, and only so they can perform their service for us. These providers act as our data processors under written agreements that require them to protect your data and use it only on our instructions.
- Brevo (Brevo SAS / Sendinblue) — our email marketing and form provider. Brevo stores the information you submit through the form and powers the emails we send you. Brevo acts as our data processor under a Data Processing Agreement. See Brevo's privacy policy at https://www.brevo.com/legal/privacypolicy/.
- Cloudflare — provides the Turnstile anti-bot protection on our form and helps deliver and secure our website. See Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
- Vercel — hosts our website.
We may also disclose personal data where we are required to do so by law, or to protect our legal rights.
International transfers
Some of our providers are based outside the UK:
- Brevo is based in the European Union. The UK government has determined that the EU provides an adequate level of data protection, so transfers to Brevo are covered by this adequacy.
- Cloudflare is based in the United States. Where data is transferred to the US, it is protected by appropriate safeguards, such as the UK extension to the EU–US Data Privacy Framework and/or the International Data Transfer Agreement (or Standard Contractual Clauses with the UK Addendum).
In each case, the transfer is subject to safeguards intended to give your data a level of protection essentially equivalent to that under UK law. You can ask us for more detail using the contact details above.
How long we keep your data
We will retain your waitlist data until our platform officially launches at your specific university, and for a maximum period of 12 months following that local launch. After this period, your data will be securely deleted or anonymized unless you choose to fully register an account with us. Of course, if you ask us to remove your data sooner (for example, by clicking the unsubscribe link in an email), we will delete it immediately. Security and server logs are kept only for a short period before being deleted or anonymised.
How we protect your data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes relying on reputable providers (such as Brevo and Cloudflare) that maintain their own security standards. No system is completely secure, but we take reasonable steps to keep your information safe.
Your rights
Under UK GDPR you have the right to:
- Be informed about how we use your data (this policy).
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict how we process your data in certain circumstances.
- Data portability — receive your data in a portable format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email us at [email protected]. We will respond within one month. There is normally no charge.
Cookies and similar technologies
Our landing page currently uses only essential/strictly necessary technologies — for example, those needed to keep the site secure and to run the Cloudflare Turnstile check on our form. Turnstile does not set advertising or tracking cookies. If we add analytics or other non-essential cookies in future, we will update this policy and ask for your consent first through a cookie banner.
Children
Our waitlist is intended for prospective and current university students aged 16 or over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date above, and where the changes are significant we will let waitlist subscribers know by email.
How to contact us or make a complaint
If you have any questions about this policy or how we handle your data, contact us at [email protected].
If you are not happy with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
We would, however, appreciate the chance to address your concerns first.