Host Privacy Notice

Home from Home Student Services Ltd (trading as London Homestays, UK Student Residences, London Study English)
Company no.: 07332845
Last updated: 3 September 2025

• We use and share your host profile so you can get bookings. We routinely share with students, schools and agents, including outside the UK.
• Pre-booking: we may share first name, profile code (e.g., LON-05703), postcode district (e.g., HA3), property description and photos (with identifying details removed), household overview (e.g., “host mother, retired teacher; lives with husband”), room/amenities (e.g., private bathroom, Wi-Fi), house rules (e.g., non-smoking; female students only), and nearest transport with approximate distance (e.g., “~15 minutes to Kingsbury station”). We do not share your surname, full address, door number, phone/email, DBS details, or any photo that reveals the exact location pre-booking.
• We don’t sell your data or allow unrelated third-party marketing.

Controller: Home from Home Student Services Ltd
Contact / DPO: Steve Horrigan — s dot horrigan at londonhomestays.com
Registered office address: 4 Glasshouse Studios, Fryern Court Road, Fordingbridge, Hampshire, England
Trading address: 124 Middleton Rd, Morden, SM4 6RW

• Identity and contact details; date of birth.
• Home & household details (property description/photos, area/postcode district, amenities, accessibility, household composition, pets, languages).
• Availability; booking and communications history.
• Compliance & payments (right-to-host checks; bank details for host payments).
• Portal/account data and logs (for security and support).
• DBS (criminal offence) data: we record outcome metadata only (certificate number, issue date, level, decision).
• We may also receive feedback or references about you from students, schools or agents and attach a short summary to your profile.
• If you give us information about household members, please share this notice with them.

We use your data for:

• Onboarding & assessment (handling enquiries, verifying details, home visits).
• Listing, matching & sharing to secure bookings (creating listings; sharing limited details with students, schools and agents worldwide).
• Booking administration & payments (confirmations, changes, cancellations, paying hosts).
• Safeguarding & compliance (maintaining standards; responding to regulators/accreditors).
• Security & fraud prevention (account security, misuse detection, audit logs).

Lawful bases: Contract (providing the hosting service and taking steps at your request) and Legitimate Interests (vetting, listing and sharing your profile to secure bookings). We may rely on Legal obligation for certain records (e.g., tax, safeguarding). We do not rely on blanket consent for core services.

Some information is required to enter into/perform your hosting contract; if not provided, we may be unable to onboard you.

We use limited profiling/filters (e.g., location, room type, rules) to help match hosts and students; decisions are not made solely by automated means that have legal or similarly significant effects.

• Students (and parents/guardians for minors).
• Educational institutions and international agents involved in bookings (usually as independent controllers of data they receive).
• Service providers acting under contract (e.g., IT hosting, CRM, messaging, payments).
• Accreditors/regulators/insurers where required by law or to establish, exercise or defend legal claims.

We routinely share limited host profile details with organisations and individuals outside the UK to secure bookings. Some of our service providers may also process data outside the UK; we use the same safeguards described here. Where possible we rely on UK adequacy regulations (e.g., EEA). Otherwise we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, supported by a Transfer Risk Assessment. Where information must be sent directly to an individual student overseas, we share the minimum necessary and rely on contract necessity; if another legal basis is needed, we will ask for your explicit consent for that specific transfer.

• Active host profile & booking records: duration of our relationship + 6 years (records and legal claims). (The clock resets on your last interaction.)
• Unsuccessful host applications: 12 months full application; then a minimal suppression record (name, contact, decision date and reason code) for 6 years (extendable to 10 years for safeguarding/serious conduct), with periodic reviews.
• Eligibility & performance notes (e.g., suitability flags; high-level positive/negative outcomes without detailed narrative): kept with your active profile and for 6 years after your last interaction (extendable to 10 years for safeguarding/serious conduct), with 2-year reviews.
• DBS outcome metadata: typically 6 months from decision or last check (longer only where documented for safeguarding).
• Financial records: 6 years for tax and audit.
• Photos used in listings: until withdrawn or the profile is removed; reviewed every 24 months.

We keep a minimal suppression record so we do not re-engage with applicants we have assessed as unsuitable. It contains only name, contact, decision date, a reason code and a review date; access is restricted and we review entries periodically. If you request erasure, we delete your full application but may keep the minimal suppression record (or a hashed identifier) where necessary to prevent re-onboarding in error and to establish, exercise or defend legal claims.

We process DBS outcome data under the Data Protection Act 2018 Schedule 1 (for example, safeguarding of children or individuals at risk) and keep an Appropriate Policy Document.

We protect your data using appropriate organisational and technical measures (role-based access, multi-factor authentication, encryption in transit/at rest, secure file-share, incident response with a 72-hour assessment path). Otherwise you agree that data such as your host profile, address and contact details may be sent via email. We may remove or blur identifying details from images (e.g., house numbers or plates).

You can request:

• Access
• Correction
• Deletion
• Restriction
• Data portability
• Objection (for non-essential uses)

We normally respond within one month (we may extend by up to two months for complex/volume requests) and may ask you to verify your identity. Requests are free of charge unless manifestly unfounded or excessive. If you object to the essential sharing above, we may be unable to offer hosting.

To exercise your rights or raise a concern, contact s dot horrigan at londonhomestays.com. We will acknowledge complaints and respond without undue delay. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

We will update this notice if our processing changes or the law requires it; significant changes will be communicated directly to hosts.