Privacy Policy – HostsRooms Limited
1. Introduction
HostsRooms Limited (hereinafter referred to as “HostsRooms”, “we”, “us”, “our”) respects
your privacy and is committed to protecting your personal data. This Privacy Policy
explains how we collect, use, store, share, and protect your information when you use our
platform, including the website internationalstudents.ie and any related services.
HostsRooms is a company registered in Ireland under company number 800998, with a
registered address at [INSERT REGISTERED ADDRESS].
We act as a Data Controller or Data Processor depending on the context of the processing,
as further described in this Policy.
Our designated Data Protection Officer (DPO) is Geraldine Vahey, who can be contacted at
dataprotection@HostsRooms.com
This Privacy Policy outlines our approach to compliance with the General Data Protection
Regulation (GDPR) and all applicable Irish and EU data protection laws.
2. Your Data Protection Rights
Under GDPR, you have the right to:
• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure of your data
• Restrict processing
• Object to processing
• Object to direct marketing
• Request data portability
• Be informed about automated decision-making
• Withdraw consent at any time (where processing is based on consent)
We may request proof of identity before fulfilling your request to ensure your data is
protected.
We aim to respond to all legitimate requests within one month in accordance with GDPR
requirements, though complex requests may take longer.
Right to Lodge a Complaint
If you are unhappy with how we process your data, you may contact our DPO.
You also have the right to lodge a complaint with the Data Protection Commission (DPC):
Data Protection Commission
Canal House, Station Road, Portarlington, Co. Laois, R32 AP23
Telephone: +353 (0761) 104 800
Email: info@dataprotection.ie
3. How we collect your data
We collect personal data when you:
• Register an account
• Create or update your profile
• Submit documents for verification
• Subscribe to newsletters or communications
• Submit queries via contact forms or email
• Upload photographs or listing materials
• Participate in surveys
• Use the platform as a host, course provider, or guest
We also collect:
• Technical data (IP address, browser type, device information)
• Statistical data (e.g., nationality, gender) — anonymised where possible
• Information from third parties (e.g., identity verification providers, payment
processors)
You may browse our website without registering.
We only collect data that is adequate, relevant, and limited to what is necessary (data
minimisation principle)
4. What data we collect
We may collect:
• Name
• Email address
• Telephone number
• Work or home address
• Employment and education details
• Family or emergency contact details
• Business and operational information
• VAT numbers and billing information (for tax compliance only)
• Identity documents (passport, ID card, driver’s licence)
• Proof of address
• Proof of qualifications or certifications
• Visa or immigration documents
• Photographs uploaded by users
• Any other information you voluntarily provide
We do not knowingly collect personal data from children without appropriate consent.
We may also collect non-personal data, such as aggregated demographic statistics, which
cannot identify you.
5. Special Category Data
In limited cases, identity documents may reveal sensitive information (e.g., ethnicity).
Where special category data is processed, we will:
• Request only the minimum necessary
• Obtain your explicit consent unless processing is legally required
• Allow you to withdraw consent at any time
• Retain such data only as long as necessary
• Process such data in accordance with Article 9 GDPR.
6. How we use your data
We process your data only when we have a lawful basis:
6.1 Contract
To enter or perform a contract with you, including:
• Creating and managing bookings
• Facilitating communication
• Providing platform services
6.2 Legal Obligations
To comply with laws, such as:
• Tax requirements
• Identity verification
• Fraud prevention
• Safety and compliance checks
6.3 Legitimate Interests
For purposes such as:
• Platform security
• Service improvement
• Administrative efficiency
• Preventing misuse or fraud
We carry out a balancing test to ensure our interests do not override your fundamental
rights. We ensure our interests do not override your rights.
6.4Consent
For activities such as:
• Marketing communications
• Optional surveys
• Processing certain sensitive documents
You may withdraw consent at any time.
Additional Purposes
We may also use your data to:
• Customise the website
• Respond to communications
• Maintain internal records
7. Photographs and Uploaded Media
Users may upload photographs for:
• Profiles
• Listings
• Promotional materials
These may be visible to other users and shared with trusted service providers as needed.
Users are responsible for ensuring they have the right to upload and share such content.
You may delete your photographs at any time unless retention is required for legal or
safety reasons.
8. Retention and Audit Trail
We retain personal data only as long as necessary for:
• Service delivery
• Legal and regulatory compliance
• Fraud prevention
• Dispute resolution
• Maintaining platform integrity
Certain records (e.g., audit logs, transaction histories) may be retained longer where
required.
Retention periods are determined based on legal, contractual, and operational
requirements.
If processing is based on consent, we retain data until you withdraw consent.
9. Document Collection and Sharing
We may request documents such as:
• Police clearance certificates
• Proof of address
• Identity documents
• Academic or professional qualifications
• Visa/immigration documents
Documents are shared only:
• With third parties identified to you
• For legitimate purposes (verification, compliance, contractual obligations)
• After you provide explicit consent where required.
• Or where another lawful basis applies
You may:
• Access your documents
• Request deletion
• Request details of third-party sharing
• Withdraw consent (without affecting prior lawful sharing)
10. Third-Party Service Providers
We may share your data with:
• Accountants
• Legal advisers
• IT and security providers
• Payment processors
• Administrative service providers
We conduct due diligence when appointing third-party processors.
All third-party processors:
• Act only on our instructions
• Are bound by confidentiality
• Must comply with GDPR
• Must implement appropriate security measures
We may also share data with:
• An Garda Síochána
• Government bodies
• Courts or tribunals
• Where required by law
Sale or Merger
If HostsRooms undergoes a sale, merger, or restructuring, your data may be transferred to
the new entity. You will be notified and may choose to discontinue using the service.
11. International Data Transfers
Your data may be transferred outside the EEA.
Where this occurs, we use safeguards such as:
• Transfers to countries with an adequacy decision
• Standard Contractual Clauses (SCCs)
• Transfers to organisations certified under the EU–US Data Privacy Framework (DPF)
Copies of relevant safeguards are available upon request.
12. Cookies
Our website uses cookies to enhance your experience.
Non-essential cookies are used only with your consent.
You may manage cookie preferences through your browser or our cookie settings panel.
Please refer to our separate Cookie Policy for full details.
13. Security
We take appropriate technical and organisational measures to protect your data,
including:
• Encryption
• Access controls
• Secure servers
• Authentication measures
• Anonymisation where appropriate
No internet transmission is 100% secure, but we take all reasonable steps to protect your
information.
14. Vetting and Police Clearance
For certain roles or academic use cases, HostsRooms may require proof of vetting or police
clearance.
HostsRooms does not conduct vetting directly; individuals or institutions are responsible
for obtaining clearance.
We collect only the minimum necessary documents and store them securely.
15. When HostsRooms acts as a Data Processor (DPA)
In some cases, HostsRooms processes data on behalf of hosts or course providers, such as:
• Managing booking information
• Facilitating communication
• Transmitting data needed to deliver services
These activities are governed by a Data Processing Agreement (DPA) with the relevant
data controller.
When acting as a processor, we:
• Follow documented instructions
• Apply appropriate security measures
• Assist with GDPR obligations
• Manage authorised sub-processors
• Delete or return data at the end of service
16. When HostsRooms acts as an Independent Data Controller
For activities such as:
• Identity verification
• Document checks
• Fraud prevention
• Platform safety and compliance
HostsRooms acts as an independent Data Controller.
These activities are not part of the DPA or Joint Controller Arrangement.
17. Joint Controller Arrangement (JCA)
For certain booking-related activities, HostsRooms and hosts/course providers act as Joint
Controllers under Article 26 GDPR. A summary of the Joint Controller Arrangement is
made available upon request, in accordance with Article 26 GDPR.
Jointly controlled activities include:
• Managing bookings
• Facilitating communication
• Sharing booking information
• Ensuring safety and service quality
• Meeting legal obligations
HostsRooms is responsible for:
• Collecting data during registration and booking
• Maintaining platform security
• Providing the primary privacy notice
Hosts/course providers are responsible for:
• Using data only for legitimate booking purposes
• Providing their own privacy information where required
• Managing their own communications
Exercising Your Rights
You may exercise your GDPR rights with either party.
Both parties cooperate to ensure timely responses.
18. Amendments to this Policy
We may update this Privacy Policy from time to time.
Significant changes will be clearly and transparently communicated on our website or by
email.
The most recent version will always be available online.
19. Contact Us
For questions about this Privacy Policy or your data rights, contact:
Data Protection Officer
HostsRooms
Email: dataprotection@HostsRooms.com
Approved by:
Geraldine Vahey
Name: Geraldine Vahey
Role/Title: Company Director
Date: 30/03/2026