TSH Privacy Notice

Last updated: October 2023

This Privacy Notice (the “Notice”) is issued on behalf of the TSH group (“TSH”, “we”, “us” or “our”) and applies to all TSH Customers making use of TSH Services (the “Customer”, “you”, “your”).

This Notice is designed to fully inform you about our privacy practices including the collection of any information relating to an identified or identifiable natural person (“Personal Data”), how we use it and the rights that exist for you to fully be in control of it. TSH is acting as the controller and is therefore responsible for processing your Personal Data and determines the means and purposes of such processing. For the full list of TSH subsidiaries acting as data controllers, please see Annex 1 to this Notice.

We treat all your Personal Data with great care, and we always act in accordance with the applicable national and international data protection legislation including the EU General Data Protection Regulation (the “GDPR”), the UK Data Protection Act 2018 and the UK GDPR.

Please read the following carefully to understand how TSH uses and protects any information that you share with us when visiting a TSH website and/or using the products and services offered by TSH (collectively “Services” or “Service”). This Notice also provides you with information about your privacy rights and how to exercise them.

1. Third Party Links

The TSH websites and any online services hosted and supplied by TSH or by third parties on TSH’s behalf (“Websites”) contain hyperlinks to other unaffiliated websites that may have information policies and practices different from ours. We have no control over those websites, are not responsible for their privacy policies, practices or content, and this Notice does not apply to them.

2. What Personal Data do we collect and why?

The type of Personal Data that TSH collects and for what purposes depends on the type of Services you have signed up to and the location where the Services will be provided.

TSH may collect the following information:

• Personal Data that you provide to TSH when you use the Services, for example when you register, subscribe to a newsletter, event, deal, waiting list or fill out a form. This may include your name, gender, age, country of residence, email address, phone number and any other data that may be requested for the purpose of the form (online or offline).
• Personal Data that you include in your “My Account” on one of the Websites. This may include your name, surname, username (email address), contact details, preferences or any other data that may be requested to complete your My Account profile.
• Personal Data that you provide to TSH when you book with us to Stay, Eat or Work and when you apply to join us as a member of the TSH Community. Depending on the nature of the Services you are interested in, the Personal Data we collect from you may include your ID information, name, gender, age, country of residence, email address, credit card details, phone number, signature, dietary preferences, university registration details, and booking preferences.
• Furthermore, when you make a reservation as a Semester guest, you may provide us with the contact details of your parents and/or guarantor ensuring that they are aware that such Personal Data will be shared. Depending on the location you have booked to stay in as a semester guests’, additional Personal Data may also be required.
• Personal Data that you may provide when using the TSH bike sharing system (“XBike App”). When using the Xbike App, TSH will keep a record of where the bike is locked using the location of the bike lock, which will only be used if needing to retrieve a bike that has not been returned in accordance with the bike terms of use. All Personal Data will be automatically overridden once the bike has been returned in accordance with the bike terms of use and a new user unlocks the bike.
• Other information about your use of the Services not knowingly provided to TSH but collected via analytics functionality in the Services: general usage information, including recent browser history (as sent by your browser) and IP-addresses. Amongst other data, we process the following Personal Data from visitors to TSH Website: website visit and use, IP address, duration and time of visit to the website, use of social media.

Want to know more about how we handle cookies? Have a look at TSH Cookie statement.

3. What are our legal bases for processing your Personal Data

We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data in the following circumstances:

• To perform the contract, we are about to enter or have entered with you;
• When necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests;
• To comply with a legal obligation; or
• In limited circumstances, where we have your consent for the processing of your Personal Data.
  
  

4. Purposes of use of Personal Data

TSH requires this Personal Data to understand your needs and provide you with a better Service, and in particular for the following reasons:

• Processing your order/booking, including billing purposes, complying with legal obligations and allowing us to communicate with you regarding your booking. Regarding payment processing, we may use a payment token whereby your payment details are stored as a secure unique payment token enabling simplified payment processes for future payment transactions associated with your account.
• Enabling you to manage your order/booking and to use and request our Services via your MyAccount.
• Performing marketing activities regarding TSH in general. There are a number of activities associated with this purpose, such as: communicating about products and services that may be of interest to you, providing personalized advertisements for products and services on selected websites. We will only use the information submitted for marketing if you have provided consent for us to do so. You can unsubscribe from marketing e-mails at any time by clicking the unsubscribe link contained emails we are sending you.
• Improving TSH’s products and services (using surveys, online questionnaires & pilot testing).
• Meeting all legal and regulatory requirements applicable to TSH, or as otherwise required by law or regulation, or requested by competent authorities, or for the protection of persons or property, or to assist us in fraud prevention or investigation, or to enforce TSH policies.
• Participating in an acquisition, merger, restructuring, sale or other transfer involving all or any portion of TSH assets or business.
• Facilitating Legal and Financial Transactions: We may share your Personal Data with financial institutions that provide financing to TSH and associated law firms such as notaries to be compliant with obligations under such relevant financing agreements. These financial institutions and law firms are entitled to use this information only for the purpose of this financing and may not disclose, share, sell, or in other way process this information for other purposes
• After your TSH experience:

- After what we hope is only your first TSH experience we will continue to store your Personal Data in a profile that is strictly accessible by TSH. Should you return to TSH in the future, we want to be able to offer the best possible Services, including the ability to customize your stay based on your previous personal preferences. We will only do this to the extent that we believe we have a legitimate interest to do so which in every case will be to improve the service we can offer to you in the future across all our locations and Services.

- In the case of Semester Guests, you will be automatically enrolled into the TSH Alumni program and gain access to TSH Community perks and benefits. TSH is enthusiastic about staying in touch with our Semester Guests. You are part of an exciting, global network of people with inspiring ideas and we want to help keep that connection alive. You can of course always unsubscribe.

5. Who has access to your Personal Data?

We handle your Personal Data discretely. Access is strictly limited to TSH and our third-party partners on a need to know basis.

TSH Management B.V. and group affiliates:

We will share your Personal Data in certain circumstances with the other companies within TSH so that we can provide you with a high quality, personalized and tailored service (including relevant marketing) across our group. That includes sharing information between the companies listed in Annex 1.

Third Party Service Providers

We may also share your Personal Data with our partners that in many cases will be necessary to provide the products and services you have purchased or otherwise carry out activities we have identified serve a legitimate interest and may also be of interest to you.

These partners include:

• Professional service providers, such as marketing agencies, advertising partners and website hosts, who help us run our business.
• Professional mailing companies that deploy our email campaigns and satisfaction surveys.
• Operational partners who maintain and service the hotels (e.g., technical maintenance, housekeeping and night security etc.).
• Third party vendors who help us manage and maintain the TSH IT infrastructure (e.g., Internet Booking Engines, Reservations Systems, Internet Connectivity, Payment Service Providers and Customer Service Channels etc.).
• Where relevant, our professional advisors, such as legal and financial intermediaries, including certain financial institutions and professionals who facilitate legal transactions, which could encompass services provided by notaries or similar roles. Sharing data with these intermediaries is necessary to complete financial transactions, validate contracts, and ensure legal compliance. Our legal basis for sharing your data in these situations is our legitimate interest in ensuring that all financial transactions and contractual agreements are processed efficiently, securely, and in compliance with legal requirements.
• Third party partners such as university partners and corporate partners that provide us with your Personal Data to validate referrals and corporate bookings under partnership agreements.

If you use the services provided by another company to interact with us, such as a university partner or online travel agency, please be aware that your Personal Data is also subject to the privacy policies of these companies. If you would like to know more about the third parties, we may share personal data with, or how to find out more on how they will use your Personal Data, please contact us through the information provided below in the “How to contact us” section.

6. Your rights

We want to make sure that you are fully in control of your Personal Data. You have multiple rights, and we want to ensure they are respected. If you wish to exercise any of the rights listed above, please contact us through the information provided below in the “How to Contact us” section. Please state clearly in the subject heading the type of your request, including a detailed explanation of your request. This enables us to respond to your request as quickly as possible. Please confirm as a minimum:

• Type of Services you signed up for
• Location
• Dates
• Supporting evidence to help identify the correct profile (e.g. booking confirmation).

Your data subject requests will only be implemented after we have validated your identity. This can be achieved by sending the request from the same email address that was used when signing up to a TSH Service. If your identity is not clear, we are entitled to ask you to provide proof of your identity before we handle your request.

We will respond to your exercise of the request within one month, but have the right to extend this period with two months. If we extend the response period, we will let you know within one month from your request.

Access: You may ask us if we are processing your personal data and, if we are, you can request TSH to provide a copy of the Personal Data we hold about you. If your request is clearly unfounded or excessive, we reserve the right to charge a reasonable fee or refuse to comply in such circumstances.

Rectification: If you believe that the Personal Data that we process is incorrect, inaccurate or incomplete, you may ask us to correct the Personal Data.

Erasure (‘Right to be forgotten’): If you want us to remove your Personal Data, you can request us to erase your Personal Data. There are certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for performance of the contract, compliance with law or in connection with legal claims.

Restriction: You may request us to suspend the processing of certain types of your Personal Data, for example if you want to establish its accuracy or the reason for processing it.

Portability: If you want to transfer your Personal Data to you or to another party, you may request us to do so in a structured, commonly used, and machine-readable format (if technically feasible).

Object: If we process your Personal Data for direct marketing, you have the right to object, and we will stop using your Personal Data for that purpose. If we are processing your Personal Data based on our legitimate interest for other purposes than direct marketing, you may object to our processing on this ground. However, in those cases we may be entitled to continue processing your personal data based on our compelling legitimate interests.

Right to withdraw your consent at any time: Where you may have provided your consent to the processing of your Personal Data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing based on your consent before its withdrawal.

Right to lodge a complaint with a supervisory authority: You also have the right to lodge a complaint with a supervisory authority in the country of your residence where you work or where an alleged infringement of the applicable data protection law took place. A list of EU data protection authorities is available here. However, we would appreciate the chance to deal with your concerns before you approach a supervisory authority. Please do not hesitate to contact us in the first instance.

7. International Data Transfers

There are circumstances that require the transfer of your Personal Data outside the EU:

• We use technology service providers and cloud-based services located outside the EU for many of our business purposes. Therefore, it may be necessary that your Personal Data is transferred to servers located in countries outside the EU.

In case of transfers of Personal Data to countries outside the EU that are not recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision), we ensure appropriate safeguards are in place to guarantee the continued protection of your Personal Data, particularly by signing the Standard Contractual Clauses of the European Commission (article 46(2)(c) GDPR). For more information on these Standard Contractual Clauses, please see here.

In case of transfers of Personal Data to countries outside the United Kingdom, we ensure appropriate safeguards are in place to guarantee the continued protection of your Personal Data, particularly by signing the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, whichever is more appropriate in the given situation. For more information on UK Addendum and the UK International Data Transfer Agreement please see here. We may also guarantee the protection of your Personal Data by relying on adequacy decisions adopted or approved by the authorities in the United Kingdom.

8. How long do we keep your Personal Data

We do not process your Personal Data any longer than necessary for the purposes outlined in this Notice.

If Personal Data is subject to a statutory retention period, we will retain your personal data for the period specified by the law.

To determine the appropriate retention period for your Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the purposes for which we process your Personal Data, applicable legal requirements or operational retention needs, and whether we can achieve those purposes through other means.

Upon expiry of the applicable retention period, we will securely destroy your Personal Data in accordance with applicable laws and regulations. In some circumstances, instead of destroying your Personal Data, we may anonymize your Personal Data, which means that it can no longer be associated with you. We may use the anonymized data for statistical or analytical purposes.

9. Updates to this Notice

This Notice may be amended it from time to time. Therefore, you are encouraged to review it regularly. Check the date included at the top of this Notice to see whether this Notice has been updated, as your continued use of TSH Services following the posting of changes to the Notice signifies your continuing awareness of this Notice.

10. How to Contact us

IIf you have any questions about this Notice or how we process your Personal Data, please contact us at privacy@thesocialhub.co, or our Data Protection Officer at bonny.bleij@thesocialhub.co

Annex 1: Overview of TSH Controllers

In practice, the primary data controller will be TSH Management B.V. and the relevant local TSH entity engaged for the particular Service.

TSH Management B.V. is a limited liability company registered under the laws of the Netherlands with its statutory seat in Amsterdam, the Netherlands, and its office at Amsteldijk 166 (1079 LH) Amsterdam, PO Box 9082 (1006AB) Amsterdam, registered with the Dutch Chamber of Commerce under number 55241247. TSH Management B.V. is the legal entity that acts as the primary data controller for all TSH subsidiaries.