Website privacy policy
Last updated: 24/03/2026
Welcome to CampusConnect! Data protection and data security when using our website are very important to us. We would therefore like to inform you which of your personal data we collect when you visit our website and for what purposes it is used.
Please note, this policy must be agreed to in order to gain access to our service.
If you are using CampusConnect our iOS and Android mobile application (“App”) as directed by your admitting university representative, please refer to our App Policy.
What is CampusConnect
CampusConnect is a white labeled applicant onboarding service designed to help and support new university entrants. We do this by connecting where accessible, applicants (pre-enrolment) together with others who they will be studying with (fellow applicants), current students (ambassadors), recent graduates or alumni, and staff from your chosen university.
General information
This Privacy Policy describes our privacy practices in plain language, keeping legal and technical jargon to a minimum, to make sure you understand the information provided. However, to achieve this objective we would like to explain to you the following concepts.
a) What law applies?
Our use of your Personal Data is subject to Ireland’s Data Protection Act 2018 (“DPA”), the United Kingdom’s General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation 2016/679 (“GDPR”), and of course we process your Personal Data accordingly.
b) What is Personal Data?
Personal Data is any information relating to personal or material circumstances that relates to an identified or identifiable individual. This includes, for example, your name, date of birth, e-mail address, postal address, or telephone number as well as online identifiers such as your IP address and device ID.
c) What is Special Category Data?
Special category data is Personal Data that needs more protection because it is of a sensitive nature. This includes Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data. As well as, data concerning health, a person’s sex life; and a person’s sexual orientation.
d) What is processing?
Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means. The term is broad and covers virtually any handling of data.
e) Who is responsible for data processing?
The responsible party within the meaning of the DPA and GDPR is StudyBundles trading as CampusConnect of Unit 5, ManorHUB Business Hub, Park Road, Manorhamilton, County Leitrim, Ireland (“CampusConnect”
, “we”, “us”, or “our”). Please direct any questions you may have to support@campusconnect.ie or write to us at the above address.
f) The Legal Bases for processing Personal Data
In accordance with the above-mentioned laws, we have to have at least one of the following legal bases to process your Personal Data: a) you have given your consent, b) the data is necessary for the fulfillment of a contract
pre-contractual measures, c) the data is necessary for the fulfillment of a legal obligation, or d) the data is necessary to protect our legitimate interests, provided that your interests are not overridden.
g) The Legal Bases for processing Special Category Data
The requirements collecting special category data is far more stringent than those surrounding the collection of personal data. For the purposes of our operations we will rely on obtaining users explicit consent or that users provide said data knowingly and freely.
h) Data Retention
We process and store your Personal Data only for the period of time required to achieve the respective processing purpose or for as long as a legal retention period exists (in particular commercial and tax law in accordance with Ireland’s Commercial Law and Fiscal Law and others for up to 8 years). Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted.
Processing of automatically collected data
When you visit our website, we collect the Personal Data that your browser automatically transmits to our server. This is technically necessary for us to display our website and to ensure its stability and security. In this sense, we collect the following data: i) IP address of the requesting computer, ii) Date and time of access, iii) name and URL of the file accessed, iv) website from which the access was made (referrer URL), v) browser used and, if applicable, the operating system of your device as well as the name of your access provider. The legal basis is our legitimate interest.
Data we collect
a) Hosting
The hosting service used by us for the purpose of operating our website is Squarespace. In doing so DigitalOcean processes inventory data, contact data, content data, usage data, meta data and communication data of customers, interested parties and visitors of our website and services, on the basis of our legitimate interests.
b) Content Management System
We also use the Content Management System (CMS) of Squarespace to publish and maintain the created and edited content and texts on our website. This means that all content and texts submitted to us is transferred to Squarespace. This represents a legitimate interest.
c) Economic analyses and market research
For business reasons, we analyse the data we have on web and server traffic patterns, website interactions, browsing behaviour etc. The analyses serve us alone and are not disclosed externally and processed using anonymous analyses with summarised and or anonymized values. For this purpose we use Google Analytics and LinkedIn Insights. The legal basis is our legitimate interest and your consent. For further information, please refer to our Cookie Policy.
d) Fonts
We have integrated Google Fonts and the Fonts of Typekit by Adobe on our website. This means that when your browser connects to my website, Google’s and Adobe’s servers transmit the fonts back to your browser to display them properly. In that sense, Google and Adobe become aware of your i) IP address; and ii) other technical data related to your access. The integration is based on our legitimate interest.
e) YouTube Videos
We have integrated components from YouTube. The integration requires that YouTube can perceive the IP address of the user. The IP address is required in order to send the video content to the user’s browser. If you click on a YouTube component (video) on our website, your internet browser will be prompted by the component to download a corresponding representation of the component. In this way, YouTube knows which specific sub-pages you have visited. The legal basis for the data processing is our legitimate interest and your consent.
f) MailGun
We use MailGun, a service provided by MailGun Technologies, Inc., to send transactional and service-related emails, such as account verification, password resets, and user notifications. In order to deliver these emails, MailGun processes user email addresses and the relevant message content. MailGun operates servers located in the European Union (EU), and data is processed in accordance with GDPR requirements. The legal basis for processing is our legitimate interest in ensuring reliable communication and, where required, your consent.
g) Uploadcare
We use the service uploadcare, offered by Uploadcare, LLC for uploading, processing, storing and delivering files (e.g. photos) for our web applications. In order to provide the service, some information about users is collected. This concerns IP address, request
headers, uploaded data and data that is mediated to the API of uploadcare. The basis for processing is our legitimate interest and your consent.
h) MapBox
We use MapBox API, a service of MapBox Inc. We use MapBox to visually display geographical information. When using MapBox, MapBox also collects, processes and uses data about visitors’ use of the map functions. MapBox stores a cookie on your end device. This transfers information about your use of our website and app, including your IP address, to a MapBox server in the USA and stores it there. This data is processed for the purpose of displaying the website or ensuring the functionality of the MapBox service. MapBox may pass this information on to third parties if this is required by law or if the information is processed by third parties on behalf of MapBox. The basis for processing is our legitimate interest and your consent.
i) Providing our services
The protection of your data is particularly important to us in the performance of our services. We therefore only want to process as much Personal Data as is absolutely necessary. Nevertheless, we rely on the processing of certain Personal Data, to fulfil our contractual obligations to you or to carry out pre-contractual measures.
j) When registering for our events and workshops
If you wish to register for a specific event or workshop, we process the Personal Data you voluntarily provide for the purpose of registering you and administering the relevant event or workshop. Depending on the relevant event or workshop, you may provide contact information such as your full name and email address, company information, etc. The legal basis is both your consent and contract.
k) Community Ambassador
If you apply to become a Community Ambassador, we process the information we receive from you as part of the application process. This may include your contact information such as your full name and email address, University information, etc. Your data will initially be processed solely for the purpose of carrying out the application process. The legal basis for processing data during the application process is the initiation of a contract and, if you have given your consent, for example by sending us information that is not necessary for the application process, it is consent.
As a rule, we do not require any special categories of Personal Data for the application process. We ask you not to provide us with any such information from the outset. If such information is relevant to the application process, we process it together with your other data. Your data will not be used by us for automated decision-making or profiling, nor will it be passed on to third parties. Your data will be processed by us or on our behalf.
l) Administration
We process data in the context of administrative tasks as well as organisation of our business, and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services. The processing bases are our legal obligations and our legitimate interest.
m) Contacting Us
We offer you the opportunity to contact us using various methods. We collect the data you submit such as your name, email address, telephone number and your message in order to process your enquiry and respond to you. The legal basis is both your consent and contract.
General principles
a) What we do not do
● We do not request Personal Data from minors and children;
● We do not collect any information about criminal convictions and offences.
● We do not process special category data without obtaining prior specific consent;
● We do not use Automated decision-making including profiling; and
● We do not sell your Personal Data.
b) Sharing
We will not disclose or otherwise distribute your Personal Data to third parties unless this is a) necessary for the performance of our services, b) you have consented to the disclosure, c) or the disclosure of data is permitted by relevant legal provisions. In addition, we may disclose your Personal Data: in connection with law enforcement, fraud prevention or other legal proceedings; as required by law or regulation; if CampusConnect (or a part of CampusConnect) is sold to or merged with a company; or if we have reason to believe that disclosure is necessary to protect our business.
c) Storage
All Service Data collected is generally transferred to our DigitalOcean, LLC Server located in Ireland and in a MongoDB database. The legal basis for the data processing is our legitimate interest in providing our services.
d) Retention
Processed Personal Data will be deleted as soon as the purpose of the processing has been achieved and there are no longer any legally required retention obligations.
e) Data Security
Nonetheless, databases or data sets that include Personal Data may be breached inadvertently or through wrongful intrusion. Upon becoming aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised, and the notice will be accompanied by a description of the action being taken to reconcile any damage as a result of the data breach. Notices will be provided as expeditiously as possible after which the breach was discovered.
Data sharing
In certain cases, it is necessary to transmit the processed Personal Data in the course of data processing. In this respect, there are different recipient bodies and categories of recipients.
a) Internal
If necessary, we transfer your Personal Data within CampusConnect. Of course, we ensure that your data is processed properly. Access to your Personal Data is only granted to authorised employees who need access to the data due to their job, e.g., to provide our services or to contact you in case of queries.
b) External bodies
Personal Data is transferred to our service providers in the following instances:
● in the context of fulfilling our contract with you,
● to use marketing services and to advertise our services online,
● to communicate with you,
● to provide our website, and
● to state authorities and institutions as far as this is required or necessary.
c) International transfers
We may transfer your Personal Data to other companies as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements regarding such transfers. We take all reasonable technical and organisational measures to protect the Personal Data we transfer.
Data security
Our website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests that you send to us. We have also implemented numerous security measures (“technical and organisational measures”
) for example encryption or need to know access, to ensure the most complete protection of Personal Data processed through our website.
Nevertheless, internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed. And databases or data sets that include Personal Data may be breached inadvertently or through wrongful intrusion. Upon becoming aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised as expeditiously as possible after which the breach was discovered.
Advertising
We would like to show you interesting advertising outside of our website and use various third-party tools and cookies for this purpose. These collect and process information about your activities on our website, for example, which products you are interested in or which pages you visit. By knowing what you are looking for and how you use our website, we can adapt our advertising to your needs. And thus increase the likelihood that you will also be shown suitable and interesting advertising outside our website.
We also analyse this data to evaluate the relevance of the advertisements and to optimise the advertisements for you. Through the tools, your browser regularly establishes a connection to the server of the tool provider when you visit our website. For some tools, we have no direct influence on what data is processed by the providers. The following personal data may be processed by third-party providers i) HTTP header information (e.g., IP address, web browser, website URL, date and time); ii) measuring pixel-specific data (e.g., pixel ID and cookie ID); and iii) additional information about visits to our website (e.g., orders placed, products clicked on). The legal bases for processing are our legitimate interest and your consent in case of cookies.
Marketing
Insofar as you have given us your separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to.
You may give us your consent in a number of ways including by selecting a box on a form where we seek your permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. Where your consent is implied, it is on the basis that you would have a reasonable expectation of receiving a marketing communication based on your interactions or contractual relationship with us.
Direct Marketing generally takes the form of email but may also include other less traditional or emerging channels. These forms of contact will be managed by us, or by our contracted service providers. Every directly addressed marketing sent or made by us or on our behalf will include a means by which you may unsubscribe or opt out.
Cookies
Please see our cookies policy for information regarding our use of cookies and the data we collect through them.
Direct messages
Under particular circumstances CampusConnect reserves the right to access users’ direct messages. Said circumstances relate to expressions of self-harm and suicidal ideation made on the platform as well as actionable threats made by a user on a CampusConnect platform. Direct messages are not end to end encrypted.
Use of AI
As part of CampusConnect’s contractual obligations to our clients, we provide monthly reports regarding user activity trends. As part of this reporting we conduct a “chat topic analysis”
of all public group chat messages, this entails collecting from group chat messages from a given deployment and providing them to an AI service for analysis. (We use Google’s Gemini GPT model) By agreeing to this privacy policy you give us consent to use any messages you post in a group chat for these AI-based reporting purposes. Please note that direct messages are not used for any reporting purposes and can be presumed private, unless subject to the criteria above outlined in the paragraph concerning direct messages.
Your rights and privileges
a) Rights
You can exercise the following rights:
The right to access, You have the right to request Our Company for copies of your personal data.
The right to rectification, You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
The right to erasure, You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing, You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing, You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability, You have the right to request that Our Company transfer the data that we have collected to another organization, or directly to you, under certain conditions.
Right not to be subject to a decision based solely on automated processing, You have the right to object to being subject to any decisions made using information only obtained from automated methods.
If you wish to exercise any of your rights, please contact us.
b) Updating your information
If you believe that the information we hold about you is inaccurate or that we are no longer entitled to use it and want to request its rectification, deletion, or object to its processing, please do so by contacting us.
c) Withdrawing your consent
You can revoke consents you have given at any time by contacting us. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
d) Access Request
In the event that you wish to make a Data Subject Access Request, you may inform us in writing of the same. We will respond to requests regarding access and correction as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any Personal Data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the respective legal regulations mentioned above).
e) Complaint to a supervisory authority
You have the right to complain about our processing of Personal Data to a supervisory authority responsible for data protection. The Data Protection Commission (DPC) in Ireland is the relevant authority in matters of data protection (www.dataprotection.ie). Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact the DPC. However we ask that you contact us in the first instance so that we may attempt to rectify the situation ourselves.
Validity and questions
This Privacy Policy was last updated on 24th March 2026 and is the current and valid version. However, from time to time changes or a revision to this policy may be necessary.
If you feel that the above is not sufficient or if you have any queries as regards the collection, processing or use of your information we are looking forward to hearing from you. We will make every effort to reply as soon as possible and take into consideration any suggestions from your end.
Amendments
From time to time we will be updating our privacy policies to reflect developments and updates, please consider referring back to this policy in future to keep informed of any changes.
Preview copy: this is the website privacy policy published on campusconnect.ie on 24/03/2026. Before launch it will be updated to list this website’s own services, and checked by CampusConnect.
Annabel FallonHead of Digital Engagement, University of Staffordshire
