RoomLine
Privacy notice
What Roomline does with personal information when you visit this website, get in touch, or work for one of our customers: why we are allowed to, who else sees it, how long we keep it, and what you can ask us to do.
Last updated 10 October 2026
1. Who we are
RoomLine is operations software for purpose-built student accommodation (PBSA) operators. It is run by:
Roomline556 Holloway Road
London N7 6JP
United Kingdom
For the information described in sections 3 and 4, Roomline is the data controller: we decide what is collected and why, and we are the ones answerable for it.
To ask anything about this notice, or to use any of the rights in section 7, email tsr@roomline.co.uk. We answer data protection requests within one month.
2. If you are a student or resident
Accommodation providers use RoomLine to run their buildings: enquiries, bookings, tenancy agreements, rent, the front desk and the resident portal. When they do, the accommodation provider is the data controller for your information, and Roomline is their processor. We handle it only on their instructions, under a written contract, and we never use it for our own purposes.
So if your question is about your booking, your tenancy, your payments or anything held about you as an applicant, resident, guarantor or visitor, the right people to ask are your accommodation provider. Their privacy notice explains what they hold and why, and it is linked from the forms, emails and portal pages they send you. If you write to us instead, we will pass your request to them straight away and tell you we have.
3. What we collect, and why we are allowed to
We only hold information for a reason, and every reason has a legal basis behind it. This is the whole picture for what Roomline controls.
| What | Why we hold it, and our legal basis |
|---|---|
| Visiting this website: your IP address, browser, the page asked for and when | Every web server records requests like these. Our host uses them to deliver the pages and to protect the site against abuse. We do not use them to profile you. Legitimate interests. |
| Getting in touch: your name, email address, organisation, job title and whatever you tell us | To answer you, arrange a demo and discuss whether RoomLine fits your buildings. Legitimate interests in responding to a business enquiry, or steps before entering a contract if you are asking to become a customer. |
| Customer contacts: the names, work email addresses and phone numbers of the people at an accommodation provider we deal with, plus our contracts, invoices and correspondence with them | To provide the service, support it, bill for it and tell customers about changes that affect them. Performance of a contract with your organisation, legitimate interests in running that relationship, and legal obligation for accounting records. |
| Staff sign-in accounts: your name, work email address, role and sign-in history | Your employer decides who has an account and what it can see, and holds the workspace's records, so for those it is the controller and we are its processor (section 2). We use your contact details ourselves only to keep the service running and secure, for example to tell you about planned maintenance or a security issue. Legitimate interests. |
| Emails between us | So both sides can see what was actually said, which matters if there is ever a disagreement. Legitimate interests, or performance of a contract where you are a customer. |
We do not buy contact lists, and we do not make any decision about you by automated means alone.
Email from us
We only email you about RoomLine if you contacted us, or if you work for a customer and the email is about the service. If you tell us to stop, we stop, and we keep a short note that you asked, so that we do not start again by mistake. Emails about the service itself, such as maintenance, security notices and changes to terms, are part of providing it to your organisation and cannot be switched off while it is a customer.
4. Cookies and browser storage
The public pages of this website set no cookies and carry no analytics, advertising or social media trackers. Their fonts and images are served from this website itself, so loading a page does not send your details to anyone else. That is why there is no cookie banner.
The sign-in page and the RoomLine workspace use only the browser storage needed to keep you signed in and to remember your screen preferences. That storage is strictly necessary for a service you have asked to use, so it does not need consent. Those pages also load fonts from Google Fonts and software libraries from jsDelivr. Like any website a browser fetches something from, those services receive your IP address. They do not receive anything you type into RoomLine.
5. Who we share it with
We do not sell personal information, and we do not share it for anyone else's marketing.
The companies below are our processors. They handle information only on our instructions and under a written contract. Where they process data outside the UK, it is covered by an international data transfer agreement.
| Who | What they do, and where |
|---|---|
| Netlify | Hosts this website and the RoomLine pages, so it sees page requests and IP addresses. USA. |
| Supabase | Hosts the RoomLine database, files and sign-ins for each customer's workspace. Stored in Ireland. |
| Resend | Sends and receives the email that RoomLine workspaces send. EU sending region, with main processing in the USA. |
| Stripe | Takes the payments that residents make to their accommodation provider through RoomLine. USA, with EU processing. For fraud checks and anti-money-laundering, Stripe acts as a controller in its own right. |
| Our email provider | Holds the mailbox that receives messages sent to us. |
We also share information where the law requires it, and with professional advisers such as accountants and lawyers, who owe us a duty of confidentiality.
6. How long we keep it
We do not keep anything indefinitely. These are the periods we work to:
| What | How long |
|---|---|
| Website request logs | Held by our host for a limited period for security and operation, then deleted. We do not copy them anywhere else |
| Enquiries that did not lead to a contract | 2 years from our last contact |
| Customer contracts and related correspondence | 6 years after the contract ends, the period in which a claim about it could still be brought |
| Invoices and accounting records | 6 years, because we are required to keep them |
| Staff sign-in accounts | Until your employer removes the account or stops using RoomLine. After that, what happens to the workspace's records is your employer's decision as controller |
| A note that you asked us not to email you | Kept, so that we do not contact you again by mistake |
7. Your rights
These rights are yours under UK data protection law. They are free to use, and using them will never affect how we treat you.
- See what we hold. Ask for a copy of your information, and we will send you everything we have about you.
- Correct it. If something is wrong, tell us and we will fix it.
- Have it deleted. We will delete what we can. Where we are required to keep something, such as an invoice, we will tell you exactly what was kept and why.
- Restrict what we do with it. If you are disputing something, you can ask us to hold everything still while it is sorted out.
- Take it with you. Ask for the information you gave us in a machine-readable file.
- Object. You can object to us using your information for our legitimate interests, and you can tell us to stop emailing you at any time.
- Withdraw consent. Where we relied on your consent, you can take it back, and doing so is no harder than giving it was.
Email tsr@roomline.co.uk. We may ask you to confirm who you are first. That step stops somebody else getting your information. We will respond within one month. If a request is genuinely complicated we may take up to two months more, and if so we will tell you within the first month, and why.
If your request is about information held in an accommodation provider's workspace, we will pass it to them, as section 2 explains, and help them answer it.
8. Security
Each customer's RoomLine workspace runs on its own deployment and its own database, not one shared with other customers. Access is checked by the database on every read and write, not just hidden in the screen, so staff see only what their role allows. Information is encrypted in transit and at rest. Passwords are stored hashed and cannot be read by anyone, including us.
9. If you are unhappy
Tell us first, at tsr@roomline.co.uk, and we will try to put it right.
You also have the right to complain directly to the Information Commissioner's Office, which regulates data protection in the UK, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, though we would rather you did.
10. Changes to this notice
When this notice changes, the date at the top changes with it. If a change affects how we use information we already hold, we will tell the people affected before it takes effect.