Privacy Policy
Last Updated: August 2026
1. Introduction
PBSAX ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website pbsax.com (the "Service").
PBSAX is a trading style of Mattison Capital Ltd, a private limited company registered in England and Wales (Company Number: 08952368), with its registered office at 7 Bell Yard, London, England, WC2A 2JR. PBSAX is a marketplace platform for Purpose-Built Student Accommodation (PBSA) in the United Kingdom. By using our Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information You Provide
We collect information that you provide directly to us, including:
- Account Information: Name, email address, phone number, company name, job title
- Property Information: Property details, addresses, postcodes, property specifications
- Contact Forms: Information submitted through contact, valuation, or inquiry forms
- Communications: Messages, inquiries, and other communications you send to us
2.2 Automatically Collected Information
When you visit our Service, we automatically collect certain information:
- Usage Data: Pages visited, time spent, links clicked, search queries
- Device Information: IP address, browser type, device type, operating system
- Location Data: General location information based on IP address
- Cookies: See our Cookie Policy section below
3. How We Use Your Information
We use the information we collect for the following purposes:
- To provide, maintain, and improve our Service
- To process and respond to your inquiries and requests
- To facilitate property listings and marketplace transactions
- To send you updates, newsletters, and marketing communications (with your consent)
- To analyze usage patterns and improve user experience
- To detect, prevent, and address technical issues and security threats
- To comply with legal obligations
3.1 Our Lawful Bases
UK GDPR requires us to have a lawful basis for each purpose for which we process your personal data. Ours are set out below.
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and running your account | Name, email, password, company, job title | Contract (Art. 6(1)(b)) |
| Responding to enquiries, valuation requests and listing submissions | Name, email, phone, company, message, property details | Contract, or legitimate interests in responding to business enquiries (Art. 6(1)(b), 6(1)(f)) |
| Marketing emails and newsletter | Name, email | Consent (Art. 6(1)(a)), withdrawable at any time |
| Analytics and site improvement | Usage data, device data, approximate location | Consent (Art. 6(1)(a)), via our cookie banner |
| Spam filtering, rate limiting and fraud prevention | IP address, user agent, submission metadata | Legitimate interests in protecting the Service (Art. 6(1)(f)) |
| AI assistant responses to your questions | The messages you send to the assistant | Contract, or legitimate interests in providing the feature (Art. 6(1)(b), 6(1)(f)) |
| Meeting legal, accounting and regulatory obligations | Transaction and correspondence records | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interest in operating and protecting the Service is not overridden by your rights. You can object to this processing at any time — see Section 6.
4. Information Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
4.1 Service Providers
We may share information with third-party service providers who perform services on our behalf, such as:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | EU / US |
| Vercel | Website hosting, edge delivery and server logs | US |
| Resend | Transactional and newsletter email delivery | US |
| Google Analytics | Website analytics (only with your consent) | US |
| Google reCAPTCHA | Spam and bot protection on our forms | US |
| OpenAI | Powers our AI assistant and content tooling | US |
| Google (Gemini API) | AI content generation and classification | US |
| Replicate | AI image generation for editorial content | US |
| Telegram | Internal operational alerts to our team | Outside UK |
| WordPress | Editorial and blog content management | US |
| Publer | Scheduling our own social media posts | Outside UK |
We do not send your account details or contact form submissions to our AI providers for model training. Messages you type into our AI assistant are sent to the provider in order to generate a reply — please do not enter confidential or special category information there.
4.2 Legal Requirements
We may disclose your information if required by law or in response to valid requests by public authorities.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
5. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.
We use industry-standard security measures including encryption, secure servers, and access controls.
6. Your Rights
Under UK GDPR and data protection laws, you have the following rights:
- Access: Request access to your personal information
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your personal information
- Restriction: Request restriction of processing
- Portability: Request transfer of your data
- Objection: Object to processing of your data
- Withdraw Consent: Withdraw consent for data processing
To exercise these rights, please contact us at [email protected]. We will respond within one month of receiving your request, as required by UK GDPR. We do not charge a fee for this.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you. If you are unhappy with how we have handled your data, you have the right to complain to the ICO (see Section 13).
7. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier.
We use cookies for:
- Essential functionality (authentication, preferences)
- Analytics (Google Analytics)
- Performance monitoring
Analytics cookies are only set if you accept them via our cookie banner. You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page. Strictly necessary cookies, such as those that keep you signed in, do not require consent.
You can also instruct your browser to refuse cookies. However, if you do not accept cookies, you may not be able to use some portions of our Service. See our Cookie Policy for full details.
8. Third-Party Links
Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.
9. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Our standard periods are:
| Data | Retention period |
|---|---|
| Account records | For as long as your account is active, then 12 months after closure |
| Contact, valuation and listing enquiries | 24 months from your last contact with us |
| Newsletter subscription records | Until you unsubscribe, plus 12 months to honour your opt-out |
| Analytics data | 14 months (Google Analytics retention setting) |
| Server and security logs | Up to 30 days, per our hosting provider's retention |
| Cookie consent records | 12 months, after which we ask you again |
| Records required for tax and accounting | 6 years, as required by UK law |
When we no longer need your information, we securely delete or anonymise it.
10. Children's Privacy
Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
11. International Data Transfers
Several of the providers listed in Section 4.1 are based in the United States, so your personal data is transferred outside the UK. Where we make such a transfer, we rely on one of the following safeguards under Chapter V of the UK GDPR:
- UK Adequacy Regulations — for providers certified under the UK Extension to the EU–US Data Privacy Framework, including Google.
- The International Data Transfer Agreement (IDTA), or EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, for all other providers.
You can request a copy of the safeguards applying to a specific transfer by emailing [email protected].
12. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.
13. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
- Company: Mattison Capital Ltd (trading as PBSAX)
- Company Number: 08952368
- ICO Registration Number: ZA516303
- Registered Office: 7 Bell Yard, London, England, WC2A 2JR
- Email: [email protected]
- Website: pbsax.com/contact
For data protection inquiries, you can also contact the UK Information Commissioner's Office (ICO) at ico.org.uk.
This Privacy Policy is effective as of January 2025 and applies to all users of PBSAX.