Privacy Policy

1. Introduction to Oxford Quarter Life Reboot Privacy Notice

    This privacy notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data, and keep it safe. St Anne’s College and the University of Oxford’s Careers Service are committed to protecting the privacy and security of personal data.

    The notice explains how we use data internally, how we share it, how long we keep it and what your legal rights are in relation to it.

    It is likely that we will need to update our Privacy Notices from time to time. We will notify you of any significant changes, but you are welcome to come back and check it whenever you wish.

    For the parts of your personal data that you supply to us to us, the notices also explain the basis on which you are required or requested to provide the information. For the parts of your personal data that we generate about you, or that we receive from others, it explains the source of the data.

    There are some instances where we process your personal data on the basis of your consent. The privacy notice sets out the categories and purposes of data where your consent is needed.

    This privacy notice relates to the following areas:

    • Course applicants
    • Course attendees
    • Website and cookies (including how we monitor use of our website)

    2. What is your personal data and how does the law regulate our use of it?

    “Personal data” is information relating to you as a living, identifiable individual.  We refer to this as “your data”. It can include information such as your name, contact details, education history and other information about you that we may process.

    “Processing” your data includes various operations that may be carried out on your data, including collecting, recording, organising, using, disclosing, storing and deleting it.

    Data protection law requires St Anne’s College and the University of Oxford Careers Service (“us” or “we”), as data controller for your data:

    • To process your data in a lawful, fair and transparent way;
    • To only collect your data for explicit and legitimate purposes;
    • To only collect data that is relevant, and limited to the purpose(s) we have told you about;
    • To ensure that your data is accurate and up to date;
    • To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;

    To ensure that appropriate security measures are used to protect your data.

    3. What personal data we hold about you and how we use it

    We may hold and use a range of data about you at different stages of our relationship with you.  We might receive this data from you; we might create it ourselves, or we might receive it from someone else (for example if someone provides us with a reference about you).

    Categories of data that we collect, store and use include (but are not limited to):

    • Contact details that you provide to us, including names, addresses and telephone numbers, submitted through online forms or by email
    • To deliver the best possible web experience, we collect technical information about your internet connection and browser as well as the country and telephone code where your computer is located, the web pages viewed during your visit, and any search terms you entered.

    4. Cookies

    Whenever you use a website, mobile application or other Internet service, certain information is created and recorded automatically. The same is true for our website(s), being those with URLs in the domain st-annes.ox.ac.uk

    In addition to the data we gather via web forms placed on our site (the handling of which will be governed by the relevant data protection notice covering the circumstances and context), we collect and generate a variety of data via our website(s).

    Categories of data that we collect, store and use include (but are not limited to):

    Log data: Whenever you use our website, our servers automatically record information (“log data”) regarding that access, including:

    • Any data sent by your browser or mobile app to enable you to access the site.
    • Location data of users (if provided by the connecting device).
    • Internet Protocol (IP) address of the connecting device or other unique device identifiers.
    • Browser type and setting for the connecting device.
    • The date and time of access.
    • Details of any attempts to log on to closed systems.
    • Crash data.
    • Cookie data: We may use “cookies” (small text files sent by your computer each time you visit our website, unique to your visit or your browser) or similar technologies to record additional information. Our cookies record information including:
    • Language preferences.
    • Contents of online ‘shopping baskets’ (where relevant).

    Most data collected is statistical data about our users’ browsing actions and patterns, and does not identify any individual.  However, there may be occasions where browsing patterns are connected to IP addresses or location data such that the data as a whole is personal data.

    Whether we collect some of the above information often depends on your device type and settings. To learn more about what information your device makes available to us, please also check the policies of your device manufacturer or software provider.

    In most circumstances, we require your consent to place cookies on your device(s).  When you access our website you are notified that we use cookies, and continued use of the site following that notification is taken as consent to the use of cookies.

    If you would prefer that we do not use cookies, you should adjust your browser settings to reject cookie use.  Your operating system may allow you to set your preferences in a variety of ways, including a ‘Do not Track’ setting. If you enable the setting, we will not track your activity on our site.

    Where we use cookies for site security, or to ensure the proper functioning of the site (for example via the use of load-bearing cookies), we do not require your consent to the use of these cookies,  We have a legitimate interest in their use and we process all data, as collected by those cookies, on that basis.

    5. The lawful basis on which we process your data

    The law requires that we provide you with information about the lawful basis on which we process your personal data, and for what purpose(s).

    Most commonly, we will process your data on the following lawful grounds:

    • Where it is necessary to perform the contract we have entered into with you;
    • Where it is necessary to take steps at your request prior to entering a contract;
    • Where it is necessary to comply with a legal obligation;
    • Where it is necessary for the performance of a task in the public interest;
    • Where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests.

    We may also use your personal information, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests.  In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent. Where you are aged under 18, we may ask your parent or guardian for their consent also.

    6. Archives

    The data we hold will generally have been obtained for other purposes originally and the law permits St Anne’s College to retain lawfully obtained data for the purposes of archiving in the public interest, for historical or scientific research purposes or for statistical purposes.  The law provides further safeguards that such processing must (a) not be likely to cause substantial damage or substantial distress to you or another individual; and/or (b) must not be carried out for the purposes of measures or decisions with respect to you or another individual, unless the purposes for which the processing is necessary include the purposes of approved medical research.

    In addition, the College (or a third party such as researchers or donors of archive material) will typically also have a legitimate interest in processing data for such purposes, provided your interests and fundamental rights do not override those interests.

    7. Data that you provide to us and the possible consequences of you not providing it

    The data that we collect via our website in the course of your accessing it, is provided by you on a voluntary basis.  If you elect to adjust your browser settings to reject cookies, it may affect your experience in using the site, in the event that any blocked cookies support functionality.

    8. How we apply further protection in the case of “Special Categories” of personal data

    “Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information.

    The Special Categories of personal data consist of data revealing:

    • racial or ethnic origin;
    • political opinions;
    • religious or philosophical beliefs;
    • trade union membership.

    They also consist of the processing of:

    • genetic data;
    • biometric data for the purpose of uniquely identifying someone;
    • data concerning health;
    • data concerning someone’s sex life or sexual orientation.

    We may process special categories of personal information in the following circumstances:

    • With your explicit written consent; or
    • Where it is necessary in the substantial public interest, and further conditions are met, or:
    • for the exercise of a function conferred on St Anne’s College or anyone else by an enactment or rule of law; or
    • for equal opportunities monitoring;
    • Where the processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or statistical purposes, subject to further safeguards for your fundamental rights and interests specified in law.
    • We have in place appropriate policy documents and/or other safeguards which we are required by law to maintain when processing such data.

    Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

    9. How we share your data

    We do not, and will not, sell your data to third parties.  We will only share it with third parties external to the collegiate University, if we are allowed or required to do so by law. This includes for example:

    • where we are required to report information about course applicants that are subject to visa controls to UK Visas and Immigration.

    All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies, and are only permitted to process your personal data for specific purposes in accordance with our instructions.  We do not allow our third party providers to use your personal data for their own purposes.

    10. Automated decision-making

    We do not envisage that any decisions will be taken about you based solely on automated means, however we will notify you in writing if this position changes.

    11. How long we keep your data

    We retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting or reporting requirements. If your data is being processed for the purposes of archiving and historical research, we will keep it until the data is no longer required for this purpose.  In practice, this means your data is likely to be retained permanently.

    Details of expected retention periods for the different categories of your personal information that we hold are set out in our Record of Processing Activity (available on request).

    Retention periods may increase as a result of legislative changes, e.g. an increase in limitation periods for legal claims would mean that St Anne’s College is required to retain certain categories of personal data for longer.  Any such changes will be reflected in updated versions of our Record of Processing Activity.

    If there are legal proceedings, a regulatory, disciplinary or criminal investigation, suspected criminal activity, or relevant requests under data protection or freedom of information legislation, it may be necessary for us to suspend the deletion of data until the proceedings, investigation or request have been fully disposed of.

    Please note that we may keep anonymised statistical data indefinitely, but you cannot be identified from such data.

    12. Your legal rights over your data

    Subject to certain conditions and exception set out in UK data protection law, you have:

    • The right to request access to a copy of your data, as well as to be informed of various information about how your data is being used;
    • The right to have any inaccuracies in your data corrected, which may include the right to have any incomplete data completed;
    • The right to have your personal data erased in certain circumstances;
    • The right to have the processing of your data suspended, for example if you want us to establish the accuracy of the data we are processing.
    • The right to receive a copy of data you have provided to us, and have that transmitted to another data controller (for example, another University or College).
    • The right to object to any direct marketing (for example, email marketing or phone calls) by us, and to require us to stop such marketing.
    • The right to object to the processing of your information if we are relying on a “legitimate interest” for the processing or where the processing is necessary for the performance of a task carried out in the public interest. The lawful basis for any particular processing activity we carry out is set out in our detailed table of processing activities (available on request).
    • The right to object to any automated decision-making about you which produces legal effects or otherwise significantly affects you.

    Where the lawful basis for processing your data is consent, you have the right to withdraw your consent at any time.  This will not affect the validity of any lawful processing of your data up until the time when you withdrew your consent.  You may withdraw your consent by contacting us at St Anne’s College, 56 Woodstock Road, Oxford OX2 6HS, Tel no 01865 274800 email: enquiries@st-annes.ox.ac.uk

    Some of your rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

    Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing, you can withdraw your consent at any time by emailing the relevant department. In this event, we will stop the processing as soon as we can. If you choose to withdraw consent it will not invalidate past processing.

    13. Contacts

    If you have a general query or wish to change the way in which your data is used, please contact: dataprotection@st-annes.ox.ac.uk.