Brasenose College Academic/Non-Academic Applicant Privacy Notice (v1.4)

A summary of what this notice explains

Brasenose College is committed to protecting the privacy and security of personal data.

This notice explains what personal data Brasenose College (“us” or “we”) holds about applicants for office holders, Fellowships, senior membership and employment at Brasenose College (“you”), how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it.

For the parts of your personal data that you supply to us, this notice also explains the basis on which you are required or requested to provide the information. For the parts of your personal data that we generate about you, or that we receive from others, it explains the source of the data.

There are some instances where we process your personal data on the basis of your consent. This notice sets out the categories and purposes of data where your consent is needed.

Brasenose College has also published separate notices, which are applicable to other groups and activities. Those notices may also apply to you, depending on your circumstances, and it is important that you read this privacy notice together with other applicable privacy notices:

  1. Current students
  2. Alumni and donors (including what financial information we hold about our alumni and how we use it when considering fundraising initiatives)
  3. Archives (which explains what data we hold in our archive)
  4. Security, maintenance and health and safety (including how we use CCTV)
  5. Website and cookies (including how we monitor use of our website)
  6. IT systems (including how we monitor internet usage)

You can access these and past versions of our privacy notices at:
https://www.bnc.ox.ac.uk/privacypolicies

What is your personal data and how does the law regulate our use of it?

“Personal data” is information relating to you as a living, identifiable individual. We refer to this as “your data”.

  • To process your data in a lawful, fair and transparent way;
  • To only collect your data for explicit and legitimate purposes;
  • To only collect data that is relevant and limited to the purpose(s) we have told you about;
  • To ensure that your data is accurate and up to date;
  • To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;
  • To ensure that appropriate security measures are used to protect your data.

Brasenose College’s Contact Details

If you need to contact us about your data, please contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford
OX1 4AJ
data.protection@bnc.ox.ac.uk

What personal data we hold about you and how we use it

We may hold and use a range of data about you at different stages of our relationship with you. We might receive this data from you; we might create it ourselves, or we might receive it from someone else (for example if someone provides us with a reference about you).

Categories of data that we collect, store and use include (but are not limited to):

  • Contact details you provide, including names, addresses and telephone numbers.
  • Position, role, grade, salary and benefits attaching to the relevant role.
  • Application paperwork, including test results.
  • Details of qualifications and correspondence in relation to them.
  • References received about you and referee contact details.
  • Requests for special arrangements and/or waiver of eligibility criteria and our consideration of them.
  • Communications with you regarding the outcomes of your application.
  • Records of decisions, including committee and panel reports.
  • Copies of passports, right to work documents, visas and other immigration data.
  • Details of any medical issues and/or disabilities you have notified to us and reasonable adjustments made.
  • Equality monitoring data.

Details of processing activities can be found at:
https://www.bnc.ox.ac.uk/privacypolicies

The lawful basis on which we process your data

Most commonly, we will process your data on the following lawful grounds:

  • Where it is necessary to perform the contract we have entered into with you;
  • Where necessary to comply with a legal obligation;
  • Where it is necessary for the performance of a task in the public interest;
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in an emergency where this is necessary to protect your vital interests or someone else’s. In limited cases we will process your data on the basis of your consent.

Special Categories of personal data

Special categories of personal information require higher levels of protection. They include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning someone’s sex life or sexual orientation.

We may process such data where:

  • Processing is necessary for employment, social security or social protection obligations or rights;
  • With your explicit written consent;
  • It is necessary in the substantial public interest (for example equal opportunities monitoring);
  • It is necessary for archiving, research or statistical purposes subject to safeguards.

We have in place appropriate data handling policies and safeguards required by law. We may also process this data for legal claims or where you have made the information public.

Criminal convictions and allegations of criminal activity

We may process data relating to criminal convictions and allegations of criminal activity on the same grounds as special category data.

Details of our processing activities

Lawful bases for processing and retention periods are set out in our Record of Processing Activity (ROPA):
https://www.bnc.ox.ac.uk/privacypolicies

Data that you provide to us and the possible consequences of not providing it

Most data you provide is processed so we can comply with legal obligations, for example:

  • Copies of passport, right to work, and visa information to comply with UK Immigration and Visa requirements.
  • DBS checks where the role involves work with children or vulnerable adults.

Failure to provide such data may mean you cannot take up the role.

Some data is voluntary, for example:

  • Equality monitoring data requested under the Equality Act 2010.
  • Disability and health condition information to consider reasonable adjustments.

Other sources of your data

  • Data generated by us during processing your application.
  • Data from the University of Oxford for joint positions.
  • References from previous educational establishments or employers.

How we share your data

We do not, and will not, sell your data to third parties. We will only share it with third parties if we are allowed or required to do so by law.

Examples of bodies to whom we are required by law to disclose certain data include, but are not limited to:

Organisation Why?
Home Office; UK Visas and Immigration To fulfil Brasenose College’s obligations as a visa sponsor.

Examples of bodies to whom we may voluntarily disclose data, in appropriate circumstances, include but are not limited to:

Organisation Why?
Other Colleges and/or PPHs within the University of Oxford, University offices and/or departments Where you apply for a role shared between different parts of the collegiate university, we may need to share relevant data for the proper functioning of relevant contracts and services.
Higher Education Statistics Agency (HESA) Some information, usually in pseudonymised form, will be sent to HESA for statistical analysis and to allow government agencies to carry out their statutory functions.
Third-party service providers To facilitate activities of Brasenose College. Any transfer will be subject to an appropriate, formal agreement between the College and the processor.

Where information is shared with third parties, we will seek to share the minimum amount of information necessary to fulfil the purpose. All our third-party service providers are required to take appropriate security measures to protect your personal information and are only permitted to process your personal data for specific purposes in accordance with our instructions. We do not allow them to use your personal data for their own purposes.

More information on the categories of recipients of your data is set out in a table called Brasenose Data Sharing, found at https://www.bnc.ox.ac.uk/privacypolicies.

Sharing your data outside the UK/EEA

Personal data may flow between the UK and EEA without additional measures. Transfers outside these areas will follow legal safeguards, and you will be notified if applicable.

Automated decision-making

We do not make decisions about you based solely on automated means. If this changes, you will be notified.

How long we keep your data

We retain your personal information as long as necessary to fulfil the purposes we collected it for and legal requirements. Details are in the ROPA. Anonymised statistical data may be kept indefinitely.

Your legal rights over your data

  • Right to request access to a copy of your data.
  • Right to correct inaccuracies or complete incomplete data.
  • Right to have personal data erased in certain circumstances.
  • Right to restrict processing of your data.
  • Right to receive and transfer your data to another controller.
  • Right to object to direct marketing and certain processing.
  • Right to withdraw consent at any time (where applicable).

To exercise your rights, contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford
OX1 4AJ
data.protection@bnc.ox.ac.uk

Further guidance is available from the Information Commissioner’s Office:
https://ico.org.uk/

Future changes to this privacy notice

We may update this notice from time to time due to changes in law, regulation, or operations. Material changes will be notified at least two months in advance by email.

Past versions can be accessed at:
https://www.bnc.ox.ac.uk/privacypolicies

 

Version control: v1.4 (February 2024)

Last Review Date: February 2024
Next Review Date: February 2025