Brasenose College Student & Visiting Student Privacy Notice (v1.3)

Brasenose College is committed to protecting the privacy and security of personal data.

This notice explains what personal data Brasenose College holds about you, how we use it internally, how we share it, how long we keep it, and what your legal rights are in relation to it.

For personal data that you supply to us, this notice also explains the basis on which you are required or requested to provide it. For data we generate or receive from others, it explains the source.

In some cases, we process your data based on consent. This notice sets out where and why consent is required.

Separate privacy notices cover other groups and activities which may also apply to you:

1. Applicants and prospective students
2. Alumni and donors
3. Archives
4. Website and cookies
5. IT systems
6. Staff (if you are also employed by the College)

You can access these at: https://www.bnc.ox.ac.uk/privacypolicies

“Personal data” means information relating to you as a living, identifiable individual. “Processing” means any operation performed on that data, such as collecting, recording, using, storing, or deleting it.

We are required by law to:

• Process your data lawfully, fairly, and transparently;
• Collect it only for explicit and legitimate purposes;
• Ensure it is relevant and limited to those purposes;
• Keep it accurate and up to date;
• Retain it only as long as necessary; and
• Protect it using appropriate security measures.

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

Providing most data is a contractual requirement. If you do not provide data that you are required to, this may limit the services we can offer or, in some cases, result in disciplinary action or termination of your contract.

• Data generated by College staff (e.g. tutorial attendance, accommodation records).
• Data from the University of Oxford (e.g. examination results, degree bookings, visa and disability data, emergency contacts, financial information).
• References from schools, previous educational institutions, or employers.
• Information from fellow students, family members, or visitors to Brasenose College.

• Where it is necessary to perform your student contract;
• Where it is necessary to perform a public task;
• Where required to comply with legal obligations;
• Where necessary for our legitimate interests (or those of a third party) without overriding your rights; or
• Where we have your consent (in limited cases).

These include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation.

We may process such data where:

• We have your explicit written consent;
• Processing is necessary to protect vital interests;
• It is necessary in the substantial public interest (e.g. crime prevention or equality monitoring); or
• It is necessary for archiving, research, or statistical purposes under legal safeguards.

We may process such data on the same lawful bases as those above.

Our Record of Processing Activities (ROPA) provides detailed information about data categories, purposes, retention, and lawful bases:
https://www.bnc.ox.ac.uk/privacypolicies

Examples include:

• Your course of study and assessed work.
• Disciplinary records and communications related to studies.
• Contact, accommodation, and payment information.
• Application data (from UCAS, predicted grades, and academic record).
• Disclosure of relevant criminal convictions or DBS results (for safeguarding purposes).
• Voluntarily provided data such as disability, health, ethnicity, gender, religion, or sexual orientation information for equality monitoring.
• Health or disability data used to consider reasonable adjustments.
• Data required by law (e.g. immigration records, reporting obligations).

More information on undergraduate admissions:
Undergraduate Criminal Convictions Policy
Graduate admissions:
Graduate Criminal Convictions Policy

We do not sell your data. We share it only where required or permitted by law. This includes:

• UK Visas and Immigration (for visa compliance).
• The University of Oxford (for reporting to HESA or other regulators).
• Law enforcement agencies (e.g. the police).

We may also share data with service providers working for the College, under formal agreements and security safeguards. Providers cannot use your data for their own purposes.

Further details are in the Brasenose Data Sharing table:
https://www.bnc.ox.ac.uk/privacypolicies

We do not make decisions about you based solely on automated means. If this changes, you will be notified in writing.

We comply with data transfer safeguards when data leaves the EU. If no adequacy decision exists, data may still be transferred if necessary for your contract or pre-contractual steps. You will be notified in such cases.

Retention periods are outlined in our ROPA:
https://www.bnc.ox.ac.uk/privacypolicies

Some student data is retained permanently for archiving and research. Anonymised statistical data may be kept indefinitely.

• Right to request access to a copy of your data;
• Right to correct inaccuracies or complete incomplete data;
• Right to request erasure in certain cases;
• Right to restrict processing (e.g. to verify accuracy);
• Right to receive and transfer your data to another controller;
• Right to object to direct marketing;
• Right to object to processing based on legitimate or public-interest grounds;
• Right to object to automated decision-making with legal or significant effects; and
• Right to withdraw consent at any time (where applicable).

Contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

Further guidance: https://ico.org.uk/
Complaints: https://ico.org.uk/concerns/

We may update this notice periodically if law, regulation, or University procedures change. If material, we will provide at least two months’ notice by email before changes take effect.

Past versions are available at:
https://www.bnc.ox.ac.uk/privacypolicies

Version control: v1.3 (June 2023)

Last Review Date: June 2023
Next Review Date: June 2025