Brasenose College GDPR ROPA – Student Applicant & Outreach Processing Activities

Version 1.4 (Reviewed June 2023)

ID	Category of personal data	Source of the data	Why we process it	How long we keep this data	Our lawful basis for processing	Details relating to lawful basis (where applicable)	Special category / public interest / criminal data
1	Applications for and decisions about financial support, such as scholarships, bursaries and hardship funds. Includes related communications with third-party funders.	We obtain this data from you; we generate this data about you; we may receive decisions from third parties that provide financial support.	To make decisions about financial support and ensure that the College is encouraging and supporting participation by talented people from all backgrounds.	Successful applicants who enrol: retained for 25 years after the end of the academic year when you cease to be a registered student, or permanently if awarded a scholarship (as part of the College archive). Unsuccessful applicants: 6 years after the application cycle. Successful applicants who do not enrol: 6 years after the final enrolment opportunity.	Consent.
2	Records of open days and study days, including attendee names, contact details, email addresses, dietary requirements, accommodation bookings, and emergency contact numbers.	We obtain this data from you; we generate this data about you.	To manage attendance and logistics for open and study days.	Two years after the open or study day.	Legitimate interests.	The College and prospective students have a legitimate interest in organising and attending open days to learn about College life.
3	Information provided during the application process via UCAS or the University of Oxford, including name, intended course, contact details, gender identity, education and employment history, predicted grades, language proficiency, personal statement, references and written work.	We obtain this data from the University of Oxford.	To make admission decisions.	Successful applicants who enrol: retained for 25 years after the end of the academic year when you cease to be a student, or permanently if retained in archive. Unsuccessful applicants: 6 years after the application cycle. Successful applicants who do not enrol: 6 years after the final enrolment opportunity.	Necessary to take steps at your request prior to entering a contract; legitimate interests.	The College has a legitimate interest in administering applications and deciding who should be offered places.
4	Records of admissions decisions, including decision letters, interview notes and feedback, offers made, acceptance records, and information from relevant University departments.	We obtain this data from the University of Oxford; we generate this data about you.	To make admissions decisions and inform applicants of outcomes.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Necessary to take steps prior to entering a contract; legitimate interests.	The College has a legitimate interest in managing the admissions process and record-keeping.
5	Sensitive data provided during the application process, including ethnicity, disabilities, special needs, dietary requirements, and any disclosed criminal convictions. Includes records of decisions made using this data.	We obtain this data from the University of Oxford and from you.	To consider and make reasonable adjustments (disability/health), and for equality monitoring. Criminal conviction data may be used to assess safety risks.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Necessary to take steps prior to entering a contract; legitimate interests; compliance with legal obligations.	The College has a legitimate interest in assessing risks and complying with its equality duties. Where processed under equality or safety law, processing is necessary to prevent breaches of those obligations and must be carried out without consent to avoid prejudice.	Substantial public interest under the UK Data Protection Act 2018 and Equality Act 2010. Criminal data processed under health and safety law for the same reasons.
6	Your fee status (e.g. home, EU, or international) and related information about your country of residence, fees, funding, and supporting evidence (e.g. loans, grants, sponsorship or family support). May include financial documents from parents or sponsors.	We obtain this data from you and from third parties (e.g. parents).	To determine applicable fees and confirm ability to pay them.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Necessary to take steps prior to entering a contract; compliance with a legal obligation.	Legislation determines fee levels based on residence status.
7	Pre-application communications with prospective students.	We obtain this data from you; we generate this data about you.	To respond to queries about studying at the College.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Necessary to take steps prior to entering a contract; legitimate interests.	The College has a legitimate interest in responding to queries from prospective students.
8	Records about interview invitations, including contextual information (school performance, postcode, care background), test scores, and submitted written work.	We obtain this data from the University of Oxford; we generate this data about you; we obtain this data from you.	To decide who to invite for interview, considering academic performance and contextual data.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Legitimate interests.	The College has a legitimate interest in using contextual data to ensure fair admissions decisions.
9	Assisting students with visa applications before arrival and visa extensions during study. Includes copies of passports, visas, and details shared with the University and Home Office/UKVI for immigration compliance.	We obtain this data from you; we generate this data about you.	To comply with immigration and visa requirements for overseas students.	Same retention as above (25 years for enrolled students; 6 years otherwise).	Necessary for performance of contract; compliance with a legal obligation; explicit consent.

Version control: Version 1.4 (Reviewed June 2023)