Brasenose College Alumni, Donors, and Friends Privacy Notice (v1.5)

Brasenose College is committed to protecting the privacy and security of personal data.

This notice explains what personal data Brasenose College holds about alumni, donors and supporters (“you”), how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it.

For the parts of your personal data that you supply to us, this notice also explains the basis on which you are required or requested to provide the information. For the parts of your personal data that we generate about you, or that we receive from others, it explains the source of the data.

There are some instances where we process your personal data based on your consent. This notice sets out the categories and purposes of data where your consent is needed.

Brasenose College has also published separate notices applicable to other groups and activities. These may also apply to you, depending on your circumstances:

1. Current students
2. Current staff, office holders and senior members
3. Archives (which explains what data we hold in our archive)
4. Security, maintenance and health and safety (including how we use CCTV)
5. Website and cookies (including how we monitor use of our website)

You can access these and past versions of our privacy notices at:
https://www.bnc.ox.ac.uk/privacypolicies

“Personal data” is information relating to you as a living, identifiable individual.

• To process your data in a lawful, fair and transparent way;
• To only collect your data for explicit and legitimate purposes;
• To only collect data that is relevant, and limited to the purpose(s) we have told you about;
• To ensure that your data is accurate and up to date;
• To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;
• To ensure that appropriate security measures are used to protect your data.

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

• Contact details you provide (names, addresses, telephone numbers).
• Details of prizes, scholarships and/or bursaries you support.
• Donation histories, including contacts made, amounts given and pledged, projects supported and Gift Aid forms.
• Financial information including payment and invoicing details for College services you request.
• Dietary and accessibility requirements.
• Details of criminal convictions or charges where required for legal compliance.
• Photographs, audio and video recordings of College events you attend.
• Health information you provide to help us make reasonable adjustments (e.g. accessibility, seating, dietary needs). With your permission, we may also retain relevant health data to support respectful engagement. See our Vulnerable Persons Policy:
  https://www.bnc.ox.ac.uk/vulnerablepersons

Details of processing activities (ROPA) can be found at:
https://www.bnc.ox.ac.uk/privacypolicies

• To perform a contract we have entered into with you;
• To comply with a legal obligation;
• To perform a task in the public interest;
• For our legitimate interests (or those of a third party) where your rights do not override those interests;
• To protect vital interests in an emergency;
• Based on your consent (in limited cases).

Special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, and data concerning sex life or sexual orientation.

We may process such data where:

• We have your explicit written consent;
• It is necessary in the substantial public interest (e.g. equal opportunities monitoring);
• It is necessary for archiving, research or statistical purposes with safeguards.

We maintain appropriate data handling policies and safeguards. We may also process such data for legal claims, or where you have made the information public.

We may process data on criminal convictions or allegations under the same bases as special category data. Additional processing (e.g. to prevent money-laundering or bribery) may occur to:

1. Comply with or assist others in compliance with regulatory requirements (e.g. to determine if an unlawful act or malpractice occurred); and
2. Act in the substantial public interest when consent cannot reasonably be obtained.

We may analyse personal information (e.g. interests, activities, hobbies, achievements, or giving history) to tailor communications and deepen engagement. Information may be drawn from College records, publicly available sources, or contacts provided by acquaintances. This may include employment, honours, property value estimates, or past charitable giving.

You have the right to request that we do not process your data in this way. We do not currently outsource profiling, but if we do in future we will inform you at least one month in advance.

• Providing disability or health information helps us make reasonable adjustments (e.g. accessibility under the Equality Act 2010).
• Providing Gift Aid information allows us to reclaim Gift Aid on donations.

Refusing to provide such data may affect the services we can offer (e.g. accessibility support).

• Data generated by us through communication, event organisation, and donation processing.
• The University of Oxford (via its Development and Alumni Relations System).
• Third-party donation processors (e.g. University Shop, Blackbaud Merchant Services, Just Giving).
• Local or international media where you are mentioned.
• Information from fellow alumni, friends, family, or visitors.

Sources are detailed in our ROPA:
https://www.bnc.ox.ac.uk/privacypolicies

We do not sell your data. We share it only where required or permitted by law.

Required by law:

Voluntary disclosures:

Third-party providers must protect your data and act only on our instructions. They may not use it for their own purposes. Details of data recipients appear in the Brasenose Data Sharing table:
https://www.bnc.ox.ac.uk/privacypolicies

Personal data may flow between the UK and EEA without additional measures. Transfers outside these areas occur only with legal safeguards or adequacy decisions. When none exist, transfers may occur if necessary and permitted under data-protection law.

Both the EU (through the EU-US Data Privacy Framework) and the UK (through the UK-US Data Bridge Regulations) have issued adequacy decisions confirming sufficient protection for such transfers.

We do not make decisions about you based solely on automated means. If this changes, you will be notified.

We retain your personal information as long as necessary for stated purposes and legal requirements. Details appear in our ROPA:
https://www.bnc.ox.ac.uk/privacypolicies

Retention may be extended by legislative change or legal proceedings. Anonymised statistical data may be kept indefinitely.

• Right to request access to your data.
• Right to correct inaccuracies or complete incomplete data.
• Right to have personal data erased in certain circumstances.
• Right to restrict processing.
• Right to receive and transfer your data to another controller.
• Right to object to direct marketing.
• Right to object to processing where based on “legitimate interest” or public-interest tasks.
• Right to object to automated decision-making producing legal or significant effects.
• Right to withdraw consent at any time (where applicable).

Contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

Guidance: https://ico.org.uk/
Complaints: https://ico.org.uk/concerns/

We may update this notice periodically (e.g. due to legal or operational changes). For material updates, at least two months’ notice will be provided by email or in writing.

Past versions are available at:
https://www.bnc.ox.ac.uk/privacypolicies

Version control: v1.5 (February 2024)

Last Review Date: February 2024
Next Review Date: February 2025