Brasenose College Applicant & Prospective Student Privacy Notice (v1.4)

Brasenose College is committed to protecting the privacy and security of personal data.

This notice explains what personal data Brasenose College holds about you, how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it.

For the parts of your personal data that you supply to us, this notice also explains the basis on which you are required or requested to provide the information. For the parts of your personal data that we generate about you, or that we receive from others, it explains the source of the data.

There are some instances where we process your personal data on the basis of your consent. This notice sets out the categories and purposes we use your data for where your consent is needed.

“Personal data” is information relating to you as a living, identifiable individual. It can include information such as your name, contact details, education history and other information about you that we may process.

“Processing” your data includes various operations that may be carried out on your data, including collecting, recording, organising, using, disclosing, storing and deleting it.

The law requires us:

• To process your data in a lawful, fair and transparent way;
• To collect your data only for explicit and legitimate purposes;
• To collect only data that is relevant and limited to the purposes we have told you about;
• To ensure that your data is accurate and up to date;
• To ensure that your data is only kept as long as necessary for those purposes; and
• To ensure that appropriate security measures are used to protect your data.

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

If you do not provide us with information that we ask for:

• If you are a prospective student wanting to attend an open day, it may mean that you cannot attend, depending on the type of information we requested.
• If you are an applicant wanting to study with us, it may mean that we reject your application, depending on the type of information we requested.

• Your school or previous educational establishments or employers, if they provide references to us;
• Your family members, guardians, friends, and other contacts who may provide us with information about you if and when they contact us, or vice versa.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• Where it is necessary to take steps at your request prior to entering a contract;
• Where necessary to comply with a legal obligation;
• Where necessary to protect your or another person’s vital interests (e.g. in an emergency); and
• On the basis of consent in limited circumstances – for applicants under 18, parental or guardian consent may also be requested.

“Special categories” of particularly sensitive personal data require higher levels of protection. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership; as well as the processing of genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

We may process such data where:

• We have your explicit written consent;
• It is necessary in the substantial public interest and further conditions are met; or
• It is necessary for archiving, research, or statistical purposes under legal safeguards.

We maintain appropriate data-handling policies and legal safeguards. We may also process such data for legal claims, to protect vital interests, or where you have made the data public.

We may process data relating to criminal convictions and allegations of criminal activity on the same lawful bases as special category data.

Our detailed Record of Processing Activities (ROPA) sets out processing activities, sources, retention, and lawful bases for both personal and special-category data:
https://www.bnc.ox.ac.uk/privacypolicies

• For administering your application, we process data on the lawful basis of legitimate interest – including:
  • Details of courses you apply for;
  • Your application form, contact details, personal statement, predicted grades and education history;
  • Written work or tests submitted, and our assessments of them.
• We may also take into account contextual data (e.g. school or postcode information, care-system background) when deciding whom to invite for interview. Further information:
  Undergraduate Admissions and
  Graduate Admissions.
• To comply with legal obligations on health and safety, we may process details of declared criminal convictions, allegations or charges, and Disclosure & Barring Service checks – where relevant to risks to students or staff.
• Bank or other payment details may be processed where you request reimbursement or make payments; this is based on legitimate interest.

We will not sell your data. We share it only where required or permitted by law, for example:

• With UK Visas and Immigration (for visa-controlled students);
• With the University of Oxford for regulatory reporting (e.g. Higher Education Statistics Agency);
• With the police, in cases of alleged criminal misconduct.

We may also share data with authorised agents or service providers, provided appropriate safeguards and agreements are in place. All third-party providers must follow security policies and process data only under our instructions.

More information is available in the Brasenose Data Sharing table:
https://www.bnc.ox.ac.uk/privacypolicies

Personal data may flow between the UK and EEA without additional measures. Transfers outside these areas are permitted only under adequacy decisions or other legal safeguards. If none apply, transfers may occur where necessary for your application or pre-contractual steps. We will inform you before any such transfer.

We do not make decisions about you based solely on automated means. If this changes, we will notify you.

Retention periods are listed in our ROPA:
https://www.bnc.ox.ac.uk/privacypolicies

Anonymised statistical data may be kept indefinitely, but it does not identify you.

• Right to request access to a copy of your data and related information;
• Right to correct inaccuracies or complete incomplete data;
• Right to erasure of personal data in certain circumstances;
• Right to restriction of processing (for example, to verify accuracy);
• Right to receive and transfer data to another controller;
• Right to object to direct marketing;
• Right to object to processing based on legitimate interest or public-interest tasks;
• Right to object to automated decision-making with legal or significant effects; and
• Right to withdraw consent at any time (where processing is based on consent).

Contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

Further guidance: https://ico.org.uk/

We may update this notice periodically – for example if law, regulation, or University procedures change. If changes are material, we will give you not less than two months’ notice by email so you can exercise your rights if appropriate.

You can access past versions at:
https://www.bnc.ox.ac.uk/privacypolicies

Version control: v1.4 (February 2024)

Last Review Date: February 2024
Next Review Date: February 2025