Brasenose College Archive Privacy Notice (v1.4)

Brasenose College is committed to protecting the privacy and security of personal data.

This privacy notice applies to anyone whose personal data is retained in Brasenose College’s archives. This group will include:

1. Current and former students
2. Current and former staff and officers of Brasenose College
3. Individuals who have donated items to our archives
4. Researchers who access our archives
5. Other third parties referred to in records held in the archive

This notice explains what personal data Brasenose College holds about you, how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it.

This notice also explains the lawful basis on which we process your data. For the parts of your personal data that we generate about you, or that we receive from others, this notice also explains the sources of the data.

“Personal data” is information relating to you as a living, identifiable individual. We refer to this as “your data”.

“Processing” your data includes various operations that may be carried out on your data, including collecting, recording, organising, using, disclosing, storing and deleting it.

Data protection law requires us:

• To process your data in a lawful, fair and transparent way;
• To only collect your data for explicit and legitimate purposes;
• To only collect data that is relevant and limited to the purpose(s) we have told you about;
• To ensure that your data is accurate and up to date;
• To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;
• To ensure that appropriate security measures are used to protect your data.

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

If you as a researcher do not provide your data (such as your name and contact details), you may not be allowed to access the archive.

Apart from the data that you provide to us, the data we hold about you may have been obtained from our staff, students, the University of Oxford, donors to our archives or other third parties.

The data we hold will generally have been obtained for other purposes originally. The law permits the College to retain lawfully obtained data for the purposes of archiving in the public interest, for historical or scientific research, or for statistical purposes.

These purposes must not cause substantial damage or distress, nor be used for decisions about individuals unless for approved medical research.

In addition, the College (or third parties such as researchers or donors of archive material) will typically also have a legitimate interest in processing data for such purposes, provided your interests and rights do not override those interests.

“Special categories” of particularly sensitive personal data require higher levels of protection. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation.

We may process such data where:

• We have your explicit written consent; or
• It is necessary in the substantial public interest, for example:
  • For the prevention or detection of unlawful acts;
  • For equal opportunities monitoring;
• It is necessary for archiving, research, or statistical purposes, under legal safeguards ensuring such processing will not cause substantial distress or damage, nor be used for decisions about individuals (unless required for approved medical research).

We maintain data handling policies and other safeguards required by law. Less commonly, we may process this type of data where it is needed in relation to legal claims, to protect vital interests, or where you have made the information public.

Similar legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same lawful bases as special category data.

Our Record of Processing Activities (ROPA) sets out what data we process, why, where it comes from, how long we keep it, and our lawful basis. It can be found at: https://www.bnc.ox.ac.uk/privacypolicies

Examples include:

• Student files: Dates of attendance, course of study, results, assessments, awards, scholarships, applications, disciplinary records, and related personal information (e.g. health, family, ethnicity, beliefs, or financial circumstances). The College processes this data for archiving and research in the public interest, including special category and criminal convictions data where appropriate.
• Staff records: Name, dates of employment, roles, reasons for departure, photographs, and references given.
• Administrative records: Governing Body or committee minutes, which may include personal data of staff mentioned in them.
• Other material: Items collected or donated to the archive.

We do not sell your data. We will only share it where required or permitted by law. Archives may be consulted by researchers with our permission and under access controls (e.g. redaction of personal data).

Third-party service providers must protect your data and act only under our instructions. They cannot use your data for their own purposes.

Details of recipients appear in the Brasenose Data Sharing table: https://www.bnc.ox.ac.uk/privacypolicies

Personal data may flow between the UK and EEA without additional measures. Transfers outside these areas are permitted for research only when:

• There is an adequacy decision by the European Commission or UK ICO; or
• Appropriate safeguards (e.g. standard contractual clauses) are in place; or
• An applicable legal derogation permits the transfer.

We do not make decisions about you based solely on automated means. If this changes, you will be notified.

Data held for archiving and historical research is retained permanently unless no longer required. If you believe such processing causes substantial distress or damage, contact the College Data Protection Officer so we can review safeguards or ongoing processing.

• Right to request access to a copy of your data and related information;
• Right to correct inaccuracies or complete incomplete data;
• Right to have personal data erased in certain circumstances;
• Right to restrict processing (for example, to verify accuracy);
• Right to receive and transfer data to another controller;
• Right to object to direct marketing;
• Right to object to processing based on legitimate interest or public-interest tasks;
• Right to object to automated decision-making with legal or significant effects; and
• Right to withdraw consent at any time (where applicable).

Contact:

The Data Protection Officer
Brasenose College
Radcliffe Square
Oxford OX1 4AJ
data.protection@bnc.ox.ac.uk

Further guidance: https://ico.org.uk/

Complaints: You have the right to contact the Information Commissioner’s Office if you believe your data has been processed unlawfully.

We may update this notice periodically due to legal, technological, or procedural changes. If changes are material, we will give not less than two months’ notice by email or in writing.

Past versions are available at: https://www.bnc.ox.ac.uk/privacypolicies

Version control: v1.4 (February 2024)

Last Review Date: February 2024
Next Review Date: February 2025