Brasenose College GDPR ROPA – Conference, Bed & Breakfast and Guest Visitors

ID	Category of personal data	Source of the data	Why we process it	How long we keep this data	Our lawful basis for processing	Details relating to lawful basis (where applicable)	Special category / public interest / criminal data
1	Contact details (name, address, phone, email) of event attendees, speakers, and conference organisers.	Obtained from you; or third parties (e.g. where someone arranges on your behalf).	To communicate with you about events or conferences you are attending or may be interested in, and to manage bookings.	Attendee and organiser details retained 7 years post-event. Communications list data retained until you withdraw or confirmation expires.	Performance of contract; legitimate interests.	Necessary to manage bookings and communicate about events; legitimate interest in event marketing and administration.
2	Security records including CCTV, access logs, guest vehicle registrations, key issue logs, incident and accident reports, and health & safety records.	Generated by the College.	To monitor attendance, ensure safety, and maintain security of College premises and people.	CCTV/access logs retained 6 months; incident and H&S records 7 years; meeting minutes mentioning incidents kept permanently.	Legitimate interests.	Interest in maintaining safety and security of College property and occupants.	Substantial public interest under the UK Data Protection Act 2018; compliance with H&S and employment law obligations.
3	Records of College events and conferences attended or organised by you.	Generated by the College.	To manage events effectively, record attendance, and plan future events or notify you of similar opportunities.	Attendance details held 1 year post-event; organiser details 6 years; communications list entries retained until withdrawn or outdated.	Performance of contract; legitimate interests.	Necessary for contract performance and legitimate interest in planning and improving events.
4	Health, dietary requirements and/or disabilities (for event attendance).	Obtained from you.	To make reasonable adjustments and comply with equality, food safety, and health obligations.	Deleted within 12 months of the event; retained longer for alumni or regular attendees where relevant.	Legal obligation; legitimate interests.	To ensure appropriate and lawful provision for participants and guests.	Substantial public interest under the UK Data Protection Act 2018; compliance with Equality Act 2010 and H&S law.
5	Records generated for legal or statutory compliance (e.g. data protection requests, safeguarding, H&S, counter-terrorism, audits, or legal claims).	Generated by the College.	To document compliance and meet legal or regulatory requirements.	7 years from creation.	Legal obligation.	To meet statutory and regulatory obligations for administration and accountability.	Substantial public interest under the Data Protection Act 2018; compliance with statutory and legal obligations.
6	Opinions and comments made by you about College events (to the extent recorded).	Obtained from you.	To evaluate and plan events; manage College event programmes.	Comments for upcoming events retained until the event; for planning reference may be archived permanently.	Legitimate interests.	Interest in improving College events and attendee experience.
7	Financial data including bank or card details, account numbers, sort codes, invoices, and payment records.	Obtained from you.	To process payments for events, deposits, and outstanding amounts.	7 years from invoice date or longer if a dispute arises.	Performance of contract.	To fulfil payment and accounting obligations.
8	Correspondence with you.	Obtained from you.	To maintain accurate records of communications related to events and bookings.	Most correspondence deleted within 7 years; some retained longer or archived if referenced in College minutes.	Legitimate interests.	Both parties have an interest in preserving correspondence for continuity and reference.
9	Photographs taken during events and conferences.	Generated by the College.	To record College events and promote activities, subject to consent where required.	May be retained permanently as part of the College archive.	Legitimate interests.	Interest in recording College life and promoting facilities and opportunities.
10	Chapel Office – information for marriages in the College Chapel, including names, ages, occupations, dates, and preferences.	Obtained from you.	To facilitate marriage ceremonies for eligible members and maintain related records.	Skeleton record and alumni ceremony details retained permanently; registers held permanently.	Performance of contract; legitimate interests.	Interest in organising ceremonies and maintaining records within College history.
11	Conference room and overnight guest bookings (names, contact details, ages, disability data).	Obtained from you; generated by us.	To manage College property and accommodation bookings.	7 years following booking; extended in case of disputes until resolution.	Performance of contract; legitimate interests.	Interest in secure and effective management of College facilities and bookings.	Substantial public interest under Data Protection Act 2018; Equality Act and H&S compliance.
12	Computer and email data for guest IT access (login credentials, IPs, connection logs, internet usage).	Generated by the College.	To manage College IT resources properly and securely.	Destroyed after one year.	Performance of contract; legitimate interests.	Interest in protecting and managing College IT infrastructure.
13	Meal bookings.	Generated by the College.	To provide catering services and invoice accurately.	As long as necessary for transaction and record-keeping purposes.	Performance of contract.
14	Requests and bookings for conferences and events, including decisions under freedom of speech obligations (Education Act 1986).	Obtained from you; generated by the College; third parties.	To manage event bookings and comply with freedom of speech legal obligations.	Up to one year for routine records; 7 years for events subject to review or concern.	Legal obligation.	College must comply with its statutory duty under the Education (No 2) Act 1986 to secure lawful freedom of speech.	Substantial public interest under Data Protection Act 2018; compliance with statutory duties.

Version 1.4 (Reviewed June 2023)