Brasenose College GDPR ROPA – Student / Visiting Student / Related Functions

Version 1.5 (Reviewed May 2024)

ID	Category of personal data	Source of the data	Why we process it	How long we keep it	Our lawful basis for processing	Details relating to lawful basis (where applicable)	Special category / public interest / criminal data
1	Your dates of attendance, course of study and results, awards, scholarships, prizes, student status (including visiting/full-time/part-time) and your official photograph.	Generated by us; obtained from the University of Oxford.	To administer your course, record results, verify attendance and maintain College archives.	Permanently.	Performance of contract; public task; legitimate interests.	The College has a legitimate interest in maintaining academic and historic student records.
2	Information about your health, dietary requirements or disabilities, and decisions taking that information into account.	Obtained from you, the University, or authorised third parties (e.g. medical professionals).	To make reasonable adjustments, take account of dietary or health needs, and ensure wellbeing.	25 years after leaving or permanently if archived.	Legitimate interests; legal obligation.	The College has a legitimate interest in supporting equality and wellbeing; also required by equality and safety law.	Substantial public interest under the UK Data Protection Act 2018; Equality Act and health/safety compliance.
3	Information about ethnicity, religion, sexuality and/or health processed for equality monitoring.	Obtained from you or the University.	For equality monitoring and reporting.	25 years after leaving or permanently if archived.	Legitimate interests.	Monitoring and promoting equality of opportunity.	Substantial public interest under the Data Protection Act 2018.
4	Records of academic performance, attendance and self-assessment.	Generated by tutors and obtained from you.	To guide and assess progress during your studies.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests.	To provide academic feedback and progression support.
5	Requests for special exam arrangements, extensions or extenuating circumstances and related decisions.	Obtained from and generated about you.	To review and decide academic requests per College policy.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests; public task; legal obligation.	Ensuring fair and compliant decision-making under College procedures.	Substantial public interest under Data Protection Act; Equality Act compliance.
6	Records of student helpers/hosts at open days, including name, contact details, hours worked, and payments.	Obtained from you.	To record and manage open-day helpers and payments/benefits.	6 months after leaving, or longer if required for accounting.	Performance of contract (if paid); legitimate interests.	Legitimate interest in students assisting at outreach events.
7	Accommodation tenancy/licence details, duration, payments and allocation.	Generated by the College.	To provide accommodation and manage related records.	7 years after tenancy/licence ends.	Performance of contract; legitimate interests.	Interest in providing and managing accommodation safely.
8	Accommodation requests, guests, dependants, inventories, lost property and safety records.	Obtained from you.	To manage accommodation safely and provide services.	7 years after tenancy/licence ends.	Performance of contract; legitimate interests.	To maintain safe and efficient accommodation operations.
9	Room/facility bookings for student events, including compliance with freedom of speech law.	Obtained from and generated about you.	To administer room bookings and ensure legal compliance.	7 years after tenancy/licence ends.	Legitimate interests; public task; legal obligation.	Complying with the Education (No 2) Act 1986.	Substantial public interest under Data Protection Act 2018.
10	Financial and payment records (“battels”) including banking and card details.	Obtained from you and generated by us.	To provide and account for services such as fees, accommodation, and meals.	Until settled, or six months after leaving; permanently if archived.	Performance of contract.
11	University fee collection information — details of fees due to the University, received and transferred to them by the College.	Generated by the College; obtained from the University of Oxford.	To collect University fees on behalf of the University and maintain proper financial records.	25 years after end of study or permanently if archived.	Performance of contract with the University; legitimate interests.	The University has a legitimate interest in collecting fees due to it.
12	Application and admission data submitted to UCAS, University or College, including academic and employment history, predicted grades, written work, research proposals, references, and feedback.	Obtained from you, the University, and referees; generated by us.	To record admission decisions, administer your application and course, and provide references.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests.	To maintain records for reference requests and academic history.
13	Criminal records or allegations declared or reported, and results of Disclosure and Barring Service (DBS) checks.	Obtained from you, third parties, or generated by us.	To ensure College safety and compliance with safeguarding obligations.	DBS data: 6 months from receipt; other criminal records retained 6 years after leaving, or permanently if archived.	Performance of contract; legitimate interests.	The College has a legitimate interest in safeguarding members and meeting legal requirements.	Substantial public interest under Data Protection Act 2018; compliance with health, safety and equality law.
14	Fee status, funding, residence, and guarantor or sponsor information (e.g. loans, grants, parental support evidence).	Obtained from you, the University, and third parties (parents, sponsors).	To determine fees payable and confirm financial arrangements for study.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests; legal obligation.	Legislation sets fees based on residence; the College must ensure students can meet costs.
15	Disciplinary, harassment or grievance records, including complaints, investigations, decisions and appeals.	Obtained from you, the University, third parties, or generated by us.	To maintain standards of conduct and behaviour for all College members.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests.	The College has a legitimate interest in operating disciplinary and grievance procedures fairly.	Substantial public interest under the Data Protection Act 2018; Equality Act 2010 compliance.
16	Records of cultural life — photographs, written records, participation in events, sports, clubs, choirs and societies.	Obtained from you or third parties; generated by the College.	To record and celebrate College cultural life and achievements, and to maintain College archives.	Permanently.	Legitimate interests.	To preserve a record of College life for current and future students and researchers.
17	Meal bookings and attendance records, including table plans for formal dinners.	Obtained from you.	To manage catering services, charge correctly, and plan formal events.	3 months after the end of the academic year you leave.	Performance of contract.
18	Records created for legal or statutory compliance (e.g. data protection, freedom of information, safeguarding, H&S, legal claims, audit records).	Generated by the College.	To document compliance and meet legal or regulatory requirements.	6 years from creation, unless extended for legal reasons.	Legal obligation.	To comply with law and accountability standards.	Substantial public interest under Data Protection Act 2018; compliance with statutory duties.
19	Right to study documentation — passport, visa, biometric permit, and attendance records.	Obtained from you and the University.	To verify entitlement to study and report to immigration authorities as required.	25 years after leaving or permanently if archived.	Performance of contract; legal obligation; legitimate interests.	College, University and students share an interest in immigration law compliance.
20	Visa application and extension assistance, including passport and visa copies shared with University and Home Office.	Obtained from you; generated by the College.	To assist international students with visa processes and ensure compliance with immigration law.	25 years after leaving or permanently if archived.	Performance of contract; legal obligation; explicit consent.
21	Emergency contact details.	Obtained from you.	To contact someone you nominate in the event of an emergency.	6 years after the end of the academic year in which you leave.	Legitimate interests.	College and students share an interest in emergency communication arrangements.
22	Contextual admissions information for undergraduate applications (e.g. school performance, postcode, care background).	Obtained from the University of Oxford.	To support fair admissions processes and comply with Office for Students access agreements.	25 years after leaving or permanently if archived.	Legitimate interests; legal obligation.	College has a legitimate interest in widening participation and fair access.
23	Contractual details, tutor information, University card number, contact details, and any disclosed caring responsibilities.	Obtained from you and generated by us.	To administer your course and take account of your personal circumstances.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests.	College has an interest in considering individual circumstances when providing teaching.
24	Records of attendance and participation in College committees (where students are members).	Generated by the College.	To record committee attendance and participation in College governance.	Permanent in archives if in minutes; otherwise 6 years after leaving.	Legitimate interests.	College has a legitimate interest in recording student representation in governance.
25	Applications for and decisions about financial support (scholarships, bursaries, hardship funds), including correspondence with funders.	Obtained from you; generated by us; sometimes received from third parties.	To assess financial support applications and promote participation from all backgrounds.	25 years after leaving or permanently if archived.	Legitimate interests; public task.	College has an interest in offering and recording financial support for students.
26	Degree ceremony records, including attendance, catering requirements and guest names.	Obtained from you; generated by us.	To organise and operate degree ceremonies.	1 year after the ceremony, or permanently if archived.	Performance of contract.
27	Prize, scholarship and award nominations and decisions (College-funded).	Obtained from you; generated by us.	To determine recipients of scholarships, prizes and awards.	25 years after leaving; record of award kept permanently.	Legitimate interests.	College has an interest in recognising student achievement and fulfilling benefactors’ wishes.
28	Prize, scholarship and award nominations and decisions (third-party funded).	Obtained from you; generated by us; provided by third-party donors.	To determine recipients of awards funded by external benefactors.	25 years after leaving; record of award kept permanently.	Legitimate interests.	College has an interest in fulfilling donor wishes and recognising student achievement.
29	Student debtor records, recovery actions and related decisions.	Generated by the College.	To manage debt collection and consider financial support or disciplinary actions.	Until debt settled or final decision; otherwise 6 years after leaving, or permanently if archived.	Performance of contract; legitimate interests.	College has an interest in recovering fees owed by students or alumni.
30	Library records: access logs, borrowing history, overdue items and fines.	Generated by the College.	To manage library facilities and enforce regulations.	1 year after library account closure.	Performance of contract; legitimate interests.	College has an interest in operating a library and managing usage and fines fairly.
31	Records of decisions regarding course options, changes, withdrawals, suspensions, or intermissions.	Obtained from you; generated by the College.	To record and decide requests concerning course or study changes.	25 years after leaving or permanently if archived.	Performance of contract; legitimate interests.	To record and implement academic decisions according to College regulations.
32	Welfare records, including confidential counselling and support requests or provision.	Obtained from you; generated by us.	To provide welfare and counselling support services to students.	25 years after leaving.	Legitimate interests.	College and students have a legitimate interest in access to welfare and counselling services.	Explicit consent; vital interests where appropriate.
33	Mailing lists used to inform you about College and University events or information.	Generated by the College.	To enable communication about events and news during your studies.	Removed from lists within 3 months after you leave.	Legitimate interests.	Ensuring students are aware of College and University activities.
34	Student information used in marketing and outreach materials (photographs, testimonials, participation records).	Obtained from you.	To promote the College to potential applicants.	Permanently (transferred to archives).	Legitimate interests.	The College has an interest in recruiting and retaining students under its charitable aims.
35	Research student records (supervisor details, examiners, advisors, thesis title, progress reports, meeting notes, viva outcomes).	Obtained from the University; generated by us.	To monitor postgraduate progress and record assessment outcomes.	25 years after leaving or permanently if archived.	Performance of contract.
36	Consultations and treatment records by the College Nurse.	Obtained from you; generated by the Nurse.	To provide basic medical advice or treatment to students.	3 years after leaving or reaching age 21, whichever is later.	Legitimate interests.	College has an interest in student welfare and healthcare provision.	Explicit consent or vital interests where necessary.
37	Data retained post-contract for archiving, research, references, legal or regulatory purposes.	Retained from other categories listed in this document.	For reference provision, regulatory compliance, archiving and research.	As specified elsewhere in this table.	Legitimate interests.	College has an interest in providing references, complying with legal requirements, maintaining archives, and supporting research.	Necessary for establishment or defence of legal claims; archiving in the public interest; historical research purposes.
38	References provided for students or alumni.	Generated by the College.	To provide references when requested by or for you.	25 years after leaving or permanently if archived.	Legitimate interests.	College, students, and reference recipients have a shared interest in providing accurate references.
39	Student performance records appearing in alumni publications (completion of courses, awards, etc.).	Generated by us; obtained from the University.	To record and share academic achievements and maintain archives.	Permanently (archived).	Legitimate interests.	College has an interest in maintaining an archive of achievements and activities as part of its historic record.

Version control: Version 1.5 (Reviewed May 2024)