Data protection statement
St Peter’s College (‘we’, ‘us’, ‘our’) is committed to protecting your personal data. We understand how important it is that we keep your information safe and that we tell you how we will use your data in a clear and transparent way.
The following sections should answer any questions you have, but if there is anything you are unclear about and on which you would like further information, please get in touch by post, telephone or email using the contact details in section 9 below.
- The University of Oxford;
- Other Oxford colleges;
- Publicly available sources;
- Matomo analytics for statistical purposes;
- Government departments and Law enforcement agencies;
- Disclosure and Barring Service (DBS);
- Providers of references, where required (and with your agreement); or
- Any other third parties providing us with services or acting on our behalf.
- We do not sell your data to third parties for any reason, including development, fundraising and events purposes.
The amount of data we collect and process depends on the frequency and nature of your interactions and engagement with us. Information may be gathered across the lifetime of our relationship with you and from many different forms of interaction.
When you share your personal data with us, you can be sure that:
- It is collected and held securely, so you know your information is safe;
- You can review and update the information we hold about you at any time; and
- You can change your preferences and have full control over which communications you receive from us.
- Past, current and prospective students of St Peter’s College.
- Past and current employees of St Peter's College.
- Individuals who apply to study or work at St Peter’s College or request information for those purposes.
- Those who have been, are or will be supporters of St Peter’s College.
- Visitors, researchers in the Library and Archive, conference and summer school guests, or event attendees.
- Tenants of St Peter’s College.
- Individuals who communicate or engage with St Peter’s College by letter, email or other means, including by social media.
- Research participants.
- Visitors to our website.
2. What information do we collect?
The information we collect about you may include:
- Your name, title, date of birth and contact details, including your address, email address and telephone number;
- Next of kin and emergency contact information;
- Your accommodation details whilst studying with us;
- For current or past students: student ID, programme of study, department, matriculation or start date, graduation date, degree conferred;
- Awards received whilst studying with us (prizes, scholarships, accolades, bursaries); other education history and professional qualifications;
- Involvement in sports teams, clubs and societies whilst studying with us and subsequently;
- Interests, activities and accolades, including honours and life achievements;
- Your attendance at events across the College, including details of any payments made, photographs, audio and video recordings in which you may be included;
- Profile pictures which come from publicly accessible sources (where copyright allows and where we have your consent where applicable);
- Photographs taken of you that capture moments in college life or that are taken for promotional and/or outreach purposes;
- Payment details, where you make a payment to us, including where you choose to make a donation to St Peter’s College, or where we make a payment to you (e.g. prizes and scholarships);
- Gift preference in respect of donations; and
- A record of any volunteering work you have undertaken for us.
When you apply for a job working for us, you will receive a separate privacy notice telling you what information we will collect, store and process.
When you visit our website, we may collect your IP address, page(s) visited, web browser, any search criteria entered, the date and time of access, previous web pages visited and other technical information. This information is used solely for web server monitoring and to deliver the best visitor experience. Additional data may be collected in forms for specific functions. We use all appropriate technical and organisational security measures to safeguard the security of your data.
When we interact with you, we may also collect notes from our conversations with you, and details of any complaints or comments you make. We may record your age or identity where the law requires this.
Special category personal data
“Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and processing this type of personal data. We aim to collect and process special category data as little as possible and we will document all incidents of our processing of special category data in our record of processing activities.
The special categories of personal data consist of data revealing:
- Racial or ethnic origin;
- Political opinions;
- Religious or philosophical beliefs; and
- Trade union membership.
They also consist of the processing of:
- Genetic data;
- Biometric data (e.g. fingerprints) for the purpose of uniquely identifying someone;
- Data concerning physical or mental health; and
- Data concerning someone’s sex life or sexual orientation.
We may process special categories of personal data where one of the following conditions are met:
- Explicit consent.
- Employment, social security and social protection (if authorised by law).
- Vital interests.
- Not-for-profit bodies.
- The data has been made public by the data subject.
- Legal claims or judicial acts.
- Reasons of substantial public interest (with a basis in law).
- Health or social care (with a basis in law).
- Public health (with a basis in law).
- Archiving, research and statistics (with a basis in law).
Further legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same grounds as those identified for “special categories” referred to above.
3. How we use your data
We process your data for a variety of purposes, including but not limited to the following:
- Managing our ongoing relationship with you and providing a record of your interactions and contributions to college and University life;
- Assessing qualifications and academic potential, and making decisions about your admission to the College;
- Supporting learning and providing you with educational facilities and support;
- Organisational management, planning and forecasting, including accounting and auditing;
- Operational reporting, the production of management information, and for other relevant purposes relating to the governance of the College;
- Monitoring and reporting on student progress;
- Providing appropriate pastoral care;
- Processing related to the provision of student accommodation;
- Assessing the quality of our services;
- Protecting the welfare of students and others in the college;
- Ensuring the safe and orderly running of the college;
- Promoting the college, its aims and ideals;
- Archiving and historical research purposes;
- Informing you of fundraising or volunteering opportunities;
- Complying with our legal requirements and responding to law enforcement authorities; and
- Equal opportunities monitoring.
4. What rights do you have?
Subject to some exceptions defined by law, you have a number of rights in relation to the processing of your personal data. You can contact us by email, phone or post (using the contact details in section 9 below) if you would like to request any of the following:
- To ask what information we hold about you and request a copy of that information, subject to any exemptions.
- To raise a valid objection to your personal data being processed.
- To have your personally identifiable data deleted in certain situations.
- To ask for your records to be updated, if you believe they are inaccurate.
- For processing of your personal data to be restricted, which you can do in certain situations.
Whenever you have given us your consent to use your personal data, you have the right to change your mind and stop future communications. You may also object in some cases to our processing of your data where we are using our legitimate interests as the lawful basis for our processing activities or, occasionally, where we are carrying out a task in the public interest.
Please include your name, email address and postal address in your request. We may also ask for proof of your identity.
5. Sharing your information
Under some circumstances, we are required to share your personal information with third-party organisations, which include (but are not limited to):
Government departments for the purposes of taxation, pensions, and employment;
- The fundraising regulator;
- Educational authorities for the purposes of admissions and outreach activities;
- The University of Oxford or other Oxford University colleges;
- Crime prevention and law enforcement authorities where this is necessary for the prevention and detection of crime;
- UK Visas and Immigration where we are required to report information about students that are subject to visa controls;
- Professional advisors, including legal and financial advisors;
- External auditors; and
- Third-party service providers, where the sharing of personal data is necessary for the fulfilment of the service, such as for the purposes of providing security services, catering services, health and safety.
6. Our lawful grounds for processing
Performance of a contract
In certain circumstances, we may need to process your personal data to fulfil a contractual obligation we have towards you, for example if you enrol as a student at the College, if you pay to attend a conference or event, or if you give a donation and agree to Gift Aid or set up a regular gift by Direct Debit.
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity affecting St Peter’s College to law enforcement agencies. This may also be the case for some data related to employment and taxation, and for example we are required by law to provide data to HESA (Higher Education Statistics Agency).
Where the processing of personal data is required to protect the vital interests of the data subject or of another natural person, i.e. to protect someone’s life, then this may be used as the lawful basis for processing. As an example, this may be used when a student/staff member has an accident and we are required to share their personal data with the emergency services.
The processing is necessary to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. Where we need to perform a task that we believe is in the public interest or as part of an official duty, then the data subject’s consent will not be requested; this includes processing personal data for teaching and research purposes.
In specific situations, we require your data to pursue our legitimate interests in a way that might reasonably be expected when we pursue our aims and objectives as an educational organisation, and which does not materially impact your rights, freedoms or interests. Where we rely on our legitimate interests for processing your data, if there is likely to be any significant impact on your rights and freedoms as a data subject, we will carry out a legitimate interest assessment.
7. Data retention
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose(s) for which it was collected and for the purposes of satisfying any legal, accounting, regulatory or reporting requirements.
There may be some circumstances where we will keep data indefinitely, for example where we are holding it for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. We also give careful consideration to the applicable legal requirements.
In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
8. Protecting your data outside the EEA
Occasionally, we will need to share your personal data with third parties and suppliers outside of the EEA (European Economic Area). The EEA includes all EU member states as well as Iceland, Liechtenstein and Norway. We may transfer personal data that we collect from you to third-party service providers in countries that are outside of the EEA, such as the US. For example, this might be required when we store data in a Cloud service.
We have a number of controls and safeguards in place to help us ensure your data is protected, including secure transfer mechanisms and standard contractual clauses, as approved by the European Commission.
If you feel that your data has been handled incorrectly, or you are unhappy with how we have dealt with your query about the way we use your personal data, you have the right to complain to the ICO (Information Commissioner’s Office), which regulates the use of information in the UK.
You can contact the ICO on 0303 123 1113 or at https://ico.org.uk/make-a-complaint/
If you would like to discuss any aspect of this policy or the way St Peter’s College processes your information, please contact our Data Protection Officer:
- Data Protection Officer
c/o The Bursar
St Peter’s College
New Inn Hall Street
10. Approval and version control
Approved by the St Peter's College Governing Body in January 2021.
Date of next review: January 2023.